Skip to content

Commit 7089e96

Browse files
sampras343sampras343
authored
Merge pull request #710 from securesign/fix/cli-stack-rework
build: rework cli-stack, move cross-compilation out of component images
2 parents b24a3dc + 711faaa commit 7089e96

4 files changed

Lines changed: 73 additions & 94 deletions

File tree

‎.tekton/trillian-cli-stack-push.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ spec:
2828
value: .
2929
- name: revision
3030
value: '{{revision}}'
31+
- name: prefetch-input
32+
value: '{"type": "gomod", "path": "."}'
3133
- name: hermetic
3234
value: "false"
3335
- name: build-source-image

‎Dockerfile.cli-stack.rh‎

Lines changed: 63 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,93 +1,97 @@
1-
FROM --platform=linux/amd64 quay.io/securesign/trillian-createtree@sha256:d05ca8ed661009c68e6964f8fdebde0b8ff5b8bfc63757c9d67f4e9d34caa449 AS createtree-amd64
2-
FROM --platform=linux/arm64 quay.io/securesign/trillian-createtree@sha256:170f40a5918f434f489abde2ee154030c9321053ab5ad0d8559d1de68874c84f AS createtree-arm64
3-
FROM --platform=linux/ppc64le quay.io/securesign/trillian-createtree@sha256:caae5b258ff276cf75f305931131a7f26c44a562255ca7e7708e23c9ab79fc8a AS createtree-ppc64le
4-
FROM --platform=linux/s390x quay.io/securesign/trillian-createtree@sha256:ca8c1450f7c59f84ebbb847fa6b69130e0027c92fd92d016eaf34acbc25fed67 AS createtree-s390x
5-
6-
FROM --platform=linux/amd64 quay.io/securesign/trillian-updatetree@sha256:a8faaae4b7c8c0db529951e3d4937cabaf84a9569004c72cdbde900101632ff1 AS updatetree-amd64
7-
FROM --platform=linux/arm64 quay.io/securesign/trillian-updatetree@sha256:3dc96414da356bc7db6ab80aa5f1ea840bfec1a3f68fe1d85a56c2479c64ce27 AS updatetree-arm64
8-
FROM --platform=linux/ppc64le quay.io/securesign/trillian-updatetree@sha256:6b559dc73c7f1e0bf5dc36700a16fe7261267987b28a1c385d1329a75d8f21ae AS updatetree-ppc64le
9-
FROM --platform=linux/s390x quay.io/securesign/trillian-updatetree@sha256:2f255abb8d3d27452f83cadba766d2000ee48e6107904ce7495c51c986881ea1 AS updatetree-s390x
1+
FROM registry.redhat.io/ubi9/go-toolset:9.7-1778604137@sha256:e06a6f4c85c3ca75f64127542449c9770fb885adfb592f987c576d268ac108de AS build-cross-platform
2+
ENV APP_ROOT=/opt/app-root \
3+
GOPATH=/opt/app-root \
4+
CGO_ENABLED=0 \
5+
GOFLAGS="-buildvcs=false" \
6+
GOEXPERIMENT=strictfipsruntime
7+
8+
WORKDIR $APP_ROOT/src
9+
ADD go.mod go.sum ./
10+
ADD ./ ./
11+
12+
RUN go mod download && \
13+
git config --global --add safe.directory /opt/app-root/src && \
14+
make -f Build-clis.mak createtree-cross-platform && \
15+
make -f Build-clis.mak updatetree-cross-platform
16+
17+
FROM --platform=linux/amd64 quay.io/securesign/trillian-createtree@sha256:49ffea5617c003c5637d29a5a5eb6897039327270f46269a62152cabd61d3ce7 AS createtree-amd64
18+
FROM --platform=linux/arm64 quay.io/securesign/trillian-createtree@sha256:49ffea5617c003c5637d29a5a5eb6897039327270f46269a62152cabd61d3ce7 AS createtree-arm64
19+
FROM --platform=linux/ppc64le quay.io/securesign/trillian-createtree@sha256:49ffea5617c003c5637d29a5a5eb6897039327270f46269a62152cabd61d3ce7 AS createtree-ppc64le
20+
FROM --platform=linux/s390x quay.io/securesign/trillian-createtree@sha256:49ffea5617c003c5637d29a5a5eb6897039327270f46269a62152cabd61d3ce7 AS createtree-s390x
21+
22+
FROM --platform=linux/amd64 quay.io/securesign/trillian-updatetree@sha256:f9ff07bab60d278a86e5b2d4ff66952a9ac218dadee500331e096558ffcb327f AS updatetree-amd64
23+
FROM --platform=linux/arm64 quay.io/securesign/trillian-updatetree@sha256:f9ff07bab60d278a86e5b2d4ff66952a9ac218dadee500331e096558ffcb327f AS updatetree-arm64
24+
FROM --platform=linux/ppc64le quay.io/securesign/trillian-updatetree@sha256:f9ff07bab60d278a86e5b2d4ff66952a9ac218dadee500331e096558ffcb327f AS updatetree-ppc64le
25+
FROM --platform=linux/s390x quay.io/securesign/trillian-updatetree@sha256:f9ff07bab60d278a86e5b2d4ff66952a9ac218dadee500331e096558ffcb327f AS updatetree-s390x
1026

1127
FROM registry.redhat.io/ubi9/go-toolset:9.7-1778604137@sha256:e06a6f4c85c3ca75f64127542449c9770fb885adfb592f987c576d268ac108de AS packager
1228
USER root
1329
RUN mkdir -p /binaries
1430

1531
# createtree: Native Linux binaries from each arch variant
16-
COPY --from=createtree-amd64 /usr/local/bin/createtree.gz /tmp/createtree.gz
17-
RUN gzip -d /tmp/createtree.gz && \
18-
tar -czf /binaries/createtree_linux_amd64.tar.gz -C /tmp createtree && \
32+
COPY --from=createtree-amd64 /createtree /tmp/createtree
33+
RUN tar -czf /binaries/createtree_linux_amd64.tar.gz -C /tmp createtree && \
1934
rm /tmp/createtree
2035

21-
COPY --from=createtree-arm64 /usr/local/bin/createtree.gz /tmp/createtree.gz
22-
RUN gzip -d /tmp/createtree.gz && \
23-
tar -czf /binaries/createtree_linux_arm64.tar.gz -C /tmp createtree && \
36+
COPY --from=createtree-arm64 /createtree /tmp/createtree
37+
RUN tar -czf /binaries/createtree_linux_arm64.tar.gz -C /tmp createtree && \
2438
rm /tmp/createtree
2539

26-
COPY --from=createtree-ppc64le /usr/local/bin/createtree.gz /tmp/createtree.gz
27-
RUN gzip -d /tmp/createtree.gz && \
28-
tar -czf /binaries/createtree_linux_ppc64le.tar.gz -C /tmp createtree && \
40+
COPY --from=createtree-ppc64le /createtree /tmp/createtree
41+
RUN tar -czf /binaries/createtree_linux_ppc64le.tar.gz -C /tmp createtree && \
2942
rm /tmp/createtree
3043

31-
COPY --from=createtree-s390x /usr/local/bin/createtree.gz /tmp/createtree.gz
32-
RUN gzip -d /tmp/createtree.gz && \
33-
tar -czf /binaries/createtree_linux_s390x.tar.gz -C /tmp createtree && \
44+
COPY --from=createtree-s390x /createtree /tmp/createtree
45+
RUN tar -czf /binaries/createtree_linux_s390x.tar.gz -C /tmp createtree && \
3446
rm /tmp/createtree
3547

3648
# createtree: Cross-compiled binaries
37-
COPY --from=createtree-amd64 /usr/local/bin/createtree-darwin-amd64.gz /tmp/createtree-darwin-amd64.gz
38-
RUN gzip -d /tmp/createtree-darwin-amd64.gz && \
39-
tar -czf /binaries/createtree_darwin_amd64.tar.gz -C /tmp createtree-darwin-amd64 && \
40-
rm /tmp/createtree-darwin-amd64
49+
COPY --from=build-cross-platform /opt/app-root/src/createtree-darwin-amd64 /tmp/createtree
50+
RUN tar -czf /binaries/createtree_darwin_amd64.tar.gz -C /tmp createtree && \
51+
rm /tmp/createtree
4152

42-
COPY --from=createtree-amd64 /usr/local/bin/createtree-darwin-arm64.gz /tmp/createtree-darwin-arm64.gz
43-
RUN gzip -d /tmp/createtree-darwin-arm64.gz && \
44-
tar -czf /binaries/createtree_darwin_arm64.tar.gz -C /tmp createtree-darwin-arm64 && \
45-
rm /tmp/createtree-darwin-arm64
53+
COPY --from=build-cross-platform /opt/app-root/src/createtree-darwin-arm64 /tmp/createtree
54+
RUN tar -czf /binaries/createtree_darwin_arm64.tar.gz -C /tmp createtree && \
55+
rm /tmp/createtree
4656

47-
COPY --from=createtree-amd64 /usr/local/bin/createtree-windows-amd64.exe.gz /tmp/createtree-windows-amd64.exe.gz
48-
RUN gzip -d /tmp/createtree-windows-amd64.exe.gz && \
49-
tar -czf /binaries/createtree_windows_amd64.tar.gz -C /tmp createtree-windows-amd64.exe && \
50-
rm /tmp/createtree-windows-amd64.exe
57+
COPY --from=build-cross-platform /opt/app-root/src/createtree-windows-amd64.exe /tmp/createtree.exe
58+
RUN tar -czf /binaries/createtree_windows_amd64.tar.gz -C /tmp createtree.exe && \
59+
rm /tmp/createtree.exe
5160

5261
# updatetree: Native Linux binaries from each arch variant
53-
COPY --from=updatetree-amd64 /usr/local/bin/updatetree.gz /tmp/updatetree.gz
54-
RUN gzip -d /tmp/updatetree.gz && \
55-
tar -czf /binaries/updatetree_linux_amd64.tar.gz -C /tmp updatetree && \
62+
COPY --from=updatetree-amd64 /updatetree /tmp/updatetree
63+
RUN tar -czf /binaries/updatetree_linux_amd64.tar.gz -C /tmp updatetree && \
5664
rm /tmp/updatetree
5765

58-
COPY --from=updatetree-arm64 /usr/local/bin/updatetree.gz /tmp/updatetree.gz
59-
RUN gzip -d /tmp/updatetree.gz && \
60-
tar -czf /binaries/updatetree_linux_arm64.tar.gz -C /tmp updatetree && \
66+
COPY --from=updatetree-arm64 /updatetree /tmp/updatetree
67+
RUN tar -czf /binaries/updatetree_linux_arm64.tar.gz -C /tmp updatetree && \
6168
rm /tmp/updatetree
6269

63-
COPY --from=updatetree-ppc64le /usr/local/bin/updatetree.gz /tmp/updatetree.gz
64-
RUN gzip -d /tmp/updatetree.gz && \
65-
tar -czf /binaries/updatetree_linux_ppc64le.tar.gz -C /tmp updatetree && \
70+
COPY --from=updatetree-ppc64le /updatetree /tmp/updatetree
71+
RUN tar -czf /binaries/updatetree_linux_ppc64le.tar.gz -C /tmp updatetree && \
6672
rm /tmp/updatetree
6773

68-
COPY --from=updatetree-s390x /usr/local/bin/updatetree.gz /tmp/updatetree.gz
69-
RUN gzip -d /tmp/updatetree.gz && \
70-
tar -czf /binaries/updatetree_linux_s390x.tar.gz -C /tmp updatetree && \
74+
COPY --from=updatetree-s390x /updatetree /tmp/updatetree
75+
RUN tar -czf /binaries/updatetree_linux_s390x.tar.gz -C /tmp updatetree && \
7176
rm /tmp/updatetree
7277

7378
# updatetree: Cross-compiled binaries
74-
COPY --from=updatetree-amd64 /usr/local/bin/updatetree-darwin-amd64.gz /tmp/updatetree-darwin-amd64.gz
75-
RUN gzip -d /tmp/updatetree-darwin-amd64.gz && \
76-
tar -czf /binaries/updatetree_darwin_amd64.tar.gz -C /tmp updatetree-darwin-amd64 && \
77-
rm /tmp/updatetree-darwin-amd64
79+
COPY --from=build-cross-platform /opt/app-root/src/updatetree-darwin-amd64 /tmp/updatetree
80+
RUN tar -czf /binaries/updatetree_darwin_amd64.tar.gz -C /tmp updatetree && \
81+
rm /tmp/updatetree
7882

