Dedicated plugin for `deb-security-manifest`

[Leon]

What needs to get done

oci-factory's IMAGE_MAINTAINER_AGREEMENT requires having a generic part in rocks that stage debs.

It would be super handy to have this as a plugin.

Why it needs to get done

It could reduce boilerpalte from the brittle

  deb-security-manifest:
    plugin: nil
    after:
      - alertmanager
      - ca-certs
    override-prime: |
      set -x
      mkdir -p $CRAFT_PRIME/usr/share/rocks/
      (echo "# os-release" && cat /etc/os-release && echo "# dpkg-query" && dpkg-query --admindir=$CRAFT_PRIME/var/lib/dpkg/ -f '${db:Status-Abbrev},${binary:Package},${Version},${source:Package},${Source:Version}\n' -W) > $CRAFT_PRIME/usr/share/rocks/dpkg.query

to the concise

  deb-security-manifest:
    plugin: deb-security-manifest
    after:
      - alertmanager
      - ca-certs

[Cristovao Cordeiro]

Hi @sed-i ! Albeit understanding the current overhead of generating such a manifest, the current efforts are being put into proper cataloguing mechanisms that will replace this manifest. @cmatsuoka has been working on this.

[Luca Bello]

Hey @cjdcordeiro @cmatsuoka , is there an approximate ETA on this? We're currently adding the security manifest to all of our ROCKs, but if it's something I have to scrap in a week or so, I'd rather wait :)

[Cristovao Cordeiro]

Not in the short term for sure. But I'll let @cmatsuoka provide a more accurate estimate

[Claudio Matsuoka]

I don't have an estimate, I suggest using alternate methods if you need it in the short term.

[Cristovao Cordeiro]

Noted @cmatsuoka

I think we'll need to live with the custom security manifests for a while.