Remove mariner2 (CBL-Mariner 2) support

.github/copilot-instructions.md

@@ -27,10 +27,10 @@ Always reference these instructions first and fallback to search or bash command
 - The frontend requires Docker BuildKit with buildx support
 
 ### Integration Testing
-- Run specific distro tests: `go test -timeout=59m -v ./test -run=TestMariner2` -- takes 30+ minutes. NEVER CANCEL. Set timeout to 75+ minutes.
+- Run specific distro tests: `go test -timeout=59m -v ./test -run=TestAzlinux3` -- takes 30+ minutes. NEVER CANCEL. Set timeout to 75+ minutes.
 - Run all integration tests: `go test -timeout=59m -v ./test` -- takes 45+ minutes. NEVER CANCEL. Set timeout to 75+ minutes.
 - Tests require Docker and BuildKit to be working properly
-- Tests cover multiple Linux distributions: Mariner2, Azlinux3, Jammy, Noble, Bullseye, Bookworm, etc.
+- Tests cover multiple Linux distributions: Azlinux3, Jammy, Noble, Bullseye, Bookworm, etc.
 
 ## Validation
 

.github/workflows/ci.yml

@@ -93,7 +93,6 @@ jobs:
       fail-fast: false
       matrix:
         suite:
-          - Mariner2
           - Azlinux3
           - Bookworm
           - Bullseye
@@ -110,7 +109,7 @@ jobs:
           - other
         include:
           - suite: other
-            skip: Mariner2|Azlinux3|Bookworm|Bullseye|Bionic|Focal|Jammy|Noble|Windows|Almalinux8|Almalinux9|Rockylinux8|Rockylinux9|Trixie
+            skip: Azlinux3|Bookworm|Bullseye|Bionic|Focal|Jammy|Noble|Windows|Almalinux8|Almalinux9|Rockylinux8|Rockylinux9|Trixie
 
     # TODO: support diff/merge
     # Right now this is handled by the e2e suite, but we can migrate that here.
@@ -419,8 +418,8 @@ jobs:
       - name: Build go-md2man example in docs
         run: |
           version=$(cat docs/examples/go-md2man.yml | yq .version)
-          docker build -t go-md2man:$version -f docs/examples/go-md2man.yml --target=mariner2/rpm --output=_output .
-          docker build -t go-md2man:$version -f docs/examples/go-md2man.yml --target=mariner2 .
+          docker build -t go-md2man:$version -f docs/examples/go-md2man.yml --target=azlinux3/rpm --output=_output .
+          docker build -t go-md2man:$version -f docs/examples/go-md2man.yml --target=azlinux3 .
       - name: dump logs
         if: failure()
         id: dump-logs

.github/workflows/retag/images.yml

@@ -67,9 +67,6 @@
 - source: "mcr.microsoft.com/azurelinux/distroless/base:3.0"
   dest: mirror/mcr/azurelinux/distroless/base:3.0
 
-- source: "mcr.microsoft.com/cbl-mariner/base/core:2.0"
-  dest: mirror/mcr/cbl-mariner/base/core:2.0
-
 - source: "mcr.microsoft.com/oss/go/microsoft/golang:1.24"
   dest: mirror/mcr/oss/go/microsoft/golang:1.24
 

.github/workflows/worker-images/matrix.json

@@ -1 +1 @@
-{"include":[{"target":"trixie/worker"},{"target":"bookworm/worker"},{"target":"bullseye/worker"},{"target":"bionic/worker"},{"target":"focal/worker"},{"target":"jammy/worker"},{"target":"noble/worker"},{"target":"almalinux8/worker"},{"target":"almalinux9/worker"},{"target":"rockylinux8/worker"},{"target":"rockylinux9/worker"},{"target":"mariner2/worker"},{"target":"azlinux3/worker"},{"target":"windowscross/worker"}]}
+{"include":[{"target":"trixie/worker"},{"target":"bookworm/worker"},{"target":"bullseye/worker"},{"target":"bionic/worker"},{"target":"focal/worker"},{"target":"jammy/worker"},{"target":"noble/worker"},{"target":"almalinux8/worker"},{"target":"almalinux9/worker"},{"target":"rockylinux8/worker"},{"target":"rockylinux9/worker"},{"target":"azlinux3/worker"},{"target":"windowscross/worker"}]}

