timestamp-authority/Dockerfile.fetch_tsa_certs.rh at main · securesign/timestamp-authority · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
FROM registry.redhat.io/ubi9/go-toolset:9.7-1774618347@sha256:0f4f6f7868962aa75dddfe4230b664bdf77071e92c43c70c824c58450e37693f as build-env
ENV GOEXPERIMENT=strictfipsruntime
ENV CGO_ENABLED=1
ENV APP_ROOT=/opt/app-root
ENV GOPATH=$APP_ROOT
WORKDIR $APP_ROOT/src/

ADD go.mod go.sum $APP_ROOT/src/
RUN go mod download

ADD ./cmd/ $APP_ROOT/src/cmd/
ADD ./pkg/ $APP_ROOT/src/pkg/
ADD ./Build.mak $APP_ROOT/src/Build.mak

RUN go build -mod=readonly -o fetch_tsa_certs_linux -trimpath ./cmd/fetch-tsa-certs && \
    gzip -k fetch_tsa_certs_linux && \
    make -f Build.mak cross-platform && \
    gzip fetch_tsa_certs_darwin_arm64 && \
    gzip fetch_tsa_certs_darwin_amd64 && \
    gzip fetch_tsa_certs_windows_amd64.exe

FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:83006d535923fcf1345067873524a3980316f51794f01d8655be55d6e9387183
ENV APP_ROOT=/opt/app-root
WORKDIR $APP_ROOT/src/

LABEL description="The fetch_tsa_certs binary is a cli used to configure the kms and tink signer types for Timestamp Authority."
LABEL io.k8s.description="The fetch_tsa_certs binary is a cli used to configure the kms and tink signer types for Timestamp Authority."
LABEL io.k8s.display-name="Fetch TSA certs container image for Red Hat Trusted Signer."
LABEL io.openshift.tags="fetch_tsa_certs"
LABEL summary="Provides fetch_tsa_certs images."
LABEL com.redhat.component="fetch_tsa_certs"
LABEL name="rhtas/fetch-tsa-certs-rhel9"

COPY LICENSE /licenses/license.txt

COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_linux /usr/local/bin/fetch_tsa_certs_linux
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_linux.gz /usr/local/bin/fetch_tsa_certs_linux.gz
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_darwin_arm64.gz /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_darwin_amd64.gz /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_windows_amd64.exe.gz /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz

RUN chown root:0 /usr/local/bin/fetch_tsa_certs_linux.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_linux.gz && \
    chown root:0 /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz && \
    chown root:0 /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz && \
    chown root:0 /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz && \
    chgrp -R 0 /${HOME} && chmod -R g=u /${HOME}