Three related bugs in the git smart-HTTP upload-pack handler surfaced as
'bad band #78', 60s 504 hangs, and "expected ACK/NAK, got '?PACK'" when
fetching after previous pulls.
- Don't advertise no-done; we don't implement the ACK ready handshake.
- With multi_ack_detailed, don't emit per-round NAKs — only the final
one after 'done'. Per-round NAKs make the client treat the first as
the transition to sideband pack data, then choke on the second.
- Break out of the negotiation loop when a round reads no content
(client closed without 'done') so we don't spin on EOF.
- Only emit pack data when 'done' was actually received. Non-final
rounds get just NAK so HTTP keep-alive doesn't desync the next round.
Also trigger null_resource.test on the ko_build image digest so tests
re-run on every deploy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
gitLayer now returns the commit it checked out (dereferencing annotated
tags). build records it, the clone URL, and the ref name as
me.kontain.git.{commit,source,ref} annotations on the checkout layer's
manifest descriptor, so the commit a :branch / :tag / :latest pull
resolved to is visible from the image manifest. The test now also checks
gitLayer's returned commit matches what resolveRef resolved.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The layer's entries were root-owned, but cgr.dev/chainguard/git runs as
uid 65532, so `git fetch`/`git commit` inside the checkout failed with
"Permission denied" creating .git/FETCH_HEAD. Stamp the base image's
runtime uid/gid onto every layer entry, and explicitly emit the
checkout's parent directories (git/, git/<repo>/, git/<repo>/.git/) so
the image extractor doesn't auto-create them root-owned.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
git.kontain.me used to clone+checkout a repo onto Cloud Run's tmpfs (memory)
and then tar the result. Now it fetches the packfile into an in-memory git dir,
walks the requested commit's tree, and streams each blob straight into the
layer tar. Only the packfile bytes (plus go-git's delta cache) are buffered, so
memory no longer scales with the size of the checked-out worktree.
The shipped .git directory is preserved (with core.bare unset and a generated
index) so the git CLI still works inside the checkout. Object SHAs change since
the tar is rebuilt differently, but the contents are the same.
https://claude.ai/code/session_01Jfhuuwb5haNaasc9hs53jw
- remove some apps (cowsay, transparency, estargz)
- start to move DNS zone management into TF too (optional)
- update GH workflow to deploy using TF
TODO:
- store state in GCS
- define one-time setup to grant GHA SA permissions it needs to deploy
- documentation for Future Jason
- cosign_verify base images
- cosign_sign images and cosign_verify before deploy
- previous change to support registries that don't support HEAD in
flatten broke flatten for other conformant registries; fix that
- support registies that don't support HEAD in mirror (without breaking
conformant registries)