docker-bake.hcl

@@ -66,7 +66,7 @@ target "maps-dep" {
         "dalec_frontend" = "target:frontend"
     }
     matrix = {
-        tgt = ["azlinux3/rpm", "mariner2/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
+        tgt = ["azlinux3/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
     }
     target = tgt
 }
@@ -81,7 +81,7 @@ target "maps-buildstep" {
         "dalec_frontend" = "target:frontend"
     }
     matrix = {
-        tgt = ["azlinux3/rpm", "mariner2/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
+        tgt = ["azlinux3/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
     }
     target = tgt
 }
@@ -96,7 +96,7 @@ target "maps-test" {
         "dalec_frontend" = "target:frontend"
     }
     matrix = {
-        tgt = ["azlinux3/rpm", "mariner2/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
+        tgt = ["azlinux3/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
     }
     target = tgt
 }
@@ -111,7 +111,7 @@ target "maps-source" {
         "dalec_frontend" = "target:frontend"
     }
     matrix = {
-        tgt = ["azlinux3/rpm", "mariner2/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
+        tgt = ["azlinux3/rpm", "jammy/deb", "noble/deb", "trixie/deb", "bookworm/deb", "bullseye/deb"]
     }
     target = tgt
 }
@@ -134,12 +134,12 @@ target "runc-azlinux" {
         "dalec_frontend" = "target:frontend"
     }
     matrix = {
-        distro = ["mariner2", "azlinux3"]
+        distro = ["azlinux3"]
         tgt = ["rpm", "container", "rpm/spec"]
     }
-    target = "mariner2/${tgt}"
+    target = "${distro}/${tgt}"
     // only tag the container target
-    tags = tgt == "container" ? ["runc:mariner2"] : []
+    tags = tgt == "container" ? ["runc:${distro}"] : []
     // only output non-container targets to the fs
     output = tgt != "container" ? ["_output"] : []
 }
@@ -170,7 +170,7 @@ target "runc-jammy" {
 target "runc-test" {
     name = "runc-test-${distro}"
     matrix = {
-        distro =["mariner2", "azlinux3", "jammy"]
+        distro =["azlinux3", "jammy"]
     }
     contexts = {
         "dalec-runc-img" = "target:runc-${distro}-container"
@@ -187,7 +187,7 @@ variable "BUILD_SPEC" {
 target "build" {
     name = "build-${distro}-${tgt}"
     matrix = {
-        distro = ["mariner2"]
+        distro = ["azlinux3"]
         tgt = ["rpm", "container"]
     }
     dockerfile = BUILD_SPEC

frontend/mux.go

@@ -58,7 +58,7 @@ const (
 //
 // When BuildMux calls a handler, it modifies the client to chomp off the
 // matched route prefix.  So a BuildMux with receiving a build target of
-// mariner2/container will match on the registered handler for mariner2 then
+// azlinux3/container will match on the registered handler for azlinux3 then
 // call the handler with the build target changed to just container.
 //
 // Finally, BuildMux sets an extra build option on the client

target.go

@@ -9,7 +9,7 @@ import (
 
 const (
 	// PreBuiltPkgSuffix is what is expected to be appended to a targetKey when it's
-	// meant to be a target distro specific package (e.g. mariner2-pkg, azlinux3-pkg,
+	// meant to be a target distro specific package (e.g. azlinux3-pkg,
 	// windowscross-pkg, bookworm-pkg, etc.). When this is provided and used to buildkit
 	// and container, it will take precedence over GenericPkg.
 	PreBuiltPkgSuffix = "-pkg"

targets/linux/distro_handler.go

@@ -187,7 +187,7 @@ func HandleSysext(c DistroConfig) gwclient.BuildFunc {
 // getPrebuiltPackage retrieves a package based on the target environment.
 // Target-specific packages (e.g., "{targetKey}-pkg") are prioritized over generic packages ("pkg").
 // This ensures compatibility with the build context and optimizes functionality for specific environments.
-// Examples of target keys include "mariner2", "azlinux3", "windowscross", and "bookworm".
+// Examples of target keys include "azlinux3", "windowscross", and "bookworm".
 func getPrebuiltPackage(ctx context.Context, targetKey string, client gwclient.Client, opts []llb.ConstraintsOpt, sOpt dalec.SourceOpts) (llb.State, bool) {
 	var pkgSt llb.State
 

targets/linux/rpm/azlinux/common.go

@@ -17,7 +17,6 @@ var (
 	}
 
 	targets = map[string]gwclient.BuildFunc{
-		Mariner2TargetKey: Mariner2Config.Handle,
 		AzLinux3TargetKey: Azlinux3Config.Handle,
 	}
 

targets/plugin/init.go

@@ -26,7 +26,6 @@ func init() {
 	targets.RegisterBuildTarget(rockylinux.V8TargetKey, rockylinux.ConfigV8.Handle)
 	targets.RegisterBuildTarget(rockylinux.V9TargetKey, rockylinux.ConfigV9.Handle)
 
