refactor release process to use ko to build the images

[cpanato]

Summary

• add more platforms when building the binaries
• use ko to build/push the container images

Ticket Link

n/a

Release Note

 refactor release process to use ko to build the images

[cpanato]

using this change
rehearsal release: https://github.com/cpanato/cosign/releases/tag/v99.999.00-ko

images:

• gcr.io/cpanato-general/cosign:v99.999.00-ko
• gcr.io/cpanato-general/cosigned:v99.999.00-ko
• gcr.io/cpanato-general/sget:v99.999.00-ko

manifest

$ crane manifest gcr.io/cpanato-general/cosign:v99.999.00-ko | jq .
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
  "manifests": [
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1079,
      "digest": "sha256:7d79c85423a9a8fee1d234928b0b5055e2e6f8506632c89254bfa9914bf8e9da",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1079,
      "digest": "sha256:b2488b0ffd4a74b44c6c7947d971f0b28f0659b80db5ba46cdf465a26d71a3dd",
      "platform": {
        "architecture": "arm",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1079,
      "digest": "sha256:ff0d0eee17ef9e732f267f295e31541d25be645bb7e379be24534a74726c8350",
      "platform": {
        "architecture": "arm64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1079,
      "digest": "sha256:6980255de9178617844f3e3b82140f6a69f38fc04d223237a05e9063f84cb549",
      "platform": {
        "architecture": "ppc64le",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1079,
      "digest": "sha256:3392a254f17fb3846ea454dffe04b6b16044aa0e8d869eda5e49108ac1ff9f1c",
      "platform": {
        "architecture": "s390x",
        "os": "linux"
      }
    }
  ]
}

cosign version:

$ docker run gcr.io/cpanato-general/cosign:v99.999.00-ko version
Unable to find image 'gcr.io/cpanato-general/cosign:v99.999.00-ko' locally
v99.999.00-ko: Pulling from cpanato-general/cosign
e8614d09b7be: Already exists
c6f4d1a13b69: Already exists
601401253d0a: Already exists
250c06f7c38e: Already exists
cb7a34949835: Pull complete
Digest: sha256:2c6befdb93e10a051c228178b2a8911060958862f2e4d57597eefc04f5acb6e7
Status: Downloaded newer image for gcr.io/cpanato-general/cosign:v99.999.00-ko
GitVersion:    v99.999.00-ko
GitCommit:     494758efeb750839eb73d759bd4459fc96219573
GitTreeState:  clean
BuildDate:     '2021-11-07T16:21:36Z'
GoVersion:     go1.17.3
Compiler:      gc
Platform:      linux/amd64

[imjasonh]

Is there a reason you don't want KO_DOCKER_REPO=${KO_PREFIX} ko publish --base in these? This will have the same effect as you have now without having to set KO_DOCKER_REPO separately each time.

[cpanato]

--base does not exist i just found --base-import-paths but the issue is the cosigned image name we build the build path is cmd/cosign/webhook so the image will be called webhook instead of cosigned but then I guess we can use the current approach for this

[cpanato]

did some changes based on your feedback @imjasonh , can you please take another look?

thanks so much for your time to review this pull request

[developer-guy]

can't we add them to the LDFLAGS environment variable as the ossf/scorecard project did? @cpanato

[cpanato]

we can, but here define that as well, not sure what is the best

[mattmoor]

Awesome. We should be able to delete the Dockerfiles too (didn't spot it here on a quick scan).

[mattmoor]

I now see the linked PR (and they are gone at HEAD)! Awesome.