remove experimental features.

Author: bgroff

docs/apko_file.md

@@ -100,7 +100,6 @@ layer-annotations:
 layering:
   strategy: origin
   budget: 10
-  auto-annotate: true
 ```
 
 Details of each field can be found below.
@@ -275,9 +274,5 @@ It contains the following children:
 
  - `strategy`: The strategy to employ (currently, only "origin" is valid).
  - `budget`: The number of additional layers apko will use for layering.
- - `auto-annotate`: When set to `true`, automatically generates per-layer annotations with package
-   metadata using the `dev.chainguard.layer.packages` key. Each layer's annotation lists the
-   `name=version` pairs of all packages in that layer. Only meaningful when a layering strategy is
-   configured. This is opt-in because it changes the manifest digest.
 
 See [layering.md](layering.md) for more information.

internal/cli/build.go

@@ -274,7 +274,7 @@ func buildImageComponents(ctx context.Context, workDir string, archs []types.Arc
 			if err != nil {
 				return fmt.Errorf("new build for arch %s: %w", arch, err)
 			}
-			layers, perLayerAnnotations, err := bc.BuildLayers(ctx)
+			layers, err := bc.BuildLayers(ctx)
 			if err != nil {
 				return fmt.Errorf("building %q layer: %w", arch, err)
 			}
@@ -291,7 +291,7 @@ func buildImageComponents(ctx context.Context, workDir string, archs []types.Arc
 				return fmt.Errorf("failed to determine build date epoch: %w", err)
 			}
 
-			img, err := oci.BuildImageFromLayers(ctx, bc.BaseImage(), layers, perLayerAnnotations, bc.ImageConfiguration(), bde, bc.Arch())
+			img, err := oci.BuildImageFromLayers(ctx, bc.BaseImage(), layers, bc.ImageConfiguration(), bde, bc.Arch())
 			if err != nil {
 				return fmt.Errorf("failed to build OCI image for %q: %w", arch, err)
 			}

pkg/build/build.go

@@ -141,8 +141,7 @@ func (bc *Context) BuildLayer(ctx context.Context) (string, v1.Layer, error) {
 }
 
 // BuildLayers is like BuildLayer but has the potential to return multiple layers.
-// The second return value contains per-layer annotations (may be nil).
-func (bc *Context) BuildLayers(ctx context.Context) ([]v1.Layer, []map[string]string, error) {
+func (bc *Context) BuildLayers(ctx context.Context) ([]v1.Layer, error) {
 	ctx, span := otel.Tracer("apko").Start(ctx, "BuildLayers")
 	defer span.End()
 
@@ -152,10 +151,10 @@ func (bc *Context) BuildLayers(ctx context.Context) ([]v1.Layer, []map[string]st
 	if bc.ic.Layering == nil || (bc.ic.Layering.Strategy == "" && bc.ic.Layering.Budget == 0) {
 		_, layer, err := bc.BuildLayer(ctx)
 		if err != nil {
-			return nil, nil, err
+			return nil, err
 		}
 
-		return []v1.Layer{layer}, nil, nil
+		return []v1.Layer{layer}, nil
 	}
 
 	return bc.buildLayers(ctx)

pkg/build/build_test.go

@@ -42,7 +42,7 @@ func TestBuildLayers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	layers, _, err := bc.BuildLayers(ctx)
+	layers, err := bc.BuildLayers(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -64,7 +64,7 @@ func TestBuildLayersWithEmptyLayering(t *testing.T) {
 	}
 
 	// Should build successfully and return a single layer
-	layers, _, err := bc.BuildLayers(ctx)
+	layers, err := bc.BuildLayers(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}

pkg/build/layers.go

@@ -25,7 +25,6 @@ import (
 	"os"
 	"path"
 	"slices"
-	"strings"
 
 	"chainguard.dev/apko/pkg/apk/apk"
 	apkfs "chainguard.dev/apko/pkg/apk/fs"
@@ -34,21 +33,21 @@ import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 )
 
-func (bc *Context) buildLayers(ctx context.Context) ([]v1.Layer, []map[string]string, error) {
+func (bc *Context) buildLayers(ctx context.Context) ([]v1.Layer, error) {
 	log := clog.FromContext(ctx)
 
 	if strategy := bc.ic.Layering.Strategy; strategy != "origin" {
-		return nil, nil, fmt.Errorf("unrecognized layering strategy %q", strategy)
+		return nil, fmt.Errorf("unrecognized layering strategy %q", strategy)
 	}
 
 	if bc.ic.Contents.BaseImage != nil {
-		return nil, nil, fmt.Errorf("layering with %q is unsupported", "baseimage")
+		return nil, fmt.Errorf("layering with %q is unsupported", "baseimage")
 	}
 
 	// Build a single fs.FS, the normal way (this writes to bc.fs).
