Konflux

Mentors: Student: Jamesss

Konflux container builds produce different image digests from identical source commits. The buildah task already supports reproducibility flags, but the pipelines don't wire them and there's no way to verify reproducibility automatically. This project audits all non-determinism sources in the build pipeline, wires SOURCE_DATE_EPOCH and related parameters through every pipeline variant, builds a benchmark suite of Containerfiles that exercise different reproducibility scenarios, and creates a standalone verify-reproducibility Tekton task. Deliverables: a non-determinism audit document, pipeline wiring patches, a 5+ Containerfile benchmark suite, a verification task with diffoci integration, and user/developer documentation.

Mentors: Student: Amanyd

This project adds zstd:chunked compression to Konflux builds while keeping compatibility with older Docker versions. It does this by pushing both gzip and zstd images in the same index, so older clients use gzip and newer ones get faster pulls. I’ll update build tasks, fix release pipeline issues caused by dual manifests, and ensure everything works with proper tests and docs. The result is faster image pulls with no breakage for existing users.

Mentors: Student: Harshit_Bansal

This project aims to add native support for the UV Python package manager to Hermeto, enabling hermetic builds for projects using pyproject.toml and uv.lock. Currently, Hermeto only supports pip-based workflows, limiting adoption for teams using modern Python tooling. The main challenge is that UV tightly couples dependency resolution, fetching, and installation, which conflicts with Hermeto’s requirement to separate prefetching from build execution. Additionally, URL and Git dependencies must be handled in a way that works fully offline. To address this, Hermeto will directly parse uv.lock as the single source of truth and deterministically fetch all dependencies without invoking UV. An inject-files mechanism will rewrite remote sources in pyproject.toml to local paths, enabling offline installation. The project will also implement marker-based artifact and wheel selection, ensuring compatibility with the target environment, and include SBOM generation using lockfile data to improve supply chain transparency. Deliverables :- 1)A complete uv.lock parser integrated into Hermeto 2)Support for fetching: -PyPI (registry) dependencies -Git dependencies -Direct URL dependencies -Local/editable/file dependencies 3)Artifact and wheel selection logic based on marker/environment filtering 4)Implementation of the inject-files system for offline installation 5)Integration with Hermeto’s existing prefetch and build pipeline 6)SBOM generation from uv.lock data 7)Comprehensive documentation -Architecture and design decisions -User workflow and setup guide -Examples and edge case handling 8)Testing(Unit & Integration)