Skip to content

Commit 6b36c41

Browse files
lbusselllbussell
committed
Update Dockerfile templates to use Managed Identity OAuth token
1 parent 915cc90 commit 6b36c41

13 files changed

Lines changed: 116 additions & 95 deletions

‎eng/dockerfile-templates/Dockerfile.linux.download-file‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,15 @@
88
sha-var-name: Name of variable that stores the checksum
99
sha-function: SHA function to use ^
1010

11-
set isInternal to find(ARGS["url"], "artifacts.visualstudio.com") >= 0 ^
12-
set alpineSetTokenCmd to 'token=$(echo "${ACCESSTOKEN}:${ACCESSTOKEN}" | base64 -w 0)' ^
13-
set additionalWgetArgs to when(isInternal, '--header="Authorization: Basic $token" ', '') ^
14-
set additionalCurlArgs to when(isInternal, '-u :$ACCESSTOKEN --basic ', '') ^
11+
_ Documentation for using Managed Identity/OAuth tokens to access Azure storage accounts:
12+
https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory#call-storage-operations-with-oauth-tokens ^
13+
14+
set isInternal to find(ARGS["url"], "dotnetstage") >= 0 ^
15+
set additionalWgetArgs to when(isInternal, '--header "Authorization: Bearer $ACCESSTOKEN" --header "x-ms-version: 2017-11-09" ', '') ^
16+
set additionalCurlArgs to when(isInternal, '-H "Authorization: Bearer $ACCESSTOKEN" -H "x-ms-version: 2017-11-09" ', '') ^
1517
set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
1618
set shaFunction to ARGS["sha-function"] ^
1719
set shaFunction to when(shaFunction, shaFunction, "512")
18-
}}{{if isAlpine:{{if isInternal:{{alpineSetTokenCmd}} \
19-
&& }}wget {{additionalWgetArgs}}-O^else:curl {{additionalCurlArgs}}-fSL --output}} {{ARGS["out-file"]}} {{if isInternal:"{{ARGS["url"]}}"^else:{{ARGS["url"]}}}}{{if ARGS["sha"]: \
20+
}}{{if isAlpine:wget {{additionalWgetArgs}}-O^else:curl {{additionalCurlArgs}}-fSL --output}} {{ARGS["out-file"]}} {{if isInternal:"{{ARGS["url"]}}"^else:{{ARGS["url"]}}}}{{if ARGS["sha"]: \
2021
&& {{ARGS["sha-var-name"]}}='{{ARGS["sha"]}}' \
2122
&& echo "${{ARGS["sha-var-name"]}} {{ARGS["out-file"]}}" | sha{{shaFunction}}sum -c -}}

‎eng/dockerfile-templates/Dockerfile.windows.download-file‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,16 @@
88
sha-var-name: Name of variable that stores the checksum
99
hash-algorithm: Algorithm type to use to get the checksum. Defaults to sha512 ^
1010

11-
set isInternal to find(ARGS["url"], "artifacts.visualstudio.com") >= 0 ^
11+
_ Documentation for using Managed Identity/OAuth tokens to access Azure storage accounts:
12+
https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory#call-storage-operations-with-oauth-tokens ^
13+
14+
set isInternal to find(ARGS["url"], "dotnetstage") >= 0 ^
1215
set hashAlgorithm to when(ARGS["hash-algorithm"], ARGS["hash-algorithm"], "sha512")
1316
}}{{if isInternal:`
14-
$Base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(\":$($Env:ACCESSTOKEN)\")); `
15-
$Headers = @@{Authorization = \"Basic $Base64AuthInfo\"}; `
17+
$Headers = @@{ `
18+
Authorization = \"Bearer $env:ACCESSTOKEN\"; `
19+
'x-ms-version' = '2017-11-09'; `
20+
}; `
1621
Invoke-WebRequest -OutFile {{ARGS["out-file"]}} \"{{ARGS["url"]}}\" -Headers $Headers; `
1722
`^else:Invoke-WebRequest -OutFile {{ARGS["out-file"]}} {{ARGS["url"]}}; `}}
1823
${{ARGS["sha-var-name"]}} = '{{ARGS["sha"]}}'; `

‎eng/dockerfile-templates/aspnet/Dockerfile.linux‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
set isFullAzureLinux to isAzureLinux && !isDistroless ^
1111
set isDistrolessAzureLinux to isAzureLinux && isDistroless ^
1212
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
13-
set isInternal to find(baseUrl, "artifacts.visualstudio.com") >= 0 ^
13+
set isInternal to find(baseUrl, "dotnetstage") >= 0 ^
1414
set runtimeDepsVariant to when(ARGS["is-extra"], "-extra", "") ^
1515
set tagVersion to when(dotnetVersion = "8.0",
1616
VARIABLES[cat("dotnet|", dotnetVersion, "|product-version")],

‎eng/dockerfile-templates/aspnet/Dockerfile.linux-composite‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
set isFullAzureLinux to isAzureLinux && !isDistroless ^
77
set isDistrolessAzureLinux to isAzureLinux && isDistroless ^
88
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
9-
set isInternal to find(baseUrl, "artifacts.visualstudio.com") >= 0 ^
9+
set isInternal to find(baseUrl, "dotnetstage") >= 0 ^
1010
set isSingleStage to isAlpine && !isInternal ^
1111
set runtimeDepsVariant to when(ARGS["is-extra"], "-extra", "") ^
1212
set tagVersion to when(dotnetVersion = "8.0",

‎eng/dockerfile-templates/aspnet/Dockerfile.linux.install-aspnet‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,44 @@
77
- installer-stage (optional): Name of the Dockerfile stage responsible for installation ^
88

99
set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".") ^
10+
set productVersion to VARIABLES[cat("dotnet|", dotnetVersion, "|product-version")] ^
11+
set buildVersion to VARIABLES[cat("aspnet|", dotnetVersion, "|build-version")] ^
12+
1013
set isFullAzureLinux to defined(match(OS_VERSION, "^cbl-mariner\d+\.\d+$")) ^
1114
set isDistroless to find(OS_VERSION, "distroless") >= 0 || find(OS_VERSION, "chiseled") >= 0 ^
1215
set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
1316
set platform to when(isAlpine, "linux-musl", "linux") ^
1417
set destDir to "/dotnet" ^
15-
set aspnetVersionDir to when(ARGS["use-local-version-var"],
16-
"$aspnetcore_version",
17-
when(ARGS["is-internal"],
18-
VARIABLES[cat("aspnet|", dotnetVersion, "|build-version")],
19-
"$ASPNET_VERSION")) ^
20-
set isStableBranding to (find(VARIABLES[cat("sdk|", dotnetVersion, "|build-version")], "-servicing") >= 0 ||
21-
find(VARIABLES[cat("sdk|", dotnetVersion, "|build-version")], "-rtm") >= 0) ^
22-
set aspnetVersionFile to when(isStableBranding,
23-
VARIABLES[cat("dotnet|", dotnetVersion, "|product-version")],
24-
aspnetVersionDir) ^
25-
set url to cat(
26-
VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])],
27-
"/aspnetcore/Runtime/", aspnetVersionDir, "/aspnetcore-runtime-", aspnetVersionFile,
28-
"-", platform, "-", ARCH_SHORT, ".tar.gz") ^
18+
19+
set versionDir to
20+
when(ARGS["use-local-version-var"],
21+
"$aspnetcore_version",
22+
"$ASPNET_VERSION") ^
23+
24+
set sdkBuildVersion to VARIABLES[cat("sdk|", dotnetVersion, "|build-version")] ^
25+
set isStableBranding to find(sdkBuildVersion, "-servicing") >= 0 || find(sdkBuildVersion, "-rtm") >= 0 ^
26+
27+
set fileVersion to when(isStableBranding, productVersion, versionDir) ^
28+
29+
if (ARGS["is-internal"]):{{
30+
set versionDir to buildVersion ^
31+
set fileVersion to productVersion
32+
}} ^
33+
34+
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
35+
set downloadUrl to cat(baseUrl, "/aspnetcore/Runtime/", versionDir, "/aspnetcore-runtime-", fileVersion, "-", platform, "-", ARCH_SHORT, ".tar.gz") ^
36+
set sha to VARIABLES[join(["aspnet", dotnetVersion, platform, ARCH_SHORT, "sha"], "|")] ^
37+
2938
set files to [
3039
[
3140
"filename": "aspnetcore.tar.gz",
32-
"url": url,
33-
"sha": VARIABLES[join(["aspnet", dotnetVersion, platform, ARCH_SHORT, "sha"], "|")],
41+
"url": downloadUrl,
42+
"sha": sha,
3443
"sha-var-name": "aspnetcore_sha512",
3544
"extract-paths": ["./shared/Microsoft.AspNetCore.App"]
3645
]
3746
] ^
47+
3848
set copyEnabled to ARGS["install-method"] = "copy-and-install" ^
3949
set downloadEnabled to ARGS["install-method"] = "download" || ARGS["install-method"] = "download-and-install" ^
4050
set installEnabled to ARGS["install-method"] = "download-and-install" || ARGS["install-method"] = "copy-and-install"
@@ -46,7 +56,7 @@ if copyEnabled:{{InsertTemplate("../Dockerfile.linux.copy-files",
4656
"destination": ""
4757
])
4858
}}
49-
}}RUN {{if ARGS["use-local-version-var"]:aspnetcore_version={{VARIABLES[cat("aspnet|", dotnetVersion, "|build-version")]}} \
59+
}}RUN {{if ARGS["use-local-version-var"]:aspnetcore_version={{buildVersion}} \
5060
&& }}{{InsertTemplate("../Dockerfile.linux.download-and-install",
5161
[
5262
"files": files,

