Implement pinned tags (#41)

The optional pins.yml file can define tags to be forcibly added to the
resulting repodata.json file, ensuring that these tags are always
available for gradual upgrades.

Pin core 2.9.5 as bug workaround

Refs NethServer/dev#7047

createrepo.py

@@ -35,6 +35,14 @@
 import subprocess
 import glob
 import urllib.request
+import yaml
+
+
+try:
+    pins = yaml.safe_load(open("pins.yml"))
+except Exception as ex:
+    print("[WARNING] while parsing pins.yml:", ex, file=sys.stderr)
+    pins = {}
 
 def is_pngfile(file_path):
     kind = filetype.guess(file_path)
@@ -162,7 +170,7 @@ def is_pngfile(file_path):
             "testing": semver_tag.prerelease is not None,
             "labels": image_labels,
         }
-        print("* Add version", tag, file=sys.stderr)
+        print("* Add registry version", tag, file=sys.stderr)
         metadata["versions"].append(image_version)
 
         if semver_tag.prerelease is None:
@@ -171,6 +179,24 @@ def is_pngfile(file_path):
         else:
             testing_found = True
 
+    for tag in pins.get(entry_name, []):
+        semver_tag = semver.parse_version_info(tag)
+        try:
+            # Fetch the pinned image labels
+            with subprocess.Popen(["skopeo", "inspect", f'docker://{metadata["source"]}:{tag}'], stdout=subprocess.PIPE, stderr=sys.stderr) as proc:
+                image_inspect = json.load(proc.stdout)
+            image_labels = image_inspect['Labels']
+        except Exception as ex:
+            print(f'[ERROR] cannot inspect {metadata["source"]}:{tag}', ex, file=sys.stderr)
+            continue
+
+        image_version = {
+            "tag": tag,
+            "testing": semver_tag.prerelease is not None,
+            "labels": image_labels,
+        }
+        print("* Add pinned version", tag, file=sys.stderr)
+        metadata["versions"].append(image_version)
 
     if metadata["versions"]:
         index.append(metadata)

createrepo.sh

@@ -27,7 +27,7 @@ if ! buildah containers --format "{{.ContainerName}}" | grep -q repomd-builder;
     buildah from --name repomd-builder -v "${PWD}:/usr/src:Z" docker.io/library/python:3.11-alpine
     buildah run repomd-builder sh <<EOF
 python3 -mvenv /opt/pyenv --upgrade-deps
-/opt/pyenv/bin/pip3 install semver==3.0.1 filetype
+/opt/pyenv/bin/pip3 install semver==3.0.1 filetype PyYAML
 apk add skopeo
 EOF
 fi

pins.yml

@@ -0,0 +1,7 @@
+---
+# Since the introduction of the labels `org.nethserver.min-core` and
+# `org.nethserver.min-from` in core 2.10, we can pin specific image tags
+# to ensure they are always visible to clients, allowing for gradual
+# upgrades between breaking releases.
+core:
+  - 2.9.5 # See #7040 #7047