image: include files from git reproducibly

[burgerdev]

Context

Our image build includes source files from git. Since git respects the users umask, the files in the image might have different permissions depending on the system executing the build.

Proposed change(s)

• Add a new Bazel rule reproducible_tar that normalizes git subtrees for image inclusion.

Additional info

The added rule depends on gnutar and is unlikely to work on vanilla darwin (cc @elchead). This trades off portability for correctness of the rootfs. Some alternatives:

• Use pkg_tar with a mode 0555. Downside: our config files are now executable.
• Split sources for inclusion into two subtrees by desired permission bits. Downside: more rules, unintuitive layout.
• Explicitly list the files that should be executable in pkg_tar(modes={}). Downside: need to maintain names in two places.

Checklist

• Run the E2E tests that are relevant to this PR's changes
  • [ ] sonobuoy-quick with fresh image on GCP
  • sonobuoy-quick with fresh image on GCP
  • reproducible builds
• Add labels (e.g., for changelog category)
• Is PR title adequate for changelog?
• Link to Milestone

[netlify]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	0747305
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/67640780c0db8800085c2660

[msanft]

The added rule depends on gnutar and is unlikely to work on vanilla darwin (cc @elchead). This trades off portability for correctness of the rootfs.

Why aren't you able to use GNU tar on Darwin? Do they require exotic syscalls that Darwin doesn't support?

[msanft]

Thanks for spotting this! Changes LGTM

[msanft]

Should we put a notice here that this requires GNU tar? Maybe explicitly target that notice to MacOS users, so they know that they have to install package X to run this.

[elchead]

Seems fine by me because building images needs to be done in the CI anyways

[burgerdev]

Unfortunately, I was ignorant of the heavy lifting that rules_pkgs does here when it comes to figuring out the correct paths. Fixing it requires reimplementing a lot of things, so I'd rather opt for the much simpler alternative (a), making everything executable.