feat: support rechunking using Chunkah

Add a `--chunkah` option to `bluebuild build` that rechunks the image
using [Chunkah](https://github.com/coreos/chunkah), a more modern,
content-agnostic rechunker that's actively maintained and should offer
various improvements over build-chunked-oci and the legacy rechunker.

This is implemented using a fairly generic "post-build hook" mechanism
that allows a post-processing step (such as rechunking) to be applied
after building the image but before tagging and pushing.

Author: HastD

.github/workflows/test.yml

@@ -247,6 +247,44 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
         run: just test-bluefin-build
 
+  chunkah-build:
+    timeout-minutes: 40
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read # read repo contents
+      packages: write # write test package to ghcr
+      id-token: write # docker auth
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          install-dir: /usr/bin
+          use-sudo: true
+
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: ${{ inputs.ref }}
+          repository: ${{ inputs.repo }}
+
+
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
+      - name: Run Build
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
+        run: |
+          export CARGO_HOME=$HOME/.cargo
+          just test-chunkah-build
+
   build-chunked-oci-build:
     timeout-minutes: 40
     runs-on: ubuntu-24.04
@@ -598,6 +636,42 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
         run: just test-multiplatform-buildah
 
+  multi-platform-chunkah:
+    timeout-minutes: 120
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: ${{ inputs.ref }}
+          repository: ${{ inputs.repo }}
+
+
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
+      - name: Run Build
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
+        run: just test-multiplatform-chunkah
+
   multi-platform-build-chunked-oci:
     timeout-minutes: 120
     runs-on: ubuntu-latest
@@ -821,6 +895,43 @@ jobs:
           COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
         run: just test-container-podman-build
 
+  container-podman-chunkah:
+    timeout-minutes: 60
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # read repo contents
+      packages: write # write test package to ghcr
+      id-token: write # docker auth
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+
+      - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
+        with:
+          use-cache: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          install: true
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: ${{ inputs.ref }}
+          repository: ${{ inputs.repo }}
+
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
+      - name: Run Build
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
+        run: just test-container-podman-chunkah
+
   container-podman-build-chunked-oci:
     timeout-minutes: 60
     runs-on: ubuntu-latest

Cargo.lock

@@ -94,7 +94,6 @@ clap = { workspace = true, features = ["derive", "cargo", "unicode", "env"] }
 colored.workspace = true
 comlexr.workspace = true
 indexmap.workspace = true
-indicatif.workspace = true
 log.workspace = true
 miette = { workspace = true, features = ["fancy"] }
 oci-client.workspace = true
@@ -105,8 +104,6 @@ semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 serde_yaml.workspace = true
-syntect.workspace = true
-tempfile.workspace = true
 tokio.workspace = true
 bon.workspace = true
 

Cargo.toml

@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://schema.blue-build.org/recipe-v1.json
+name: cli/test-chunkah
+description: This is my personal OS image.
+base-image: quay.io/fedora/fedora-bootc
+image-version: latest
+stages:
+  - from-file: stages.yml
+modules:
+  - from-file: common.yml

integration-tests/test-repo/recipes/recipe-chunkah.yml

@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://schema.blue-build.org/recipe-v1.json
+name: cli/test-multiplatform-chunkah
+description: This is my personal OS image.
+base-image: quay.io/fedora/fedora-bootc
+image-version: latest
+platforms:
+  - linux/amd64
+  - linux/arm64
+stages:
+  - from-file: stages.yml
+modules:
+  - from-file: common.yml

integration-tests/test-repo/recipes/recipe-multiplatform-chunkah.yml

@@ -188,6 +188,14 @@ test-bluefin-build: generate-test-secret install-debug-all-features
     -vv \
     recipes/recipe-bluefin.yml
 
+test-chunkah-build: generate-test-secret install-debug-all-features
+  cd integration-tests/test-repo \
+  && bluebuild build \
+    {{ should_push }} \
+    -vv \
+    --chunkah \
+    recipes/recipe-chunkah.yml
+
 test-build-chunked-oci-build: generate-test-secret install-debug-all-features
   cd integration-tests/test-repo \
   && bluebuild build \
@@ -256,7 +264,7 @@ test-buildah-build: generate-test-secret install-debug-all-features
     recipes/recipe-buildah.yml
 
 # Run the multi-platform builds
-test-multiplatform: test-multiplatform-docker test-multiplatform-podman test-multiplatform-buildah test-multiplatform-build-chunked-oci test-multiplatform-rechunk
+test-multiplatform: test-multiplatform-docker test-multiplatform-podman test-multiplatform-buildah test-multiplatform-chunkah test-multiplatform-build-chunked-oci test-multiplatform-rechunk
 
 test-multiplatform-docker: generate-test-secret install-debug-all-features
   cd integration-tests/test-repo \
@@ -288,6 +296,17 @@ test-multiplatform-buildah: generate-test-secret install-debug-all-features
     -vv \
     recipes/recipe-multiplatform-buildah.yml
 
