Skip to content

Commit c8756c6

Browse files
cgwalterscgwalters
committed
devenv: Extract shared scripts for tools, rust, and kani installation
Deduplicate the nearly identical installation logic between c10s and debian Containerfiles by extracting into shared shell scripts: - fetch-tools.sh: Downloads goose, bcvk, and scorecard binaries - install-rust.sh: Installs rustup/cargo system-wide to /usr/local - install-kani.sh: Installs kani formal verification tool The only remaining differences are distro-specific build dependency installation (dnf vs apt), which must differ. Assisted-by: OpenCode (Claude Sonnet 4) Signed-off-by: Colin Walters <walters@verbum.org>
1 parent d424417 commit c8756c6

6 files changed

Lines changed: 111 additions & 156 deletions

File tree

‎devenv/.dockerignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,6 @@
1212
!build-deps-debian.txt
1313
!build-deps-c10s.txt
1414
!devenv-init.sh
15+
!fetch-tools.sh
16+
!install-rust.sh
17+
!install-kani.sh

‎devenv/Containerfile.c10s‎

Lines changed: 7 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -32,93 +32,21 @@ ARG gooseversion=v1.11.1
3232
ARG bcvkversion=v0.9.0
3333
# renovate: datasource=github-releases depName=ossf/scorecard
3434
ARG scorecardversion=v5.1.1
35-
RUN <<EORUN
36-
set -xeuo pipefail
37-
arch=$(arch)
38-
39-
rm -vrf /usr/local/bin/*
40-
41-
# goose is a single static binary
42-
target=goose-${arch}-unknown-linux-gnu.tar.bz2
43-
/bin/time -f '%E %C' curl -fLO https://github.com/block/goose/releases/download/$gooseversion/$target
44-
tar xvjf $target
45-
mv goose /usr/local/bin/goose
46-
47-
## Other tools
48-
49-
# bcvk
50-
if test "${arch}" = x86_64; then
51-
td=$(mktemp -d)
52-
(
53-
cd $td
54-
target=bcvk-${arch}-unknown-linux-gnu
55-
/bin/time -f '%E %C' curl -fLO https://github.com/bootc-dev/bcvk/releases/download/$bcvkversion/${target}.tar.gz
56-
tar xvzf $target.tar.gz
57-
mv $target /usr/local/bin/bcvk
58-
)
59-
rm -rf $td
60-
else
61-
echo bcvk unavailable for $arch
62-
fi
63-
64-
# scorecard (OpenSSF security scanner)
65-
td=$(mktemp -d)
66-
(
67-
cd $td
68-
# Map arch to scorecard naming convention
69-
case "${arch}" in
70-
x86_64) scarch=amd64 ;;
71-
aarch64) scarch=arm64 ;;
72-
*) echo "scorecard unavailable for $arch"; exit 0 ;;
73-
esac
74-
target=scorecard_${scorecardversion#v}_linux_${scarch}.tar.gz
75-
/bin/time -f '%E %C' curl -fLO https://github.com/ossf/scorecard/releases/download/$scorecardversion/$target
76-
tar xvzf $target
77-
mv scorecard /usr/local/bin/scorecard
78-
)
79-
rm -rf $td
80-
EORUN
35+
COPY fetch-tools.sh /run/src/
36+
RUN gooseversion=$gooseversion bcvkversion=$bcvkversion scorecardversion=$scorecardversion /run/src/fetch-tools.sh
8137

8238
FROM base as rust
83-
RUN <<EORUN
84-
set -xeuo pipefail
85-
# Setup rust; the idea here though is we install system-wide into /usr/local
86-
# as if it was packaged.
87-
export RUSTUP_HOME=/usr/local/rustup
88-
export CARGO_HOME=/usr/local/cargo
89-
# Install Rust system-wide
90-
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile default
91-
# Move binaries to /usr/local/bin (system-managed, root-owned)
92-
mv /usr/local/cargo/bin/* /usr/local/bin/
93-
# Recreate bin directory with symlink to rustup - rustup's self-update check
94-
# looks for itself at $CARGO_HOME/bin/rustup
95-
mkdir -p /usr/local/cargo/bin
96-
ln -sf /usr/local/bin/rustup /usr/local/cargo/bin/rustup
97-
EORUN
39+
COPY install-rust.sh /run/src/
40+
RUN /run/src/install-rust.sh
9841

