tufcli/Dockerfile.cli-stack.rh at main · securesign/tufcli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
FROM registry.redhat.io/ubi9/go-toolset:9.8-1789040808@sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 AS build-cross-platform
ENV APP_ROOT=/opt/app-root \
    GOPATH=/opt/app-root

USER root

ARG ZIG_VERSION=0.16.0
RUN curl -fsSL https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz | tar xJ -C /usr/local && \
    ln -s /usr/local/zig-x86_64-linux-${ZIG_VERSION}/zig /usr/local/bin/zig && \
    printf '%s\n' '#!/bin/bash' 'args=(); fw_next=false; tgt_next=false; tgt=""' 'for a in "$@"; do' \
      '  if $tgt_next; then tgt_next=false; tgt="$a"; args+=("$a"); continue; fi' \
      '  if $fw_next; then fw_next=false' \
      '    if [ "$a" = "PCSC" ] && [ -f "/opt/pcsc-stub/pcsc_stub_${tgt}.o" ]; then' \
      '      args+=("/opt/pcsc-stub/pcsc_stub_${tgt}.o"); fi; continue; fi' \
      '  case "$a" in -lresolv|-ldl) continue;; -framework) fw_next=true;; -target) tgt_next=true; args+=("$a");; *) args+=("$a");; esac' \
      'done' 'exec zig cc "${args[@]}"' > /usr/local/bin/zig-cc && \
    sed 's/zig cc/zig c++/' /usr/local/bin/zig-cc > /usr/local/bin/zig-cxx && \
    chmod +x /usr/local/bin/zig-cc /usr/local/bin/zig-cxx

WORKDIR $APP_ROOT/src
ADD go.mod go.sum ./
RUN go mod download

ADD ./ ./

RUN cp -r hack/pcsc-lite/PCSC /usr/include/PCSC && \
    mkdir -p /opt/pcsc-include && ln -s /usr/include/PCSC /opt/pcsc-include/PCSC && \
    cp hack/pcsc-lite/libpcsclite.pc /usr/lib64/pkgconfig/libpcsclite.pc && \
    gcc -c -o /tmp/pcsc_stub.o hack/pcsc-lite/pcsc_stub.c && \
    ar rcs /usr/lib64/libpcsclite.a /tmp/pcsc_stub.o && rm /tmp/pcsc_stub.o

RUN mkdir -p /opt/pcsc-stub && \
    zig cc -target aarch64-macos -c -o /opt/pcsc-stub/pcsc_stub_aarch64-macos.o hack/pcsc-lite/pcsc_stub.c && \
    zig cc -target x86_64-macos -c -o /opt/pcsc-stub/pcsc_stub_x86_64-macos.o hack/pcsc-lite/pcsc_stub.c

RUN git config --global --add safe.directory /opt/app-root/src && \
    make -f Build.mak cross-platform

FROM --platform=linux/amd64   quay.io/securesign/tufcli@sha256:1cd081e7cedc8c77e7043b8ce8f889a55be6619a6eca01265d9acb98f0454f8d AS build-amd64
FROM --platform=linux/arm64   quay.io/securesign/tufcli@sha256:8694e0cca9133793fbdd671052537b886f569973d9306fbaff252ddf6ec5560b AS build-arm64
FROM --platform=linux/ppc64le quay.io/securesign/tufcli@sha256:852823b879b26a0481eb77310fa48b5ce3c0c774e5ea48e1dff197f96c6293c7 AS build-ppc64le
FROM --platform=linux/s390x   quay.io/securesign/tufcli@sha256:351da32e91453b54c641161bba28640476742ab74a5156279c44f00ebdff88e1 AS build-s390x

FROM registry.redhat.io/ubi9/go-toolset:9.8-1789040808@sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 AS packager
USER root
RUN mkdir -p /binaries

# tufcli: Native Linux binaries from each arch variant
COPY --from=build-amd64 /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_amd64.tar.gz -C /tmp tufcli && rm /tmp/tufcli

COPY --from=build-arm64 /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_arm64.tar.gz -C /tmp tufcli && rm /tmp/tufcli

COPY --from=build-ppc64le /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_ppc64le.tar.gz -C /tmp tufcli && rm /tmp/tufcli

COPY --from=build-s390x /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_s390x.tar.gz -C /tmp tufcli && rm /tmp/tufcli

# tufcli: Cross-compiled binaries
COPY --from=build-cross-platform /opt/app-root/src/tufcli_darwin_amd64 /tmp/tufcli_darwin_amd64
RUN tar -czf /binaries/tufcli_darwin_amd64.tar.gz -C /tmp tufcli_darwin_amd64 && \
    rm /tmp/tufcli_darwin_amd64

COPY --from=build-cross-platform /opt/app-root/src/tufcli_darwin_arm64 /tmp/tufcli_darwin_arm64
RUN tar -czf /binaries/tufcli_darwin_arm64.tar.gz -C /tmp tufcli_darwin_arm64 && \
    rm /tmp/tufcli_darwin_arm64

COPY --from=build-cross-platform /opt/app-root/src/tufcli_windows_amd64.exe /tmp/tufcli_windows_amd64.exe
RUN tar -czf /binaries/tufcli_windows_amd64.tar.gz -C /tmp tufcli_windows_amd64.exe && \
    rm /tmp/tufcli_windows_amd64.exe

RUN chmod -R a+rX /binaries

# Final minimal image with all binaries
FROM registry.redhat.io/ubi9/ubi-micro:9.8-1789345812@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650

LABEL description="Flat image containing tufcli CLI binaries for all platforms and architectures"
LABEL io.k8s.description="Flat image containing tufcli CLI binaries for all platforms and architectures"
LABEL io.opencontainers.image.description="Flat image containing tufcli CLI binaries for all platforms and architectures"
LABEL io.k8s.display-name="tufcli CLI stack image for Red Hat Trusted Artifact Signer"
LABEL io.openshift.tags="tufcli trusted-artifact-signer cli-stack"
LABEL summary="Provides all tufcli CLI binaries as tar.gz archives for CDN distribution."
LABEL com.redhat.component="tufcli-cli-stack"
LABEL name="rhtas/tufcli-cli-stack"

COPY --from=packager /binaries/ /binaries/
COPY --from=build-amd64 /licenses/ /licenses/

USER 65532:65532