October 2023 Summaries

BazelCon in Munich featured several significant announcements from Aspect, including the introduction of bazel lint support, which integrates formatting and linting tools and offers a new lint command for enhanced code review processes. The release of bazel-lib 2.0 was highlighted, introducing a new tar rule, while improvements in rules_py aimed to align Python program organization with ecosystem standards. Aspect's partnership with Chainguard addressed supply-chain security by releasing rules_apko, enabling secure base image assembly. Keynote speeches and talks covered various topics, including the challenges of supporting diverse programming languages and showcasing Aspect's products and services.

At BazelCon 2023, the general availability of rules_apko, an open-source plugin for Bazel, was announced, enabling the creation of secure, minimal Wolfi-based container images through Bazel's build system. Developed by Chainguard, this plugin facilitates the production of distroless container images with low security vulnerabilities by integrating Wolfi's un-distro and APK packages into OCI-compliant images, ensuring a complete software bill of materials (SBOM). By using rules_apko, Bazel users can incorporate these images into their existing workflows, eliminating the need for external base image updates and deprecated APIs, while enhancing supply chain security and reproducibility. The plugin supports fully offline builds, integrity verification of packages, and is capable of building images containing any application code across different languages, providing a streamlined path for developing secure container images in enterprise applications.

The blog post provides an in-depth look at the processes behind maintaining and releasing Bazel rules by Aspect, emphasizing the importance of automating releases to ensure efficiency and supply-chain security. It discusses the challenges of distributing tools without exposing dependencies to users, highlighting the effort to simplify user experiences when switching between tagged releases and source archives. The post explains the workflow using GitHub Actions to automate tests and releases, the use of integrity hashes to maintain toolchain consistency, and the strategic use of Bazel's configuration options to manage dependencies efficiently. Aspect's commitment to open-source contributions is evident as they share their methodology for seamless releases, underscoring their significant role in the Bazel Central Registry.