-	targets.RegisterBuildTarget(azlinux.Mariner2TargetKey, azlinux.Mariner2Config.Handle)
 	targets.RegisterBuildTarget(azlinux.AzLinux3TargetKey, azlinux.Azlinux3Config.Handle)
 
 	targets.RegisterBuildTarget(windows.DefaultTargetKey, windows.Handle)

test/fixtures/env-multiple-commands.yml

@@ -9,10 +9,6 @@ vendor: Microsoft
 packager: Microsoft <support@microsoft.com>
 license: Apache 2.0
 
-targets: # Distro specific build requirements
-  mariner2:
-    dependencies:
-
 build:
   steps:
     - command: |

test/fixtures/moby-runc.yml

@@ -7,6 +7,7 @@ args:
   RUNC_COMMIT:
   REVISION: 1
   VERSION:
+  DALEC_TARGET:
 
 name: moby-runc
 description: A CLI tool for spawning and running containers according to the OCI specification.
@@ -52,8 +53,6 @@ x-azl: &azl
 targets: # Distro specific build requirements
   azlinux3:
     <<: *azl
-  mariner2:
-    <<: *azl
   jammy:
     image:
     dependencies:
@@ -91,10 +90,14 @@ build:
     CGO_ENABLED: 1
     GOGC: off
     GOFLAGS: -trimpath
+    DALEC_TARGET: "${DALEC_TARGET}"
   steps:
     - command: |
-        set -e
+        set -eu
         cd src
+        if [ "${DALEC_TARGET}" = "azlinux3" ]; then
+          export GOEXPERIMENT=nosystemcrypto
+        fi
         make man runc BUILDTAGS=seccomp
 artifacts:
   binaries:

test/linux_target_test.go

@@ -5498,7 +5498,6 @@ echo "This is a third test binary"
 		},
 		Targets: map[string]dalec.Target{
 			"azlinux3":    rpmTarget,
-			"mariner2":    rpmTarget,
 			"almalinux8":  rpmTarget,
 			"almalinux9":  rpmTarget,
 			"rockylinux8": rpmTarget,

test/multiple_artifacts_test.go

@@ -89,9 +89,9 @@ func testTargetArtifactsTakePrecedence(ctx context.Context, t *testing.T, target
 	vals := strings.Split(targetCfg.Package, "/")
 	primaryTarget := vals[0]
 	// prevent primaryTarget from being the same as secondaryTarget or tertiaryTarget
-	secondaryTarget := "mariner2"
+	secondaryTarget := "azlinux3"
 	if primaryTarget == secondaryTarget {
-		secondaryTarget = "azlinux3"
+		secondaryTarget = "almalinux9"
 	}
 	tertiaryTarget := "bookworm"
 	if primaryTarget == "bookworm" {

test/target_azlinux_test.go

@@ -37,52 +37,6 @@ metadata_expire=0
 	}
 }
 
-func TestMariner2(t *testing.T) {
-	t.Parallel()
-
-	ctx := startTestSpan(baseCtx, t)
-	cfg := testLinuxConfig{
-		Target: targetConfig{
-			Key:       azlinux.Mariner2TargetKey,
-			Package:   "mariner2/rpm",
-			Container: "mariner2/container",
-			DepsOnly:  "mariner2/container/depsonly",
-			Worker:    "mariner2/worker",
-			FormatDepEqual: func(v, _ string) string {
-				return v
-			},
-			ListExpectedSignFiles: azlinuxListSignFiles("cm2"),
-		},
-		LicenseDir: "/usr/share/licenses",
-		SystemdDir: struct {
-			Units   string
-			Targets string
-		}{
-			Units:   "/usr/lib/systemd",
-			Targets: "/etc/systemd/system",
-		},
-		Worker: workerConfig{
-			ContextName:    azlinux.Mariner2WorkerContextName,
-			CreateRepo:     createYumRepo(azlinux.Mariner2Config),
-			SignRepo:       signRepoDnf,
-			TestRepoConfig: azlinuxTestRepoConfig,
-		},
-		Release: OSRelease{
-			ID:        "mariner",
-			VersionID: "2.0",
-		},
-		SupportsGomodVersionUpdate: true,
-		Platforms: []ocispecs.Platform{
-			{OS: "linux", Architecture: "amd64"},
-			{OS: "linux", Architecture: "arm64"},
-		},
-		PackageOutputPath: rpmTargetOutputPath("cm2"),
-	}
-
-	testLinuxDistro(ctx, t, cfg)
-	testAzlinuxExtra(ctx, t, cfg, azlinux.Mariner2Config.ImageRef)
-}
-
 func TestAzlinux3(t *testing.T) {
 	t.Parallel()
 

