2.3 KiB
ctrl/versions.env
Pinned toolchain
The single manifest ctrl/deps.sh installs from. Every entry is a single binary; none of them needs an apt repo.
- kubectl — fully static
- kind — libc only
- tilt — libc + libstdc++ + libgcc (present in base Debian)
- jq — upstream static build (Debian's is linked against libjq/libonig)
Checksums are the upstream-published SHA256 of the linux/amd64 artifact.
Bumping a pin
Change the version, then take the checksum from the release's own published list — never hand-edit or hand-copy one from a download you did. For anything hosted on GitHub releases that is:
curl -sSL https://github.com/<org>/<repo>/releases/download/<tag>/checksums.txt \
| grep linux.x86_64
(kubectl publishes its own instead: <KUBECTL_URL>.sha256.)
There was a ctrl/versions-refresh.sh named here that has never existed. If bumping stops being rare enough to do by hand, write it — but a comment pointing at a missing script is worse than no comment.
ctlptl
Creates a kind cluster WITH a local registry wired in, which is what keeps images off docker.io (an unqualified name means docker.io/library/<name>). Same publisher and same archive shape as tilt: binary at the archive root, so fetch_tgz handles it with strip=0 and no special case.
docker compose
The distro docker packages ship the daemon and the CLI but frequently not this, so docker compose up fails with "unknown command" on an otherwise working Docker. It is a CLI plugin, found by NAME in a plugin directory, so a copy in the bin dir alone only gives you the retired docker-compose v1 spelling; deps.sh links it into ~/.docker/cli-plugins.
Node images
Node images shipped with KIND_VERSION, pinned by digest so a kind upgrade can never silently move the k8s version. Profiles select one via K8S_VERSION. Older entries are kept deliberately: running a trailing-edge control plane is part of simulating a legacy estate.
Cabinets
Public services dropped in as-is, the upstream image unmodified. The same declaration installs on compose or in the cluster, so a dependency is named once and works either way. Pinned by tag rather than digest because they are ordinary upstream images with no supply chain claim attached — bump freely, and preload them for the offline profile.