‎eng/dockerfile-templates/aspnet/Dockerfile.windows‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
set isServerCore to find(OS_VERSION, "windowsservercore") >= 0 ^
44

55
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
6-
set isInternal to find(baseUrl, "artifacts.visualstudio.com") >= 0 ^
6+
set isInternal to find(baseUrl, "dotnetstage") >= 0 ^
77

88
set installerStageFromImage to cat("mcr.microsoft.com/windows/servercore:", OS_VERSION_NUMBER, "-amd64") ^
99

‎eng/dockerfile-templates/runtime-deps/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
set isAzureLinux to isCblMariner || defined(match(OS_VERSION, "^azurelinux\d+\.\d+$")) ^
1313

1414
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
15-
set isInternal to find(baseUrl, "artifacts.visualstudio.com") >= 0 ^
15+
set isInternal to find(baseUrl, "dotnetstage") >= 0 ^
1616

1717
set baseImageRepo to when(isAlpine,
1818
cat(ARCH_VERSIONED, "/alpine"),

‎eng/dockerfile-templates/runtime/Dockerfile.linux‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
set isFullAzureLinux to isAzureLinux && !isDistroless ^
1111
set isDistrolessAzureLinux to isAzureLinux && isDistroless ^
1212
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
13-
set isInternal to find(baseUrl, "artifacts.visualstudio.com") >= 0 ^
13+
set isInternal to find(baseUrl, "dotnetstage") >= 0 ^
1414
set runtimeDepsVariant to when(ARGS["is-extra"], "-extra", "") ^
1515
set tagVersion to VARIABLES[cat("dotnet|", dotnetVersion, "|fixed-tag")] ^
1616
set runtimeDepsBaseTag to cat(

‎eng/dockerfile-templates/runtime/Dockerfile.linux.install-runtime‎

Lines changed: 42 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -10,48 +10,55 @@
1010
is-composite-runtime (optional): Whether to install aspnetcore composite version ^
1111

1212
set dotnetVersion to join(slice(split(PRODUCT_VERSION, "."), 0, 2), ".") ^
13-
set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
14-
set varPlatform to when(isAlpine, "linux-musl", "linux") ^
15-
set runtimeVersionDir to when(ARGS["use-local-version-var"],
16-
"$dotnet_version",
17-
when(ARGS["is-internal"],
18-
VARIABLES[cat("runtime|", dotnetVersion, "|build-version")],
19-
"$DOTNET_VERSION")) ^
20-
set aspnetCompositeVersionDir to when(ARGS["use-local-version-var"],
21-
"$aspnetcore_version",
22-
when(ARGS["is-internal"],
13+
set productVersion to VARIABLES[cat("dotnet|", dotnetVersion, "|product-version")] ^
14+
set buildVersion to
15+
when(ARGS["is-composite-runtime"],
2316
VARIABLES[cat("aspnet|", dotnetVersion, "|build-version")],
24-
"$ASPNET_VERSION")) ^
25-
set isStableBranding to (find(VARIABLES[cat("sdk|", dotnetVersion, "|build-version")], "-servicing") >= 0 ||
26-
find(VARIABLES[cat("sdk|", dotnetVersion, "|build-version")], "-rtm") >= 0) ^
27-
set runtimeVersionFile to when(isStableBranding,
28-
VARIABLES[cat("dotnet|", dotnetVersion, "|product-version")],
29-
runtimeVersionDir) ^
30-
set aspnetCompositeVersionFile to when(isStableBranding,
31-
VARIABLES[cat("dotnet|", dotnetVersion, "|product-version")],
32-
aspnetCompositeVersionDir) ^
33-
set filePlatform to when(isAlpine, "-linux-musl", "-linux") ^
17+
VARIABLES[cat("runtime|", dotnetVersion, "|build-version")]) ^
18+
19+
set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
20+
set platform to when(isAlpine, "linux-musl", "linux") ^
21+
22+
set versionDir to
23+
when(ARGS["is-composite-runtime"],
24+
when(ARGS["use-local-version-var"],
25+
"$aspnetcore_version",
26+
"$ASPNET_VERSION"),
27+
when(ARGS["use-local-version-var"],
28+
"$dotnet_version",
29+
"$DOTNET_VERSION")) ^
30+
31+
set sdkBuildVersion to VARIABLES[cat("sdk|", dotnetVersion, "|build-version")] ^
32+
set isStableBranding to find(sdkBuildVersion, "-servicing") >= 0 || find(sdkBuildVersion, "-rtm") >= 0 ^
33+
34+
set fileVersion to when(isStableBranding, productVersion, versionDir) ^
35+
36+
_ This is specific to the layout of the staging storage account blob containers. ^
37+
if (ARGS["is-internal"]):{{
38+
set versionDir to buildVersion ^
39+
set fileVersion to productVersion
40+
}} ^
41+
3442
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
35-
set runtimeBaseUrl to cat(baseUrl, "/Runtime/", runtimeVersionDir, "/") ^
36-
set aspnetCompositeUrl to cat(baseUrl, "/aspnetcore/Runtime/", aspnetCompositeVersionDir, "/aspnetcore-runtime-composite-", aspnetCompositeVersionFile,
37-
filePlatform, "-", ARCH_SHORT, ".tar.gz") ^
38-
set files to when(ARGS["is-composite-runtime"],
39-
[
40-
[
41-
"filename": "dotnet.tar.gz",
42-
"url": aspnetCompositeUrl,
43-
"sha": VARIABLES[join(["aspnet-composite", dotnetVersion, varPlatform, ARCH_SHORT, "sha"], "|")],
44-
"sha-var-name": "dotnet_sha512"
45-
]
46-
],
43+
set downloadUrl to
44+
when(ARGS["is-composite-runtime"],
45+
cat(baseUrl, "/aspnetcore/Runtime/", versionDir, "/aspnetcore-runtime-composite-", fileVersion, "-", platform, "-", ARCH_SHORT, ".tar.gz"),
46+
cat(baseUrl, "/Runtime/", versionDir, "/dotnet-runtime-", fileVersion, "-", platform, "-", ARCH_SHORT, ".tar.gz")) ^
47+
set sha to
48+
when(ARGS["is-composite-runtime"],
49+
VARIABLES[join(["aspnet-composite", dotnetVersion, platform, ARCH_SHORT, "sha"], "|")],
50+
VARIABLES[join(["runtime", dotnetVersion, platform, ARCH_SHORT, "sha"], "|")]) ^
51+
52+
set files to
4753
[
4854
[
4955
"filename": "dotnet.tar.gz",
50-
"url": cat(runtimeBaseUrl, "dotnet-runtime-", runtimeVersionFile, "-", varPlatform, "-", ARCH_SHORT, ".tar.gz"),
51-
"sha": VARIABLES[join(["runtime", dotnetVersion, varPlatform, ARCH_SHORT, "sha"], "|")],
56+
"url": downloadUrl,
57+
"sha": sha,
5258
"sha-var-name": "dotnet_sha512"
5359
]
54-
]) ^
60+
] ^
61+
5562
set copyEnabled to ARGS["install-method"] = "copy-and-install" ^
5663
set downloadEnabled to ARGS["install-method"] = "download" || ARGS["install-method"] = "download-and-install" ^
5764
set installEnabled to ARGS["install-method"] = "download-and-install" || ARGS["install-method"] = "copy-and-install"

‎eng/dockerfile-templates/runtime/Dockerfile.windows‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
set isServer2025 to find(OS_VERSION_NUMBER, "2025") >= 0 ^
55

66
set baseUrl to VARIABLES[cat("dotnet|", dotnetVersion, "|base-url|", VARIABLES["branch"])] ^
7-
set isInternal to find(baseUrl, "artifacts.visualstudio.com") >= 0 ^
7+
set isInternal to find(baseUrl, "dotnetstage") >= 0 ^
88

99
set installerStageRepo to cat("mcr.microsoft.com/windows/", "servercore") ^
1010
set runtimeStageRepo to cat("mcr.microsoft.com/windows/", when(isServerCore, "servercore", "nanoserver")) ^

0 commit comments

Comments
 (0)