9942
# Kani formal verification tool - requires rustup for toolchain management
10043
FROM rust as kani
10144
# renovate: datasource=crate depName=kani-verifier
10245
ARG kaniversion=0.67.0
103-
RUN <<EORUN
104-
set -xeuo pipefail
10546
# Install build dependencies needed to compile kani-verifier
106-
dnf install -y gcc
107-
export RUSTUP_HOME=/usr/local/rustup
108-
export CARGO_HOME=/usr/local/cargo
109-
export PATH="/usr/local/bin:$PATH"
110-
# Install Kani to a system-wide location so all users can access it
111-
export KANI_HOME=/usr/local/kani
112-
113-
# Install kani-verifier
114-
/bin/time -f '%E %C' cargo install --locked kani-verifier --version $kaniversion
115-
116-
# Run kani setup - downloads bundle and installs required nightly toolchain
117-
/bin/time -f '%E %C' /usr/local/cargo/bin/cargo-kani setup
118-
119-
# Move kani binaries to /usr/local/bin, keep rustup symlink
120-
mv /usr/local/cargo/bin/cargo-kani /usr/local/cargo/bin/kani /usr/local/bin/
121-
EORUN
47+
RUN dnf install -y gcc
48+
COPY install-kani.sh /run/src/
49+
RUN kaniversion=$kaniversion /run/src/install-kani.sh
12250

12351
# This builds the image.
12452
# Build this using `just devenv-build-c10s` from the root of the repository.

‎devenv/Containerfile.debian‎

Lines changed: 7 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -32,91 +32,21 @@ ARG gooseversion=v1.11.1
3232
ARG bcvkversion=v0.9.0
3333
# renovate: datasource=github-releases depName=ossf/scorecard
3434
ARG scorecardversion=v5.1.1
35-
RUN <<EORUN
36-
set -xeuo pipefail
37-
arch=$(arch)
38-
39-
rm -vrf /usr/local/bin/*
40-
41-
# goose for local AI
42-
target=goose-${arch}-unknown-linux-gnu.tar.bz2
43-
/bin/time -f '%E %C' curl -fLO https://github.com/block/goose/releases/download/$gooseversion/$target
44-
tar xvjf $target
45-
mv goose /usr/local/bin/goose
46-
47-
# bcvk
48-
if test "${arch}" = x86_64; then
49-
td=$(mktemp -d)
50-
(
51-
cd $td
52-
target=bcvk-${arch}-unknown-linux-gnu
53-
/bin/time -f '%E %C' curl -fLO https://github.com/bootc-dev/bcvk/releases/download/$bcvkversion/${target}.tar.gz
54-
tar xvzf $target.tar.gz
55-
mv $target /usr/local/bin/bcvk
56-
)
57-
rm -rf $td
58-
else
59-
echo bcvk unavailable for $arch
60-
fi
61-
62-
# scorecard (OpenSSF security scanner)
63-
td=$(mktemp -d)
64-
(
65-
cd $td
66-
# Map arch to scorecard naming convention
67-
case "${arch}" in
68-
x86_64) scarch=amd64 ;;
69-
aarch64) scarch=arm64 ;;
70-
*) echo "scorecard unavailable for $arch"; exit 0 ;;
71-
esac
72-
target=scorecard_${scorecardversion#v}_linux_${scarch}.tar.gz
73-
/bin/time -f '%E %C' curl -fLO https://github.com/ossf/scorecard/releases/download/$scorecardversion/$target
74-
tar xvzf $target
75-
mv scorecard /usr/local/bin/scorecard
76-
)
77-
rm -rf $td
78-
EORUN
35+
COPY fetch-tools.sh /run/src/
36+
RUN gooseversion=$gooseversion bcvkversion=$bcvkversion scorecardversion=$scorecardversion /run/src/fetch-tools.sh
7937

8038
FROM base as rust
81-
RUN <<EORUN
82-
set -xeuo pipefail
83-
# Setup rust; the idea here though is we install system-wide into /usr/local
84-
# as if it was packaged.
85-
export RUSTUP_HOME=/usr/local/rustup
86-
export CARGO_HOME=/usr/local/cargo
87-
# Install Rust system-wide
88-
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile default
89-
# Move binaries to /usr/local/bin (system-managed, root-owned)
90-
mv /usr/local/cargo/bin/* /usr/local/bin/
91-
# Recreate bin directory with symlink to rustup - rustup's self-update check
92-
# looks for itself at $CARGO_HOME/bin/rustup
93-
mkdir -p /usr/local/cargo/bin
94-
ln -sf /usr/local/bin/rustup /usr/local/cargo/bin/rustup
95-
EORUN
39+
COPY install-rust.sh /run/src/
40+
RUN /run/src/install-rust.sh
9641

9742
# Kani formal verification tool - requires rustup for toolchain management
9843
FROM rust as kani
9944
# renovate: datasource=crate depName=kani-verifier
10045
ARG kaniversion=0.67.0
101-
RUN <<EORUN
102-
set -xeuo pipefail
10346
# Install build dependencies needed to compile kani-verifier
104-
apt-get update && apt-get install -y --no-install-recommends build-essential
105-
export RUSTUP_HOME=/usr/local/rustup
106-
export CARGO_HOME=/usr/local/cargo
107-
export PATH="/usr/local/bin:$PATH"
108-
# Install Kani to a system-wide location so all users can access it
109-
export KANI_HOME=/usr/local/kani
110-
111-
# Install kani-verifier
112-
/bin/time -f '%E %C' cargo install --locked kani-verifier --version $kaniversion
113-
114-
# Run kani setup - downloads bundle and installs required nightly toolchain
115-
/bin/time -f '%E %C' /usr/local/cargo/bin/cargo-kani setup
116-
117-
# Move kani binaries to /usr/local/bin, keep rustup symlink
118-
mv /usr/local/cargo/bin/cargo-kani /usr/local/cargo/bin/kani /usr/local/bin/
119-
EORUN
47+
RUN apt-get update && apt-get install -y --no-install-recommends build-essential
48+
COPY install-kani.sh /run/src/
49+
RUN kaniversion=$kaniversion /run/src/install-kani.sh
12050

12151
# This builds the image.
12252
# Build this using `just devenv-build-debian` from the root of the repository.