 	diffs, err := bc.buildImage(ctx)
 	if err != nil {
-		return nil, nil, fmt.Errorf("building filesystem: %w", err)
+		return nil, fmt.Errorf("building filesystem: %w", err)
 	}
 
 	pkgs := make([]*apk.Package, 0, len(diffs))
@@ -67,13 +66,13 @@ func (bc *Context) buildLayers(ctx context.Context) ([]v1.Layer, []map[string]st
 	//
 	// TODO: Clean this up when time permits.
 	if err := bc.postBuildSetApk(ctx); err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
 	// Use our layering strategy to partition packages into a set of Budget groups.
 	groups, err := groupByOriginAndSize(pkgs, bc.ic.Layering.Budget)
 	if err != nil {
-		return nil, nil, fmt.Errorf("grouping packages: %w", err)
+		return nil, fmt.Errorf("grouping packages: %w", err)
 	}
 	log.Infof("Building %d layers with budget %d", len(groups), bc.ic.Layering.Budget)
 
@@ -88,34 +87,10 @@ func (bc *Context) buildLayers(ctx context.Context) ([]v1.Layer, []map[string]st
 	// Then partition that single fs.FS into multiple layers based on our layering strategy.
 	layers, err := splitLayers(ctx, bc.fs, groups, pkgToDiff, bc.o.TempDir())
 	if err != nil {
-		return nil, nil, err
-	}
-
-	// Generate per-layer annotations when auto-annotate is enabled.
-	var perLayerAnnotations []map[string]string
-	if bc.ic.Layering.AutoAnnotate {
-		perLayerAnnotations = autoAnnotateLayers(groups)
+		return nil, err
 	}
 
-	return layers, perLayerAnnotations, nil
-}
-
-// autoAnnotateLayers generates per-layer annotation maps from package groups.
-// The returned slice has one entry per group (package layer); the top layer
-// (appended by splitLayers) is not included and gets no auto-annotations.
-func autoAnnotateLayers(groups []*group) []map[string]string {
-	annotations := make([]map[string]string, len(groups))
-	for i, g := range groups {
-		names := make([]string, 0, len(g.pkgs))
-		for _, pkg := range g.pkgs {
-			names = append(names, pkg.Name+"="+pkg.Version)
-		}
-		slices.Sort(names)
-		annotations[i] = map[string]string{
-			"dev.chainguard.layer.packages": strings.Join(names, ","),
-		}
-	}
-	return annotations
+	return layers, nil
 }
 
 func replacesGroup(rep string, g *group) (bool, error) {

pkg/build/layers_test.go

@@ -215,32 +215,6 @@ func TestAlignStacks(t *testing.T) {
 	}
 }
 
-func TestAutoAnnotateLayers(t *testing.T) {
-	pkg1 := &apk.Package{Name: "glibc", Version: "2.38-r14"}
-	pkg2 := &apk.Package{Name: "glibc-locale-posix", Version: "2.38-r14"}
-	pkg3 := &apk.Package{Name: "crane", Version: "0.19.0-r1"}
-
-	groups := []*group{
-		{pkgs: []*apk.Package{pkg1, pkg2}},
-		{pkgs: []*apk.Package{pkg3}},
-	}
-
-	got := autoAnnotateLayers(groups)
-	if len(got) != 2 {
-		t.Fatalf("expected 2 annotation maps, got %d", len(got))
-	}
-
-	want0 := "glibc-locale-posix=2.38-r14,glibc=2.38-r14"
-	if got[0]["dev.chainguard.layer.packages"] != want0 {
-		t.Errorf("layer 0 packages: got %q, want %q", got[0]["dev.chainguard.layer.packages"], want0)
-	}
-
-	want1 := "crane=0.19.0-r1"
-	if got[1]["dev.chainguard.layer.packages"] != want1 {
-		t.Errorf("layer 1 packages: got %q, want %q", got[1]["dev.chainguard.layer.packages"], want1)
-	}
-}
-
 // NB: this only cares about path
 func compareStacks(a, b []*file) error {
 	if len(a) != len(b) {

pkg/build/oci/image.go

@@ -38,10 +38,10 @@ import (
 )
 
 func BuildImageFromLayer(ctx context.Context, baseImage v1.Image, layer v1.Layer, oic types.ImageConfiguration, created time.Time, arch types.Architecture) (v1.Image, error) {
-	return BuildImageFromLayers(ctx, baseImage, []v1.Layer{layer}, nil, oic, created, arch)
+	return BuildImageFromLayers(ctx, baseImage, []v1.Layer{layer}, oic, created, arch)
 }
 
-func BuildImageFromLayers(ctx context.Context, baseImage v1.Image, layers []v1.Layer, perLayerAnnotations []map[string]string, oic types.ImageConfiguration, created time.Time, arch types.Architecture) (v1.Image, error) {
+func BuildImageFromLayers(ctx context.Context, baseImage v1.Image, layers []v1.Layer, oic types.ImageConfiguration, created time.Time, arch types.Architecture) (v1.Image, error) {
 	log := clog.FromContext(ctx)
 
 	// Create a copy to avoid modifying the original ImageConfiguration.
@@ -62,7 +62,7 @@ func BuildImageFromLayers(ctx context.Context, baseImage v1.Image, layers []v1.L
 	}
 
 	adds := make([]mutate.Addendum, 0, len(layers))
-	for i, layer := range layers {
+	for _, layer := range layers {
 		digest, err := layer.Digest()
 		if err != nil {
 			return nil, fmt.Errorf("could not calculate layer digest: %w", err)
@@ -76,16 +76,10 @@ func BuildImageFromLayers(ctx context.Context, baseImage v1.Image, layers []v1.L
 		log.Infof("layer digest: %v", digest)
 		log.Infof("layer diffID: %v", diffid)
 
-		// Build layer descriptor annotations from uniform + per-layer sources.
+		// Apply uniform layer annotations if configured.
 		var layerAnns map[string]string
-		if len(ic.LayerAnnotations) > 0 || (i < len(perLayerAnnotations) && len(perLayerAnnotations[i]) > 0) {
-			layerAnns = make(map[string]string)
-			maps.Copy(layerAnns, ic.LayerAnnotations)
-			if i < len(perLayerAnnotations) {
-				maps.Copy(layerAnns, perLayerAnnotations[i])
-				// Include layer digest only when auto-annotate is active (per-layer annotations present).
