Append `rc` or `unstable` to version tags of unstable versions

[DerRockWolf]

Unstable images are already tagged with additional tags identifying that they are unstable.

In addition it would be very useful, when using e.g. renovate bot for update automation, if the tags containing the version number would be suffixed with -rc or -unstable resulting in 1.35.0-rc instead of 1.35.0. This would keep Renovate from bumping to unstable versions and would remove the need to manually check if the image is stable or not.

[tianon]

See https://busybox.net/ -- we use BusyBox upstream's version numbers verbatim, and they unfortunately do not differentiate unstable in any way more than it's usually the .0 release of a new minor.

[DerRockWolf]

Ok then I have to live with that unfortunately. If release .0 is always unstable I at least can ignore the PRs. Thanks for your help :)

[nickovs]

Unfortunately the .0 tag is not always unstable. The current stable version is 1.35.0, as per the commit message on 1_35_stable branch.

It would be nice if busybox:latest was updated to be 1.35.0 when you have the time!

[tianon]

https://busybox.net/ still lists 1.35.0 as "unstable" and if you look historically on that page, the .0 is always unstable -- I think the 1_35_stable branch probably exists specifically so that a future 1.35.1 (stable) branch could be cut from it.

However, I do think that given the unique way that BusyBox uses the common "stable" and "unstable" terms, we probably should move latest to point to the latest version number (which as of #160 will be 1.36.0).

Full list of BusyBox website versions, for context:

```console $ wget -qO- 'https://busybox.net' | grep -ioE '[0-9a-zA-Z ]+ -- BusyBox [0-9.]+ [(](un)?stable[)]' | sed -re 's/(.*) -- (.*)/\2\t\1/' | column -ts$'\t' -R2 BusyBox 1.36.0 (unstable) 3 January 2023 BusyBox 1.35.0 (unstable) 26 December 2021 BusyBox 1.33.2 (stable) 30 November 2021 BusyBox 1.34.1 (stable) 30 September 2021 BusyBox 1.34.0 (unstable) 19 August 2021 BusyBox 1.33.1 (stable) 3 May 2021 BusyBox 1.32.1 (stable) 1 January 2021 BusyBox 1.33.0 (unstable) 29 December 2020 BusyBox 1.32.0 (unstable) 26 June 2020 BusyBox 1.31.1 (stable) 25 October 2019 BusyBox 1.31.0 (unstable) 10 June 2019 BusyBox 1.30.1 (stable) 14 February 2019 BusyBox 1.30.0 (unstable) 31 December 2018 BusyBox 1.29.3 (stable) 9 September 2018 BusyBox 1.29.2 (stable) 31 July 2018 BusyBox 1.29.1 (stable) 15 July 2018 BusyBox 1.29.0 (unstable) 1 July 2018 BusyBox 1.28.4 (stable) 22 May 2018 BusyBox 1.28.3 (stable) 3 April 2018 BusyBox 1.28.2 (stable) 26 March 2018 BusyBox 1.28.1 (stable) 15 February 2018 BusyBox 1.28.0 (unstable) 2 January 2018 BusyBox 1.27.2 (stable) 17 August 2017 BusyBox 1.27.1 (stable) 18 July 2017 BusyBox 1.27.0 (unstable) 3 July 2017 BusyBox 1.26.2 (stable) 10 January 2017 BusyBox 1.26.1 (stable) 2 January 2017 BusyBox 1.26.0 (unstable) 20 December 2016 BusyBox 1.25.1 (stable) 7 October 2016 BusyBox 1.25.0 (unstable) 22 June 2016 BusyBox 1.24.2 (stable) 24 March 2016 BusyBox 1.24.1 (stable) 24 October 2015 BusyBox 1.24.0 (unstable) 12 October 2015 BusyBox 1.23.2 (stable) 23 March 2015 BusyBox 1.23.1 (stable) 27 January 2015 BusyBox 1.23.0 (unstable) 23 December 2014 BusyBox 1.22.1 (stable) 20 January 2014 BusyBox 1.22.0 (unstable) 1 January 2014 BusyBox 1.21.1 (stable) 29 June 2013 BusyBox 1.21.0 (unstable) 21 January 2013 BusyBox 1.20.2 (stable) 2 July 2012 ```

[tianon]

Upon further consideration, I think we really ought to probably go even further here and no longer package "stable" and "unstable" but rather "latest major.minor" and "second-latest major.minor" (which today would give us 1.35.0 and 1.36.0 instead of 1.36.0 and 1.34.1, which is kind of a weird mix just because 1.34 happened to have a .1 release and 1.35 hasn't yet) but I'm not sure where that leaves us with the "stable" and "unstable" aliases. Perhaps they come and go based on whether our two releases are stable or unstable? (ie, we'd have busybox:unstable which would point to 1.36.0 but we would stop updating busybox:stable for now until there's a new .1 release)

[nickovs]

https://busybox.net/ still lists 1.35.0 as "unstable" and if you look historically on that page, the .0 is always unstable -- I think the 1_35_stable branch probably exists specifically so that a future 1.35.1 (stable) branch could be cut from it.

I stand corrected!

However, I do think that given the unique way that BusyBox uses the common "stable" and "unstable" terms, we probably should move latest to point to the latest version number (which as of https://github.com/docker-library/busybox/pull/160 will be 1.36.0).

As for where to point latest, there's plenty of precedent either way. For instance, ubuntu:latest currently points to ubuntu:22.04 because that's the latest LTS version.

[tianon]

Yeah, latest is a bit of a misnomer (that we as a container community can't really correct reasonably at this point) -- I interpret :latest not as "what's the latest release" but rather "what should I choose to use if I don't know what I need" which matches Ubuntu pointing to the latest LTS release instead of the latest rolling release.

[nickovs]

I believe that what happened with 1.35 is that it turned out that 1.35.0 was plenty stable enough, so it never got a point release, so it never got a new tag. So, ironically, by being too stable it never got marked as stable.

[nickovs]

Yeah, latest is a bit of a misnomer (that we as a container community can't really correct reasonably at this point) -- I interpret :latest not as "what's the latest release" but rather "what should I choose to use if I don't know what I need" which matches Ubuntu pointing to the latest LTS release instead of the latest rolling release.

By that measure busybox:latest should probably point to the highest numbered version that is either marked as stable or is on a branch that is marked stable and is more than <threshold age> old. Version 1.35.0 is more than a year old and as such is de facto stable. Once a branch is stable the Busybox team don't add any new functions, they just seem to do bug fixes.

FWIW, the CVE mentioned in #133 may result in a 1.35.1 being release; if so they might even mark it as stable!

[tianon]

Refactored in https://github.com/docker-library/busybox/pull/161 :+1: