From 3a4d59c2ec4987c96a4d125056ca8c4d855a7854 Mon Sep 17 00:00:00 2001
From: Jason Hall <jasonhall@google.com>
Date: Mon, 27 Jul 2020 15:16:31 -0400
Subject: [PATCH] Align release-generated .ko.yaml with repo config

This resolves disparities between the .ko.yaml normally used to build
images during development with the one generated and used during a
release (to ensure git-init and creds-init are built on the just-built
build-base image)

This won't prevent future drift.
---
 tekton/publish.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tekton/publish.yaml b/tekton/publish.yaml
index ad28bb58a73..3f2819e06f5 100644
--- a/tekton/publish.yaml
+++ b/tekton/publish.yaml
@@ -73,11 +73,15 @@ spec:
       set -ex
 
       cat <<EOF > /workspace/go/src/github.com/tektoncd/pipeline/.ko.yaml
-      # By default ko will build images on top of distroless
+      # This matches the value configured in .ko.yaml
+      defaultBaseImage: gcr.io/distroless/static:nonroot
       baseImageOverrides:
         $(inputs.params.pathToProject)/$(outputs.resources.builtCredsInitImage.url): $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/build-base:latest
         $(inputs.params.pathToProject)/$(outputs.resources.builtGitInitImage.url): $(inputs.params.imageRegistry)/$(inputs.params.pathToProject)/build-base:latest
-        $(inputs.params.pathToProject)/$(outputs.resources.builtEntrypointImage.url): busybox # image should have shell in $PATH
+
+        # These match values configured in .ko.yaml
+        $(inputs.params.pathToProject)/$(outputs.resources.builtEntrypointImage.url): gcr.io/distroless/base:debug-nonroot
+        $(inputs.params.pathToPrjoect)/$(outputs.resources.builtGcsFetcherImage.url): gcr.io/distroless/static:latest
       baseBuildOverrides:
         $(inputs.params.pathToProject)/$(outputs.resources.builtControllerImage.url):
           flags: