refactor: use hermetic tar

Fixes #328

MODULE.bazel

@@ -6,7 +6,7 @@ module(
     compatibility_level = 1,
 )
 
-bazel_dep(name = "aspect_bazel_lib", version = "1.32.0")
+bazel_dep(name = "aspect_bazel_lib", version = "2.0.0-beta0")
 bazel_dep(name = "bazel_skylib", version = "1.4.1")
 bazel_dep(name = "platforms", version = "0.0.5")
 

oci/dependencies.bzl

@@ -29,7 +29,7 @@ def rules_oci_dependencies():
 
     http_archive(
         name = "aspect_bazel_lib",
-        sha256 = "f1c181b910f821072f38ee45bb87db6b56275458c7f832c54c54ba6334119eca",
-        strip_prefix = "bazel-lib-1.32.0",
-        url = "https://github.com/aspect-build/bazel-lib/releases/download/v1.32.0/bazel-lib-v1.32.0.tar.gz",
+        sha256 = "39ecbb25198950bab1cddc0f36e271f95a3e8bdb102c70e5c3ca6beb48602799",
+        strip_prefix = "bazel-lib-2.0.0-beta0",
+        url = "https://github.com/aspect-build/bazel-lib/releases/download/v2.0.0-beta0/bazel-lib-v2.0.0-beta0.tar.gz",
     )

oci/private/tarball.bzl

@@ -49,11 +49,13 @@ def _tarball_impl(ctx):
     image = ctx.file.image
     tarball = ctx.actions.declare_file("{}/tarball.tar".format(ctx.label.name))
     yq_bin = ctx.toolchains["@aspect_bazel_lib//lib:yq_toolchain_type"].yqinfo.bin
+    bsdtar = ctx.toolchains["@aspect_bazel_lib//lib:tar_toolchain_type"]
     executable = ctx.actions.declare_file("{}/tarball.sh".format(ctx.label.name))
     repo_tags = ctx.file.repo_tags
 
     substitutions = {
         "{{yq}}": yq_bin.path,
+        "{{tar}}": bsdtar.tarinfo.binary.path,
         "{{image_dir}}": image.path,
         "{{tarball_path}}": tarball.path,
     }
@@ -70,7 +72,10 @@ def _tarball_impl(ctx):
 
     ctx.actions.run(
         executable = util.maybe_wrap_launcher_for_windows(ctx, executable),
-        inputs = [image, repo_tags, executable],
+        inputs = depset(
+            direct = [image, repo_tags, executable],
+            transitive = [bsdtar.default.files],
+        ),
         outputs = [tarball],
         tools = [yq_bin],
         mnemonic = "OCITarball",
@@ -98,6 +103,7 @@ oci_tarball = rule(
     doc = doc,
     toolchains = [
         "@bazel_tools//tools/sh:toolchain_type",
+        "@aspect_bazel_lib//lib:tar_toolchain_type",
         "@aspect_bazel_lib//lib:yq_toolchain_type",
     ],
     executable = True,

oci/private/tarball.sh.tpl

@@ -3,6 +3,7 @@ set -o pipefail -o errexit -o nounset
 
 readonly STAGING_DIR=$(mktemp -d)
 readonly YQ="{{yq}}"
+readonly TAR="{{tar}}"
 readonly IMAGE_DIR="{{image_dir}}"
 readonly BLOBS_DIR="${STAGING_DIR}/blobs"
 readonly TARBALL_PATH="{{tarball_path}}"
@@ -34,5 +35,4 @@ layers="${LAYERS}" \
         --null-input '.[0] = {"Config": env(config), "RepoTags": "${repo_tags}" | envsubst | split("%") | map(select(. != "")) , "Layers": env(layers) | map( "blobs/" + . + ".tar.gz") }' \
         --output-format json > "${STAGING_DIR}/manifest.json"
 
-# TODO: https://github.com/bazel-contrib/rules_oci/issues/217
-tar -C "${STAGING_DIR}" -cf "${TARBALL_PATH}" manifest.json blobs
+${TAR} -C "${STAGING_DIR}" -cf "${TARBALL_PATH}" manifest.json blobs