Skip to content

Feature commit for alibuild 2.0 - #1038

Draft
ktf wants to merge 5 commits into
alisw:masterfrom
ktf:pr1038
Draft

Feature commit for alibuild 2.0#1038
ktf wants to merge 5 commits into
alisw:masterfrom
ktf:pr1038

Conversation

@ktf

@ktf ktf commented Jul 2, 2026

Copy link
Copy Markdown
Member
  • Add new provenance tracking remote store back-end. Modeled after Google's
    REAPI.
  • Add install sub command to install packages without alidist and the need to build them.
  • Add reconstruct sub command to rebuild a tarball using the provenance information stored
    in the remote store ledger.
  • Add migrate sub command to populate the new reapi store with packages from the old store
  • Code-signing support for official tarballs

Stack created with Sapling. Best reviewed with ReviewStack.

@ktf ktf changed the title Add reconstruct, migrate, install commands to support the new REAPI backend Feature commit for alibuild 2.0 Aug 6, 2026
@ktf
ktf force-pushed the pr1038 branch 13 times, most recently from c0fcc96 to c1bed60 Compare August 12, 2026 18:36
@ktf
ktf force-pushed the pr1038 branch 6 times, most recently from b66845d to 73e470c Compare August 19, 2026 13:54
ktf added 4 commits August 25, 2026 17:17
Publishing writes the package symlink, the dist symlinks and the tarball,
with no transaction between them. A build killed part-way left the remote in
a state every later build refused to touch ("already exists on S3 but ...
does not", or "Conflicts detected" among the dist symlinks) until someone
cleaned it up by hand, and clients following the symlink got 404s meanwhile.

Write the package symlink with If-None-Match: * and let it arbitrate who
owns the revision. If it points at the store path we are about to write, any
leftovers are our own and we complete the publish; anything else still
aborts. Losing the claim to a build of the same hash is fine, but that build
may itself have died, so check for its tarball instead of assuming it will
finish.

The store must honour If-None-Match (CERN's Ceph RGW verifiably does);
ignoring it would silently restore the old racy behaviour, so there is no
fallback. botocore support is checked up front, and read-only use is
unaffected.
@ktf
ktf force-pushed the pr1038 branch 4 times, most recently from 5688b9e to 96dda74 Compare September 1, 2026 10:07
* Add new provenance tracking remote store back-end. Modeled after Google's
  REAPI.
* Add install sub command to install packages without alidist and the need to build them.
* Add reconstruct sub command to rebuild a tarball using the provenance information stored
  in the remote store ledger.
* Add migrate sub command to populate the new reapi store with packages from the old store
* Code-signing support for official tarballs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant