Skip to content

Commit 6ef1355

Browse files
osmmanosmman
authored
Merge pull request #373 from securesign/tturek/cli-stack-rework
Rework cli-stack: move cross-compilation out of component
2 parents 42923ca + da11988 commit 6ef1355

3 files changed

Lines changed: 60 additions & 64 deletions

File tree

‎Build.mak‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,20 @@
11
FIPS_MODULE ?= latest
22

3-
.PHONY:
3+
.PHONY: fetch-tsa-certs-linux
4+
fetch-tsa-certs-linux: ## Build native Linux binary (FIPS, CGO)
5+
env CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime go build -mod=readonly -buildvcs=false -o fetch_tsa_certs -trimpath ./cmd/fetch-tsa-certs
6+
7+
.PHONY:
48
cross-platform: fetch-tsa-certs-darwin-arm64 fetch-tsa-certs-darwin-amd64 fetch-tsa-certs-windows ## Build all distributable (cross-platform) binaries
59

610
.PHONY: fetch-tsa-certs-darwin-arm64
711
fetch-tsa-certs-darwin-arm64: ## Build for mac M1
8-
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build -mod=readonly -o fetch_tsa_certs_darwin_arm64 -trimpath ./cmd/fetch-tsa-certs
12+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_darwin_arm64 -trimpath ./cmd/fetch-tsa-certs
913

1014
.PHONY: fetch-tsa-certs-darwin-amd64
1115
fetch-tsa-certs-darwin-amd64: ## Build for Darwin (macOS)
12-
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build -mod=readonly -o fetch_tsa_certs_darwin_amd64 -trimpath ./cmd/fetch-tsa-certs
16+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_darwin_amd64 -trimpath ./cmd/fetch-tsa-certs
1317

1418
.PHONY: fetch-tsa-certs-windows
1519
fetch-tsa-certs-windows: ## Build for Windows
16-
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build -mod=readonly -o fetch_tsa_certs_windows_amd64.exe -trimpath ./cmd/fetch-tsa-certs
20+
env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_windows_amd64.exe -trimpath ./cmd/fetch-tsa-certs

‎Dockerfile.cli-stack.rh‎

Lines changed: 46 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,59 @@
1-
FROM --platform=linux/amd64 quay.io/securesign/fetch-tsa-certs@sha256:77b2a8640e8417921161869ff447e2c13479131d8700b34bd4e8697e2c799aca AS build-amd64
2-
FROM --platform=linux/arm64 quay.io/securesign/fetch-tsa-certs@sha256:784bf6296c636231054112c37a1399afedbd137c8d9adf5b8861d472bed3f97c AS build-arm64
3-
FROM --platform=linux/ppc64le quay.io/securesign/fetch-tsa-certs@sha256:ad659c674d7bfe8a59fc733b4656564b0bb5c35916abce274eb22d80111c86ba AS build-ppc64le
4-
FROM --platform=linux/s390x quay.io/securesign/fetch-tsa-certs@sha256:81fecc40486c85cd3d42802b533ce625feb6ed704f63cea7de41c8eb974cb6d9 AS build-s390x
1+
FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS build-cross-platform
2+
ENV APP_ROOT=/opt/app-root \
3+
GOPATH=/opt/app-root
54

6-
FROM registry.redhat.io/ubi9/go-toolset:9.7-1774618347@sha256:0f4f6f7868962aa75dddfe4230b664bdf77071e92c43c70c824c58450e37693f AS packager
5+
USER root
6+
WORKDIR $APP_ROOT/src
7+
ADD go.mod go.sum ./
8+
ADD ./ ./
9+
10+
RUN git config --global --add safe.directory /opt/app-root/src && \
11+
go mod download && \
12+
make -f Build.mak cross-platform
13+
14+
FROM --platform=linux/amd64 quay.io/securesign/fetch-tsa-certs@sha256:c106febc6ee5320e50f09b93c7bbc7391290e465f55a87c913762fea7f738573 AS build-amd64
15+
FROM --platform=linux/arm64 quay.io/securesign/fetch-tsa-certs@sha256:c106febc6ee5320e50f09b93c7bbc7391290e465f55a87c913762fea7f738573 AS build-arm64
16+
FROM --platform=linux/ppc64le quay.io/securesign/fetch-tsa-certs@sha256:c106febc6ee5320e50f09b93c7bbc7391290e465f55a87c913762fea7f738573 AS build-ppc64le
17+
FROM --platform=linux/s390x quay.io/securesign/fetch-tsa-certs@sha256:c106febc6ee5320e50f09b93c7bbc7391290e465f55a87c913762fea7f738573 AS build-s390x
18+
19+
FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS packager
720
USER root
821
RUN mkdir -p /binaries
922

10-
# Native Linux binaries from each arch variant
11-
COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs_linux.gz /tmp/fetch_tsa_certs_linux.gz
12-
RUN gzip -d /tmp/fetch_tsa_certs_linux.gz && \
13-
tar -czf /binaries/fetch_tsa_certs_linux_amd64.tar.gz -C /tmp fetch_tsa_certs_linux && \
14-
rm /tmp/fetch_tsa_certs_linux
15-
16-
COPY --from=build-arm64 /usr/local/bin/fetch_tsa_certs_linux.gz /tmp/fetch_tsa_certs_linux.gz
17-
RUN gzip -d /tmp/fetch_tsa_certs_linux.gz && \
18-
tar -czf /binaries/fetch_tsa_certs_linux_arm64.tar.gz -C /tmp fetch_tsa_certs_linux && \
19-
rm /tmp/fetch_tsa_certs_linux
20-
21-
COPY --from=build-ppc64le /usr/local/bin/fetch_tsa_certs_linux.gz /tmp/fetch_tsa_certs_linux.gz
22-
RUN gzip -d /tmp/fetch_tsa_certs_linux.gz && \
23-
tar -czf /binaries/fetch_tsa_certs_linux_ppc64le.tar.gz -C /tmp fetch_tsa_certs_linux && \
24-
rm /tmp/fetch_tsa_certs_linux
25-
26-
COPY --from=build-s390x /usr/local/bin/fetch_tsa_certs_linux.gz /tmp/fetch_tsa_certs_linux.gz
27-
RUN gzip -d /tmp/fetch_tsa_certs_linux.gz && \
28-
tar -czf /binaries/fetch_tsa_certs_linux_s390x.tar.gz -C /tmp fetch_tsa_certs_linux && \
29-
rm /tmp/fetch_tsa_certs_linux
30-
31-
# Darwin amd64
32-
COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz /tmp/fetch_tsa_certs_darwin_amd64.gz
33-
RUN gzip -d /tmp/fetch_tsa_certs_darwin_amd64.gz && \
34-
tar -czf /binaries/fetch_tsa_certs_darwin_amd64.tar.gz -C /tmp fetch_tsa_certs_darwin_amd64 && \
23+
# fetch_tsa_certs: Native Linux binaries from each arch variant
24+
COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
25+
RUN tar -czf /binaries/fetch_tsa_certs_linux_amd64.tar.gz -C /tmp fetch_tsa_certs && \
26+
rm /tmp/fetch_tsa_certs
27+
28+
COPY --from=build-arm64 /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
29+
RUN tar -czf /binaries/fetch_tsa_certs_linux_arm64.tar.gz -C /tmp fetch_tsa_certs && \
30+
rm /tmp/fetch_tsa_certs
31+
32+
COPY --from=build-ppc64le /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
33+
RUN tar -czf /binaries/fetch_tsa_certs_linux_ppc64le.tar.gz -C /tmp fetch_tsa_certs && \
34+
rm /tmp/fetch_tsa_certs
35+
36+
COPY --from=build-s390x /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs
37+
RUN tar -czf /binaries/fetch_tsa_certs_linux_s390x.tar.gz -C /tmp fetch_tsa_certs && \
38+
rm /tmp/fetch_tsa_certs
39+
40+
# fetch_tsa_certs: Cross-compiled binaries
41+
COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_darwin_amd64 /tmp/fetch_tsa_certs_darwin_amd64
42+
RUN tar -czf /binaries/fetch_tsa_certs_darwin_amd64.tar.gz -C /tmp fetch_tsa_certs_darwin_amd64 && \
3543
rm /tmp/fetch_tsa_certs_darwin_amd64
3644

37-
# Darwin arm64
38-
COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz /tmp/fetch_tsa_certs_darwin_arm64.gz
39-
RUN gzip -d /tmp/fetch_tsa_certs_darwin_arm64.gz && \
40-
tar -czf /binaries/fetch_tsa_certs_darwin_arm64.tar.gz -C /tmp fetch_tsa_certs_darwin_arm64 && \
45+
COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_darwin_arm64 /tmp/fetch_tsa_certs_darwin_arm64
46+
RUN tar -czf /binaries/fetch_tsa_certs_darwin_arm64.tar.gz -C /tmp fetch_tsa_certs_darwin_arm64 && \
4147
rm /tmp/fetch_tsa_certs_darwin_arm64
4248

43-
# Windows amd64
44-
COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz /tmp/fetch_tsa_certs_windows_amd64.exe.gz
45-
RUN gzip -d /tmp/fetch_tsa_certs_windows_amd64.exe.gz && \
46-
tar -czf /binaries/fetch_tsa_certs_windows_amd64.tar.gz -C /tmp fetch_tsa_certs_windows_amd64.exe && \
49+
COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_windows_amd64.exe /tmp/fetch_tsa_certs_windows_amd64.exe
50+
RUN tar -czf /binaries/fetch_tsa_certs_windows_amd64.tar.gz -C /tmp fetch_tsa_certs_windows_amd64.exe && \
4751
rm /tmp/fetch_tsa_certs_windows_amd64.exe
4852

53+
RUN chmod -R a+rX /binaries
54+
4955
# Final minimal image with all binaries
50-
FROM registry.redhat.io/ubi9/ubi-minimal@sha256:83006d535923fcf1345067873524a3980316f51794f01d8655be55d6e9387183
56+
FROM registry.redhat.io/ubi9/ubi-micro:9.8@sha256:b498b3ea26111ab4b81d65139f2ebd2ef9a2abb7a4588b7fdcc54889f95e9caa
5157

5258
LABEL description="Flat image containing fetch-tsa-certs CLI binaries for all platforms and architectures"
5359
LABEL io.k8s.description="Flat image containing fetch-tsa-certs CLI binaries for all platforms and architectures"
@@ -56,10 +62,9 @@ LABEL io.k8s.display-name="Fetch TSA certs CLI stack image for Red Hat Trusted A
5662
LABEL io.openshift.tags="fetch-tsa-certs trusted-artifact-signer cli-stack"
5763
LABEL summary="Provides all fetch-tsa-certs CLI binaries as tar.gz archives for CDN distribution."
5864
LABEL com.redhat.component="fetch-tsa-certs-cli-stack"
65+
LABEL name="rhtas/fetch-tsa-certs-cli-stack"
5966

6067
COPY --from=packager /binaries/ /binaries/
6168
COPY --from=build-amd64 /licenses/ /licenses/
6269

63-
RUN chown -R root:0 /binaries && chmod -R g+r /binaries
64-
6570
USER 65532:65532

‎Dockerfile.fetch_tsa_certs.rh‎

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
FROM registry.redhat.io/ubi9/go-toolset:9.7-1774618347@sha256:0f4f6f7868962aa75dddfe4230b664bdf77071e92c43c70c824c58450e37693f as build-env
2-
ENV GOEXPERIMENT=strictfipsruntime
3-
ENV CGO_ENABLED=1
42
ENV APP_ROOT=/opt/app-root
53
ENV GOPATH=$APP_ROOT
64
WORKDIR $APP_ROOT/src/
@@ -12,12 +10,7 @@ ADD ./cmd/ $APP_ROOT/src/cmd/
1210
ADD ./pkg/ $APP_ROOT/src/pkg/
1311
ADD ./Build.mak $APP_ROOT/src/Build.mak
1412

15-
RUN go build -mod=readonly -o fetch_tsa_certs_linux -trimpath ./cmd/fetch-tsa-certs && \
16-
gzip -k fetch_tsa_certs_linux && \
17-
make -f Build.mak cross-platform && \
18-
gzip fetch_tsa_certs_darwin_arm64 && \
19-
gzip fetch_tsa_certs_darwin_amd64 && \
20-
gzip fetch_tsa_certs_windows_amd64.exe
13+
RUN make -f Build.mak fetch-tsa-certs-linux
2114

2215
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:83006d535923fcf1345067873524a3980316f51794f01d8655be55d6e9387183
2316
ENV APP_ROOT=/opt/app-root
@@ -33,14 +26,8 @@ LABEL name="rhtas/fetch-tsa-certs-rhel9"
3326

3427
COPY LICENSE /licenses/license.txt
3528

36-
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_linux /usr/local/bin/fetch_tsa_certs_linux
37-
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_linux.gz /usr/local/bin/fetch_tsa_certs_linux.gz
38-
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_darwin_arm64.gz /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz
39-
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_darwin_amd64.gz /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz
40-
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs_windows_amd64.exe.gz /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz
41-
42-
RUN chown root:0 /usr/local/bin/fetch_tsa_certs_linux.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_linux.gz && \
43-
chown root:0 /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_darwin_arm64.gz && \
44-
chown root:0 /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_darwin_amd64.gz && \
45-
chown root:0 /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz && chmod g+wx /usr/local/bin/fetch_tsa_certs_windows_amd64.exe.gz && \
46-
chgrp -R 0 /${HOME} && chmod -R g=u /${HOME}
29+
COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs /usr/local/bin/fetch_tsa_certs
30+
31+
USER 65532:65532
32+
33+
ENTRYPOINT ["fetch_tsa_certs"]

0 commit comments

Comments
 (0)