Conda lock import changes + environment signing/verification

MetroStar / conda-vendor

Conda package for artifact creation that enables offline environments. Ideal for air-gapped deployments.

MIT License

14 stars 8 forks source link

Conda lock import changes + environment signing/verification #32

Closed rigzba21 closed 2 years ago

rigzba21 commented 2 years ago

Upstream conda-lock has some module changes in 1.0.3 that break the current version of conda-vendor.

dependencies are now returned as a List(VersionedDependency) instead of List(str)
Channels are now returned as Channel instead of str Fixes https://github.com/MetroStar/conda-vendor/issues/33

EDIT: Adding signing + verification for generated conda environments

[ ] add cosign signing and verification to vendored conda environments
[ ] add cosign conda environment signature to meta-manifest
[ ] add in-toto attestation spec for manifest format?

rigzba21 commented 2 years ago

Just adding some notes here

Conda-lock now returns a List(VersionedDependency) instead of a List(str)

Dependency definition

class Dependency(StrictModel):
    name: str
    manager: Literal["conda", "pip"] = "conda"
    optional: bool = False
    category: str = "main"
    extras: List[str] = []
    selectors: Selectors = Selectors()

class VersionedDependency(Dependency):
    version: str
    build: Optional[str]

rigzba21 commented 2 years ago

Channels are now returned as a Channel object instead of a list of strings. See https://github.com/conda-incubator/conda-lock/blob/06e24cd0f4bd575eac5953fa6334cb4a8404fa3b/conda_lock/models/channel.py#L92

rigzba21 commented 2 years ago

trying out a simplified meta-manifest format, closer to conda-lock's:

dependencies:
- name: bzip2-1.0.8
  sha256: 60ba4c64f5d0afca0d283c7addba577d3e2efc0db86002808dadb0498661b2f2
  url: https://conda.anaconda.org/conda-forge/osx-64/bzip2-1.0.8-h0d85af4_4.tar.bz2
- name: tk-8.6.12
  sha256: 331aa1137a264fd9cc905f04f09a161c801fe504b93da08b4e6697bd7c9ae6a6
  url: https://conda.anaconda.org/conda-forge/osx-64/tk-8.6.12-h5dbffcc_0.tar.bz2
- name: tzdata-2022a
  sha256: 74d8c1fbccae1a78c9bd2b2d1cda73df425cc28717a637198c23bd1c9b53b60e
  url: https://conda.anaconda.org/conda-forge/noarch/tzdata-2022a-h191b570_0.tar.bz2

rigzba21 commented 2 years ago

closing due to https://github.com/MetroStar/conda-vendor/issues/34