-				layerAnns["dev.chainguard.layer.digest"] = digest.String()
-			}
+		if len(ic.LayerAnnotations) > 0 {
+			layerAnns = maps.Clone(ic.LayerAnnotations)
 		}
 
 		adds = append(adds, mutate.Addendum{

pkg/build/oci/image_test.go

@@ -174,21 +174,15 @@ func TestBuildImageFromLayersWithAnnotations(t *testing.T) {
 	layer1 := static.NewLayer([]byte("layer1"), ggcrtypes.OCILayer)
 	layer2 := static.NewLayer([]byte("layer2"), ggcrtypes.OCILayer)
 
-	digest1, err := layer1.Digest()
-	require.NoError(t, err)
-	digest2, err := layer2.Digest()
-	require.NoError(t, err)
-
 	now := time.Now()
 	ctx := context.Background()
 
 	for _, tc := range []struct {
-		desc                string
-		cfg                 types.ImageConfiguration
-		perLayerAnnotations []map[string]string
-		wantLayerAnns       []map[string]string
+		desc          string
+		cfg           types.ImageConfiguration
+		wantLayerAnns []map[string]string
 	}{{
-		desc: "uniform layer annotations only",
+		desc: "uniform layer annotations",
 		cfg: types.ImageConfiguration{
 			LayerAnnotations: map[string]string{
 				"dev.chainguard.layer.source": "apko",
@@ -198,40 +192,14 @@ func TestBuildImageFromLayersWithAnnotations(t *testing.T) {
 			{"dev.chainguard.layer.source": "apko"},
 			{"dev.chainguard.layer.source": "apko"},
 		},
-	}, {
-		desc: "per-layer annotations only",
-		cfg:  types.ImageConfiguration{},
-		perLayerAnnotations: []map[string]string{
-			{"dev.chainguard.layer.packages": "glibc"},
-			{"dev.chainguard.layer.packages": "crane"},
-		},
-		wantLayerAnns: []map[string]string{
-			{"dev.chainguard.layer.packages": "glibc", "dev.chainguard.layer.digest": digest1.String()},
-			{"dev.chainguard.layer.packages": "crane", "dev.chainguard.layer.digest": digest2.String()},
-		},
-	}, {
-		desc: "uniform and per-layer merged",
-		cfg: types.ImageConfiguration{
-			LayerAnnotations: map[string]string{
-				"dev.chainguard.layer.source": "apko",
-			},
-		},
-		perLayerAnnotations: []map[string]string{
-			{"dev.chainguard.layer.packages": "glibc"},
-			{"dev.chainguard.layer.packages": "crane"},
-		},
-		wantLayerAnns: []map[string]string{
-			{"dev.chainguard.layer.source": "apko", "dev.chainguard.layer.packages": "glibc", "dev.chainguard.layer.digest": digest1.String()},
-			{"dev.chainguard.layer.source": "apko", "dev.chainguard.layer.packages": "crane", "dev.chainguard.layer.digest": digest2.String()},
-		},
 	}, {
 		desc:          "no annotations",
 		cfg:           types.ImageConfiguration{},
 		wantLayerAnns: []map[string]string{nil, nil},
 	}} {
 		t.Run(tc.desc, func(t *testing.T) {
 			layers := []v1.Layer{layer1, layer2}
-			img, err := BuildImageFromLayers(ctx, empty.Image, layers, tc.perLayerAnnotations, tc.cfg, now, types.ParseArchitecture(""))
+			img, err := BuildImageFromLayers(ctx, empty.Image, layers, tc.cfg, now, types.ParseArchitecture(""))
 			require.NoError(t, err)
 
 			manifest, err := img.Manifest()

pkg/build/types/schema.json

@@ -253,9 +253,6 @@
         },
         "budget": {
           "type": "integer"
-        },
-        "auto-annotate": {
-          "type": "boolean"
         }
       },
       "additionalProperties": false,

pkg/build/types/types.go

@@ -439,9 +439,8 @@ type SBOM struct {
 }
 
 type Layering struct {
-	Strategy     string `json:"strategy,omitempty" yaml:"strategy,omitempty"`
-	Budget       int    `json:"budget,omitempty" yaml:"budget,omitempty"`
-	AutoAnnotate bool   `json:"auto-annotate,omitempty" yaml:"auto-annotate,omitempty"`
+	Strategy string `json:"strategy,omitempty" yaml:"strategy,omitempty"`
+	Budget   int    `json:"budget,omitempty" yaml:"budget,omitempty"`
 }
 
 type AdditionalCertificateEntry struct {