+test-multiplatform-chunkah: generate-test-secret install-debug-all-features
+  cd integration-tests/test-repo \
+  && bluebuild build \
+    --retry-push \
+    --chunkah \
+    --remove-base-image \
+    -S sigstore \
+    {{ should_push }} \
+    -vv \
+    recipes/recipe-multiplatform-chunkah.yml
+
 test-multiplatform-build-chunked-oci: generate-test-secret install-debug-all-features
   cd integration-tests/test-repo \
   && bluebuild build \
@@ -351,6 +370,12 @@ test-container-podman-build: \
   generate-test-secret \
   (exec-cli-container "bluebuild" "build" "-B" "podman" "--squash" "-vv")
 
+# Run a cli container using the podman build driver with chunkah
+test-container-podman-chunkah: \
+  generate-test-secret \
+  (exec-cli-container "bluebuild" "build" "-B" \
+    "podman" "-vv" "--chunkah" "recipes/recipe-chunkah.yml")
+
 # Run a cli container using the podman build driver with build-chunked-oci
 test-container-podman-build-chunked-oci: \
   generate-test-secret \

justfile

@@ -16,7 +16,6 @@ blue-build-utils = { version = "=0.9.35", path = "../utils" }
 indicatif-log-bridge = "0.2.3"
 log4rs = { version = "1.4.0", features = ["background_rotation"] }
 nu-ansi-term = { version = "0.50.3", features = ["gnu_legacy"] }
-os_pipe = { version = "1.2.3", features = ["io_safety"] }
 signal-hook = { version = "0.4.4", features = ["extended-siginfo"] }
 sigstore = { version = "0.13.0", features = ["rustls-tls", "cached-client", "sigstore-trust-root", "sign", "cosign"], default-features = false }
 
@@ -26,15 +25,13 @@ chrono.workspace = true
 clap = { workspace = true, features = ["derive", "env"] }
 colored.workspace = true
 comlexr.workspace = true
-indexmap.workspace = true
 indicatif.workspace = true
 lazy-regex.workspace = true
 log.workspace = true
 miette.workspace = true
 nix = { workspace = true, features = ["signal"] }
 rayon.workspace = true
 oci-client.workspace = true
-reqwest.workspace = true
 semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true

process/Cargo.toml

@@ -36,9 +36,9 @@ use crate::{logging::Logger, signal_handler::DetachedContainer};
 use opts::{
     BuildChunkedOciOpts, BuildOpts, BuildRechunkTagPushOpts, BuildTagPushOpts, CheckKeyPairOpts,
     ContainerOpts, CopyOciOpts, CreateContainerOpts, GenerateImageNameOpts, GenerateKeyPairOpts,
-    GenerateTagsOpts, GetMetadataOpts, ManifestCreateOpts, ManifestPushOpts, PruneOpts, PullOpts,
-    PushOpts, RechunkOpts, RemoveContainerOpts, RemoveImageOpts, RunOpts, SignOpts, SwitchOpts,
-    TagOpts, UntagOpts, VerifyOpts, VolumeOpts,
+    GenerateTagsOpts, GetMetadataOpts, ManifestCreateOpts, ManifestPushOpts, PostBuildDriverOpts,
+    PruneOpts, PullOpts, PushOpts, RechunkOpts, RemoveContainerOpts, RemoveImageOpts, RunOpts,
+    SignOpts, SwitchOpts, TagOpts, UntagOpts, VerifyOpts, VolumeOpts,
 };
 use types::{
     BootDriverType, BuildDriverType, CiDriverType, ImageMetadata, InspectDriverType, RunDriverType,
@@ -67,6 +67,7 @@ mod local_driver;
 mod oci_client_driver;
 pub mod opts;
 mod podman_driver;
+pub mod post_build;
 mod rpm_ostree_driver;
 mod rpm_ostree_runner;
 mod sigstore_driver;
@@ -325,7 +326,11 @@ fn get_version_run_image(oci_ref: &Reference) -> Result<Version> {
     }
 
     if should_remove {
-        Driver::remove_image(RemoveImageOpts::builder().image(oci_ref).build())?;
+        Driver::remove_image(
+            RemoveImageOpts::builder()
+                .image(&oci_ref.to_string())
+                .build(),
+        )?;
     }
 
     progress.finish_and_clear();
@@ -396,6 +401,15 @@ impl BuildDriver for Driver {
     }
 }
 
+impl PostBuildDriver for Driver {
+    fn build_tag_push_with_post_build(
+        opts: BuildTagPushOpts,
+        pb_opts: PostBuildDriverOpts,
+    ) -> Result<Vec<String>> {
+        PodmanDriver::build_tag_push_with_post_build(opts, pb_opts)
+    }
+}
+
 macro_rules! impl_signing_driver {
     ($func:ident($($args:expr),*)) => {
         match Self::get_signing_driver() {

process/drivers.rs

@@ -352,7 +352,8 @@ impl ImageStorageDriver for BuildahDriver {
                 sudo_check = opts.privileged,
                 "buildah",
                 "rmi",
-                opts.image.to_string(),
+                "--",
+                opts.image,
             );
             trace!("{c:?}");
             c