‎devenv/fetch-tools.sh‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash
2+
# Fetch architecture-independent binary tools into /usr/local/bin
3+
# This script is shared between c10s and debian container builds.
4+
set -xeuo pipefail
5+
6+
# Required environment variables (passed as build ARGs)
7+
: "${gooseversion:?gooseversion is required}"
8+
: "${bcvkversion:?bcvkversion is required}"
9+
: "${scorecardversion:?scorecardversion is required}"
10+
11+
arch=$(arch)
12+
13+
rm -vrf /usr/local/bin/*
14+
15+
# goose is a single static binary
16+
target=goose-${arch}-unknown-linux-gnu.tar.bz2
17+
/bin/time -f '%E %C' curl -fLO https://github.com/block/goose/releases/download/$gooseversion/$target
18+
tar xvjf $target
19+
mv goose /usr/local/bin/goose
20+
rm -f $target
21+
22+
# bcvk
23+
if test "${arch}" = x86_64; then
24+
td=$(mktemp -d)
25+
(
26+
cd $td
27+
target=bcvk-${arch}-unknown-linux-gnu
28+
/bin/time -f '%E %C' curl -fLO https://github.com/bootc-dev/bcvk/releases/download/$bcvkversion/${target}.tar.gz
29+
tar xvzf $target.tar.gz
30+
mv $target /usr/local/bin/bcvk
31+
)
32+
rm -rf $td
33+
else
34+
echo bcvk unavailable for $arch
35+
fi
36+
37+
# scorecard (OpenSSF security scanner)
38+
td=$(mktemp -d)
39+
(
40+
cd $td
41+
# Map arch to scorecard naming convention
42+
case "${arch}" in
43+
x86_64) scarch=amd64 ;;
44+
aarch64) scarch=arm64 ;;
45+
*) echo "scorecard unavailable for $arch"; exit 0 ;;
46+
esac
47+
target=scorecard_${scorecardversion#v}_linux_${scarch}.tar.gz
48+
/bin/time -f '%E %C' curl -fLO https://github.com/ossf/scorecard/releases/download/$scorecardversion/$target
49+
tar xvzf $target
50+
mv scorecard /usr/local/bin/scorecard
51+
)
52+
rm -rf $td

‎devenv/install-kani.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
# Install Kani formal verification tool
3+
# This script is shared between c10s and debian container builds.
4+
# Prerequisites: rustup must already be installed (via install-rust.sh)
5+
set -xeuo pipefail
6+
7+
# Required environment variable (passed as build ARG)
8+
: "${kaniversion:?kaniversion is required}"
9+
10+
export RUSTUP_HOME=/usr/local/rustup
11+
export CARGO_HOME=/usr/local/cargo
12+
export PATH="/usr/local/bin:$PATH"
13+
14+
# Install Kani to a system-wide location so all users can access it
15+
export KANI_HOME=/usr/local/kani
16+
17+
# Install kani-verifier
18+
/bin/time -f '%E %C' cargo install --locked kani-verifier --version $kaniversion
19+
20+
# Run kani setup - downloads bundle and installs required nightly toolchain
21+
/bin/time -f '%E %C' /usr/local/cargo/bin/cargo-kani setup
22+
23+
# Move kani binaries to /usr/local/bin, keep rustup symlink
24+
mv /usr/local/cargo/bin/cargo-kani /usr/local/cargo/bin/kani /usr/local/bin/

‎devenv/install-rust.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
# Install Rust system-wide into /usr/local
3+
# This script is shared between c10s and debian container builds.
4+
set -xeuo pipefail
5+
6+
export RUSTUP_HOME=/usr/local/rustup
7+
export CARGO_HOME=/usr/local/cargo
8+
9+
# Install Rust system-wide
10+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile default
11+
12+
# Move binaries to /usr/local/bin (system-managed, root-owned)
13+
mv /usr/local/cargo/bin/* /usr/local/bin/
14+
15+
# Recreate bin directory with symlink to rustup - rustup's self-update check
16+
# looks for itself at $CARGO_HOME/bin/rustup
17+
mkdir -p /usr/local/cargo/bin
18+
ln -sf /usr/local/bin/rustup /usr/local/cargo/bin/rustup

0 commit comments

Comments
 (0)