Update go-containerregsitry dependency to 0.4.1

[imjasonh]

PR Checklist

Please check if your PR fulfills the following requirements:

• [n] Tests for the changes have been added (for bug fixes / features)
• [n] Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• Other... Please describe:

What is the current behavior?

Issue Number: #1814

What is the new behavior?

This updates the go-containerregistry dependency from 0.1.4 (October 2020) to 0.4.1 (March 2021)

This removes a dependency on a non-deterministic package resulting in inconsistent archive SHAs generated by GitHub's archive server. That upstream issue was also fixed in kubernetes/kubernetes#99376.

Other than removing this non-determinism, no major functional changes are expected. Some performance improvements and bugfixes have been added since 0.1.4, which might be beneficial.

Does this PR introduce a breaking change?

• Yes
• No

Other information

[steeve]

Thank you for being so reactive, but 👎

Github branch/commit tarballs are dynamically generated. Don't depend on them having a stable SHA256. If the upstream rule is not distributing built artefacts, you'll need to use git_repository or go_repository or whatever rule that is stable.

In this case, use go_repository's commit and remote to pin a specific commit.

[imjasonh]

I've updated this PR to use commit and importpath for go-containerregistry.

I haven't touched the other dependencies, but I can update those if you'd like.

[steeve]

Not my call, but I feel this could be a good idea. Or let go_repository pull them as in module mode maybe?

[uhthomas]

The go_repository target is missing the sum attribute. The module downloaded through this rule will not be verified and poses a security risk.

[steeve]

The go_repository target is missing the sum attribute. The module downloaded through this rule will not be verified and poses a security risk.

It is not downloaded as a module, but via a git commit, which is safe.

[uhthomas]

The go_repository target is missing the sum attribute. The module downloaded through this rule will not be verified and poses a security risk.

It is not downloaded as a module, but via a git commit, which is safe.

Downloading an archive just based on a git commit is not safe. All content must be verified, whether it be through the sum or sha256 attributes.