Reinventing the wheel
Fast first-time builds for charmcraft—on a local machine or CI
Install pipx: https://pipx.pypa.io/stable/installation/
pipx install charmcraftcache
ccc add
ccc pack
For best results, add charm-strict-dependencies: true to your charmcraft.yaml.
Instead of downloading wheels from PyPI (which pip does by default), charmcraft builds Python package wheels from source (i.e. with pip install --no-binary).
charmcraft builds each charm base in a separate LXC container1. Within each container, pip has an internal cache for wheels built from source & for HTTP responses.
charmcraft 2.5 moved the pip internal cache to the LXC host machine, so that one pip cache is used for all LXC containers. (This increases the chance of a cache hit—a faster build.)
However, charmcraft builds are still slow the first time the wheel is built. This happens on CI runners, when you use a new machine/VM, or when you contribute to a new charm.
charmcraftcache solves the slow first build.
charmcraftcache-hub maintains a list of charms. For each charm, charmcraft pack is used to build Python dependencies from source and the pip wheel cache is uploaded to a GitHub release.
ccc pack downloads these pre-built wheels to charmcraft's pip cache (and then runs charmcraft pack).
Note: Within the GitHub release, each charm has an isolated cache. If the same charm (same GitHub repository and relative path to charmcraft.yaml) is added to the list of charms more than once (with different git refs), the wheels are combined into a single cache. If there are duplicate wheels, the wheel is selected from the ref that is earlier in the list.
Pretty much. The only difference is charmcraftcache-hub wheels are built from source on our runners, instead of built by the package maintainer.
Unless --destructive-mode is enabled ↩
FAQs
Fast first-time builds for charmcraft
We found that charmcraftcache demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.