test/windows_test.go

@@ -713,7 +713,7 @@ func getZipperState(ctx context.Context, t *testing.T, gwc gwclient.Client) llb.
 		},
 	})
 
-	sr := newSolveRequest(withSpec(ctx, t, zipperSpec), withBuildTarget("mariner2/container"))
+	sr := newSolveRequest(withSpec(ctx, t, zipperSpec), withBuildTarget("azlinux3/container"))
 	zipper := reqToState(ctx, gwc, sr, t)
 	return zipper
 }

website/docs/architecture.md

@@ -37,7 +37,7 @@ flowchart TB
 
 Detailed sequence:
 1. **BuildKit invokes the frontend** with a build context containing a Dalec spec (the spec is the effective `Dockerfile` for the custom frontend).
-2. **`BuildMux` resolves the target**: exact match, default handler, or prefix routing (e.g. `mariner2/container`). The matched handler sees the shortened target and a `dalec.target` build option that identifies the active spec target stanza.
+2. **`BuildMux` resolves the target**: exact match, default handler, or prefix routing (e.g. `azlinux3/container`). The matched handler sees the shortened target and a `dalec.target` build option that identifies the active spec target stanza.
 3. **Specs load once per build** through `LoadSpec`, which reads the spec from the Docker build context, merges build-arg substitutions (including derived platform arguments), and returns a `*dalec.Spec`.
 4. **`BuildWithPlatform` fans out per platform** requested by the client, invoking a target handler for each architecture. Handler closures return an image reference and optional `dalec.DockerImageSpec` metadata.
 5. **Handlers construct LLB graphs** using helpers from the `dalec` package to fetch sources, apply patches, run build steps, and generate artifacts (packages, root filesystems, signatures).

website/docs/developers.md

@@ -233,13 +233,12 @@ Integration tests are comprehensive and time-consuming. Run them for significant
 make test-integration
 
 # Or test a specific distribution
-make test-integration SUITE=Mariner2
 make test-integration SUITE=Azlinux3
 make test-integration SUITE=Jammy
 make test-integration SUITE=Bookworm
 ```
 
-**Available test suites**: Mariner2, Azlinux3, Bookworm, Bullseye, Bionic, Focal, Jammy, Noble, Windows, Almalinux8, Almalinux9, Rockylinux8, Rockylinux9
+**Available test suites**: Azlinux3, Bookworm, Bullseye, Bionic, Focal, Jammy, Noble, Windows, Almalinux8, Almalinux9, Rockylinux8, Rockylinux9
 
 ### Testing Specific Components
 

website/docs/examples/targets.md

@@ -41,11 +41,6 @@ jammy/deb (default)              Builds a deb package.
 jammy/dsc                        Builds a Debian source package.
 jammy/testing/container          Builds a container image for testing purposes only.
 jammy/worker                     Builds the worker image.
-mariner2/container (default)     Builds a container image for CBL-Mariner 2
-mariner2/container/depsonly      Builds a container image with only the runtime dependencies installed.
-mariner2/rpm                     Builds an rpm and src.rpm.
-mariner2/rpm/debug               Debug options for rpm builds.
-mariner2/worker                  Builds the base worker image responsible for building the rpm
 noble/deb (default)              Builds a deb package.
 noble/dsc                        Builds a Debian source package.
 noble/testing/container          Builds a container image for testing purposes only.

website/docs/image.md

@@ -42,7 +42,7 @@ Example:
 
 ```yaml
 image:
-  base: mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0
+  base: docker.io/library/ubuntu:jammy
 ```