devenv: Deduplicate kani setup and devcontainer configs

Move gcc installation into install-kani.sh so the distro-specific
package manager command isn't duplicated across all three Containerfiles.
The script auto-detects dnf vs apt-get.

Add devcontainer-generate and devcontainer-validate recipes to generate
per-OS devcontainer.json files from the default template and validate
they stay in sync.

Assisted-by: Claude Code (Opus 4.6)
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>

Author: henrywang

Justfile

@@ -1,5 +1,32 @@
-# Validate devcontainer.json syntax
+# Generate per-OS devcontainer.json from the default (debian) template
+devcontainer-generate:
+	#!/bin/bash
+	set -euo pipefail
+	template=common/.devcontainer/devcontainer.json
+	for os in debian ubuntu; do
+	  mkdir -p "common/.devcontainer/${os}"
+	  sed -e "s/devenv-debian/devenv-${os}/g" "$template" > "common/.devcontainer/${os}/devcontainer.json"
+	done
+
+# Validate devcontainer.json syntax and that per-OS configs are in sync
 devcontainer-validate:
+	#!/bin/bash
+	set -euo pipefail
+	template=common/.devcontainer/devcontainer.json
+	rc=0
+	for os in debian ubuntu; do
+	  expected=$(sed "s/devenv-debian/devenv-${os}/g" "$template")
+	  actual=$(cat "common/.devcontainer/${os}/devcontainer.json")
+	  if [ "$expected" != "$actual" ]; then
+	    echo "ERROR: common/.devcontainer/${os}/devcontainer.json is out of sync with template"
+	    echo "Run 'just devcontainer-generate' to fix"
+	    rc=1
+	  fi
+	done
+	if [ $rc -ne 0 ]; then
+	  exit $rc
+	fi
+	echo "All devcontainer configs are in sync"
 	npx --yes @devcontainers/cli read-configuration --workspace-folder .
 
 # Build devenv Debian image with local tag

devenv/Containerfile.c10s

@@ -42,7 +42,6 @@ RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 FROM rust as kani
 # renovate: datasource=crate depName=kani-verifier
 ARG kaniversion=0.67.0
-RUN dnf install -y gcc && dnf clean all
 COPY install-kani.sh /run/src/
 RUN kaniversion=$kaniversion /run/src/install-kani.sh
 

devenv/Containerfile.debian

@@ -45,7 +45,6 @@ RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 FROM rust AS kani
 # renovate: datasource=crate depName=kani-verifier
 ARG kaniversion=0.67.0
-RUN apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*
 COPY install-kani.sh /run/src/
 RUN kaniversion=$kaniversion /run/src/install-kani.sh
 

devenv/Containerfile.ubuntu

@@ -57,7 +57,6 @@ RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 FROM rust AS kani
 # renovate: datasource=crate depName=kani-verifier
 ARG kaniversion=0.67.0
-RUN apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*
 COPY install-kani.sh /run/src/
 RUN kaniversion=$kaniversion /run/src/install-kani.sh
 

devenv/install-kani.sh

@@ -1,12 +1,19 @@
 #!/bin/bash
 # Install Kani formal verification tool
-# This script is shared between c10s and debian container builds.
+# This script is shared between c10s, debian, and ubuntu container builds.
 # Prerequisites: rustup must already be installed (via install-rust.sh)
 set -xeuo pipefail
 
 # Required environment variable (passed as build ARG)
 : "${kaniversion:?kaniversion is required}"
 
+# Install gcc (required to compile Kani's C stubs)
+if command -v dnf >/dev/null; then
+    dnf install -y gcc && dnf clean all
+elif command -v apt-get >/dev/null; then
+    apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*
+fi
+
 export RUSTUP_HOME=/usr/local/rustup
 export CARGO_HOME=/usr/local/cargo
 export PATH="/usr/local/bin:$PATH"