release: Allow release image to be directly substituted into binary

[smarterclayton]

As part of our release process we build container images for installer
that are added to the release image (which has a cryptographic
relationship to the images it contains, giving strong integrity). A
consumer should be able to download and install a locked installer
binary that uses the payload. However, we would prefer to not
rebuild the binary outside of the image, but instead have:

1. a source for the binary from the payload
2. the binary be locked to the payload it comes from

This commit allows a build system above the payload to extract the
installer binary for linux from the image (other platforms later)
and perform a replacement on the binary itself, patching:

_RELEASE_IMAGE_LOCATION_XXXXXXXXXXX

with

quay.io/openshift/ocp-release:v4.0\x00

without requiring a recompilation of the binary. The internal code
checks the constant and verifies bounds (panicking if necessary)
and then returns the updated constant. This allows a simpler
replacement process to customize a binary for both external use
and offline use that is locked to a payload.

Chose this over a few other options:

1. rebuilding outside the payload (loses reproducibility)
2. not locking payload (loses simplicity for test and users)

Steps after this:

1. oc can stream back either this binary or a tar from a payload with the proper locking
2. release-controller can serve that
3. ART creates the tar as the last step in the promotion flow and sends it to the mirror

/assign @wking

[wking]

I've pushed d07804b to a branch in my repo dropping the prefix variable (because I don't see a need to distinguish between changed and unchanged) and adding hack/pin-release-image.sh to somewhat reliably make the substitution. Feel free to pick and choose interesting things to squash in from that commit.

[smarterclayton]

I updated with the logging changes. I hope my comments in d07804b were clear - we need the prefix to detect mutation, we don't want the constant the code replaces to have to change by version (i.e. the code that mutates the binary shouldn't change unless we grow the allowed pull spec length in the future).

[wking]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smarterclayton, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smarterclayton,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment