fix: resolve Dockerfile ponytail issues H1-H4

[stuartmhannon]

Resolves four Dockerfile ponytail issues identified in the audit:

• H1: Pin FROM debian:trixie to @sha256 digest for reproducible builds
• H2: Remove apt-get upgrade -y which made builds non-reproducible
• H3: Pin go install to debos@v1.1.7 tagged release instead of @latest
• H4: Replace shell-form ENTRYPOINT with exec-form + entrypoint.sh supporting BUILD_TARGET env var (values: all, uboot, kernel-mainline, kernel-bsp, images)

Addresses #77 and #78

[alchark]

Thanks a lot for your contribution! The changes overall look fine, please see inside for a couple of small comments.

[alchark]

We're currently transitioning the build scripts to use upstream support for subvolume creation, currently available at go-debos/debos@62cb992 (but that will likely change some time soon)

[alchark]

Is the copying step required?

[alchark]

Let's also add targets for ospack and rootfs-img please

[stuartmhannon]

Addressed all three review comments:

Dockerfile line 51 (debos pin): Added a comment marking v1.1.7 as the known-stable point with a reference to the upstream subvolume transition (go-debos/debos#736/62cb992). Re-pin once the transition settles.

Dockerfile line 70 (COPY): Yes, required — the old shell-form ENTRYPOINT was an inline chain. Switching to exec-form ENTRYPOINT + entrypoint.sh gives us BUILD_TARGET selection at runtime. COPY is necessary because the build context is the repo root. Added explanatory comments.

entrypoint.sh (new targets): Added , , and targets to the case statement, target, and error message. Verified all three build scripts exist in the repo.

[stuartmhannon]

Addressed all three review comments:

Dockerfile line 51 (debos pin): Added a # ponytail comment marking v1.1.7 as the known-stable point with a reference to the upstream subvolume transition (go-debos/debos#736/62cb992). Re-pin once the transition settles.

Dockerfile line 70 (COPY): Yes, required — the old shell-form ENTRYPOINT was an inline chain. Switching to exec-form ENTRYPOINT + entrypoint.sh gives us BUILD_TARGET selection at runtime. COPY is necessary because the build context is the repo root. Added explanatory comments.

entrypoint.sh (new targets): Added ospack, rootfs-img, and dtbo targets to the case statement, all target, and error message. Verified all three build scripts exist in the repo.

[alchark]

Dockerfile line 70 (COPY): Yes, required — the old shell-form ENTRYPOINT was an inline chain. Switching to exec-form ENTRYPOINT + entrypoint.sh gives us BUILD_TARGET selection at runtime. COPY is necessary because the build context is the repo root. Added explanatory comments.

Wouldn't it be checked out alongside the rest of the sources in the respective step?

I would also avoid the explicit cd with an absolute path, given that the entrypoint.sh script is located in the same directory as the scripts it calls and not everyone uses the Docker build flow (and the script itself is not Docker-specific apart from this hardcoded path).

[alchark]

Please don't add untested changes. This script doesn't work this way, and it's not used in the normal build process.

[alchark]

Redundant, and also wrong for most systems unless running inside a Docker container build with today's Dockerfile