releng tools should be able to pin a Helios version

[jclulow]

Under ordinary circumstances, when Omicron images are built, we use whatever the current version of Helios packages and tools is available. This means we're generally testing new changes with current OS bits automatically. This does, however, mean that images built this way are not automatically reproducible (i.e., one would need to pick apart a prior image to obtain the exact Helios version included in it, to then be able to reproduce it).

As part of the release engineering process for Omicron, we create a branch for a given release version. We then push a commit onto that branch that pins the version of Helios that was contemporary with the base Omicron commit in the release. This makes a given Omicron release commit reproducible with respect to the OS packages it includes. This pinning is in two parts:

• we pin the commit of oxidecomputer/helios.git that we use to obtain the helios-build tool
• we add an extra dependency on a release version-specific incorporation package (see Constraints and Freezing in pkg(7) for more discussion) which then constrains the versions of all of the binary packages included in the image from the IPS repository

Today, we achieve this by doctoring the source for the releng tool; e.g., for V12:

• for rc0, 020fde1 added the base change that forces the tool to use the particular bits
• for rc1, 3a2ed5e updated the pins because we needed an OS backport to fix an issue

I think it would be best if these two details could come from some manifest file that is stored in the repository. On the main branch it would specify no pinning, and then as part of release engineering we could just push an update to the file itself. People could also then use this facility as part of building test images for various changes.

[jclulow]

NOTE: We probably shouldn't put this file in the top-level of the repository; see #3350 for more details.