Fix release notebook dependency source - #902
Closed
msarahan wants to merge 2 commits into
Closed
Conversation
Feedback from James is that the purpose of this PR was not clear, and that the summary was pretty heavy on jargon. The jargon did not phase me, presumably because I've been swimming in this stuff for longer/deeper. The purpose of this PR is to surface image contents in better ways. As part of our release process, the images that this repo produces get scanned with various tools to find CVEs and malware. These tools are prone to misidentifying some components, and that has been especially true for conda packages historically. We have frequently needed to override the detected package lists/SBOM via JIRA tickets with our security tools team. Part of filing those tickets is providing them with the actual contents of the images, which we often have to discover by looking into build logs. That's where this PR comes in. Instead of looking at build logs, we should export our known environment information to a more readily usable location. In theory, this could replace the scans, but I think it's better to keep doing the scans and use our manifests as validation/correction where necessary. That keeps us in line with how security tools team manages other projects. **Posted by Codex (GPT-5.6) on behalf of Michael Sarahan. Treat this description as LLM-generated.** ## Summary Add a signed, OCI-referrer RAPIDS image provenance manifest for published `base` and `notebooks` image digests. - Export exact `conda-meta` package facts through minimal BuildKit targets rather than downloading image layers. - Attach a platform-specific manifest to every pushed architecture image, then attach a multiarch index manifest that links those platform records. - Record the image digest, platform, source SHA, workflow URL, build arguments, and conda package name/version/build/channel/source URL. - Keylessly sign each attached OCI artifact with GitHub Actions OIDC and Cosign. - Keep pURLs explicitly unmapped until a verified upstream mapping is available; this intentionally does not invent `pkg:conda/...` identifiers. ## Relationship to rapidsai#805 rapidsai#805 is complementary. It generates and embeds a CycloneDX SBOM in the final image. This change makes digest-bound build facts discoverable as registry metadata and supplies the platform-to-multiarch relationship needed by scan triage without pulling image layers. If rapidsai#805 lands, the preferred follow-up is to add its SBOM digest/reference to this manifest rather than maintain a separate provenance model. Its Dockerfile stage renaming will require a small conflict resolution in this branch's `provenance-base` and `provenance-notebooks` export targets.
Use the release branch for notebook dependency inputs when building an alpha release branch, so the solve stays aligned with the RAPIDS release packages. Created with Codex (GPT-5).
jameslamb
approved these changes
Aug 3, 2026
Contributor
Author
|
superseded by #904 |
rapids-bot Bot
pushed a commit
that referenced
this pull request
Aug 3, 2026
This reverts commit f33fc76. This broke and should not have been merged into the release branch. Revert and re-do on main. See #901 and #902 for more info. Authors: - Mike Sarahan (https://github.com/msarahan) Approvers: - James Lamb (https://github.com/jameslamb) URL: #903
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-merger in #901 failed because of this issue. I botched this with Codex on the first try - it pushed a merge with main into release/26.08. I enabled force-push to undo that, then disabled force-push. I think the next correct steps are to evaluate/merge this, then update #901 and hopefully both this and the original changes from #901 will be merged into main with that PR.
Posted by Codex (GPT-5) on behalf of msarahan. Treat this PR description as LLM-generated.
Release alpha builds currently source notebook dependency inputs from
main, which can request next-release packages (for examplecudf=26.10) while the image build deliberately installs RAPIDS 26.08.When the workflow runs on a
release/YY.MMbranch, this change instead reads the notebook dependencies from that same release branch. Main alpha builds and final-release tags retain their existing source selection.