← Back to issue list

Add support for pinning the build and build-base images

View original Github issue

Metadata

Project
rockcraft
Number
#459
Type
issue
State
open
Author
arturo-seijas
Labels
Created
Updated
Closed

Current evaluation

Feature request to pin build and build-base images by digest in rockcraft descriptors for repeatable builds and renovate-driven updates. Open 951 days, no labels, zero maintainer comments, no assignee. Code confirms base types are still Literal strings with no digest support.

Suggested action: needs triage

Reason: The issue has no labels, no maintainer comments, and no assignee after 951 days. Code inspection confirms BaseT and BuildBaseT in project.py are still Literal types (e.g. 'ubuntu@24.04') with no digest-pinning support, and RockcraftImageService fetches bases by name only. The feature remains unimplemented and relevant, so it needs a maintainer to triage and decide whether to scope it.

Impact: 45 Quick Win: 20.25 Staleness: 75 Complexity: 55 Confidence: 75 Support Request: 10

Issue body

### What needs to get done Add support for pinning the build and build-base images in the rockcraft descriptors to an existing image diggest ### Why it needs to get done The motivation for this request is twofold: - Support repeatable builds, with all the advantages this entails - Trigger new builds when the base or build-base image changes using widely adopted mechanisms like [renovate](https://github.com/renovatebot/renovate). Right now there's [a workaround to support this](https://github.com/canonical/synapse-operator/blob/main/synapse_rock/rockcraft.yaml#L9) but since the base images are not pinned the resulting OCI image can be updated alongside any other change before the PR is merged

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 45
Quick Win: 20.25
Staleness: 75
Complexity: 55
Confidence: 75
Support Request: 10
needs triage Feature request to pin build and build-base images by digest in rockcraft descriptors for repeatable builds and renovate-driven updates. Open 951 days, no labels, zero maintainer comments, no assignee. Code confirms base types are still Literal strings with no digest support.
qwen/qwen3.6-35b-a3b
Staleness: 85
Complexity: 40
Confidence: 75
Support Request: 5
needs triage Feature request to add digest pinning for build and build-base images in rockcraft descriptors. Enables repeatable builds and automated base image updates. Currently unlabelled, has zero maintainer comments, and has been inactive for over two years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 88
Complexity: 45
Confidence: 80
Support Request: 5
needs triage Feature request to add digest pinning for build and build-base images in rockcraft descriptors to enable reproducible builds and automated base image updates. Currently unlabelled and inactive for over two years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 90
Complexity: 60
Confidence: 75
Support Request: 10
needs triage Feature request to add digest pinning for build and build-base images in rockcraft descriptors to enable reproducible builds and automated base image updates. Currently unlabelled and inactive for over a year.
qwen3.6-35b-a3b-mtp-q6
Staleness: 85
Complexity: 45
Confidence: 80
Support Request: 5
needs triage Request to pin build and build-base images to specific digests in rockcraft descriptors for reproducible builds and automated updates. Open, inactive for 304 days, with zero comments and no labels. Needs triage and assignment.

Update history

No update history recorded yet.

Related issues

No related issues found above the similarity threshold.