oxipng/9.1.4 package update

[octo-sts]

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

Since no specific error message is shown in the build output, and the build appears to complete successfully (indicated by "wrote packages/x86_64/oxipng-9.1.4-r0.apk"), I'll analyze potential issues with the Melange YAML file and suggest improvements for robustness:

• Error Category: Configuration
• Failure Point: No immediate failure, but potential reliability concerns
• Root Cause Analysis: The YAML file could benefit from additional build requirements and test coverage

• Suggested Fix:

package:
  name: oxipng
  version: "9.1.4"
  epoch: 0
  description: Multithreaded PNG optimizer written in Rust
  copyright:
    - license: MIT
  dependencies:
    runtime:
      - glibc
      - libgcc
      - libm

environment:
  contents:
    packages:
      - rust-1.84
      - cargo-auditable
      - build-base
  environment:
    RUSTFLAGS: "-C linker=/usr/local/bin/gcc"
    CARGO_HOME: "/tmp/cargo"
    CARGO_NET_OFFLINE: "true"

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/shssoichiro/oxipng
      tag: v${{package.version}}
      expected-commit: bc8c36456858fe4678460bdea520a4ec0bc50dc4

  - uses: cargo/build
    with:
      output: ${{package.name}}
      cargo-auditable: true

  - uses: strip

• Explanation:

1. Added explicit runtime dependencies based on the scan output
2. Added build environment packages explicitly
3. Added CARGO_HOME and CARGO_NET_OFFLINE for build reproducibility
4. Enabled cargo-auditable for better security tracking

• Additional Notes:

• The build succeeds but could be more robust with explicit dependencies
• Consider adding more comprehensive tests
• Security scanning with cargo-audit might be valuable
• Runtime dependencies match the scanning output

• References:

• Cargo Build Documentation: https://doc.rust-lang.org/cargo/commands/cargo-build.html
• Melange Rust Package Guide: https://github.com/chainguard-dev/melange/blob/main/docs/rust.md

Would you like me to explain any part of these suggestions in more detail?

[OddBloke]

Converted to Draft as I'm iterating on an arm build failure in CI

[OddBloke]

We've escalated this internally as it's a toolchain type issue.