79-
COPY --from=updatetree-amd64 /usr/local/bin/updatetree-darwin-arm64.gz /tmp/updatetree-darwin-arm64.gz
80-
RUN gzip -d /tmp/updatetree-darwin-arm64.gz && \
81-
tar -czf /binaries/updatetree_darwin_arm64.tar.gz -C /tmp updatetree-darwin-arm64 && \
82-
rm /tmp/updatetree-darwin-arm64
83+
COPY --from=build-cross-platform /opt/app-root/src/updatetree-darwin-arm64 /tmp/updatetree
84+
RUN tar -czf /binaries/updatetree_darwin_arm64.tar.gz -C /tmp updatetree && \
85+
rm /tmp/updatetree
86+
87+
COPY --from=build-cross-platform /opt/app-root/src/updatetree-windows-amd64.exe /tmp/updatetree.exe
88+
RUN tar -czf /binaries/updatetree_windows_amd64.tar.gz -C /tmp updatetree.exe && \
89+
rm /tmp/updatetree.exe
8390

84-
COPY --from=updatetree-amd64 /usr/local/bin/updatetree-windows-amd64.exe.gz /tmp/updatetree-windows-amd64.exe.gz
85-
RUN gzip -d /tmp/updatetree-windows-amd64.exe.gz && \
86-
tar -czf /binaries/updatetree_windows_amd64.tar.gz -C /tmp updatetree-windows-amd64.exe && \
87-
rm /tmp/updatetree-windows-amd64.exe
91+
RUN chmod -R a+rX /binaries
8892

8993
# Final minimal image with all binaries
90-
FROM registry.redhat.io/ubi9/ubi-minimal@sha256:12db9874bd753eb98b1ab3d840e75de5d6842ac0604fbd68c012adefe97140be
94+
FROM registry.redhat.io/ubi9/ubi-micro:9.8@sha256:b498b3ea26111ab4b81d65139f2ebd2ef9a2abb7a4588b7fdcc54889f95e9caa
9195

9296
LABEL description="Flat image containing createtree and updatetree CLI binaries for all platforms and architectures"
9397
LABEL io.k8s.description="Flat image containing createtree and updatetree CLI binaries for all platforms and architectures"
@@ -96,10 +100,9 @@ LABEL io.k8s.display-name="Trillian CLI stack image for Red Hat Trusted Artifact
96100
LABEL io.openshift.tags="trillian createtree updatetree trusted-artifact-signer cli-stack"
97101
LABEL summary="Provides all trillian CLI binaries (createtree, updatetree) as tar.gz archives for CDN distribution."
98102
LABEL com.redhat.component="trillian-cli-stack"
103+
LABEL name="rhtas/trillian-cli-stack"
99104

100105
COPY --from=packager /binaries/ /binaries/
101106
COPY --from=createtree-amd64 /licenses/ /licenses/
102107

103-
RUN chown -R root:0 /binaries && chmod -R g+r /binaries
104-
105108
USER 65532:65532

‎Dockerfile.createtree.rh‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,7 @@ ADD ./ ./
1111

1212
RUN go mod download && \
1313
git config --global --add safe.directory /opt/app-root/src && \
14-
go build -mod=mod -o createtree -trimpath ./cmd/createtree && \
15-
gzip -k createtree && \
16-
make -f Build-clis.mak createtree-cross-platform && \
17-
gzip createtree-darwin-amd64 && \
18-
gzip createtree-darwin-arm64 && \
19-
gzip createtree-windows-amd64.exe
14+
go build -mod=mod -o createtree -trimpath ./cmd/createtree
2015

2116
# Multi-Stage production build
2217
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:12db9874bd753eb98b1ab3d840e75de5d6842ac0604fbd68c012adefe97140be AS deploy
@@ -32,17 +27,9 @@ LABEL summary="Provides the trillian createtree binary for creating merkel trees
3227
LABEL com.redhat.component="createtree"
3328
LABEL name="rhtas/createtree-rhel9"
3429

35-
COPY --from=build /opt/app-root/src/createtree /
36-
COPY --from=build /opt/app-root/src/createtree.gz /usr/local/bin/createtree.gz
37-
COPY --from=build /opt/app-root/src/createtree-darwin-amd64.gz /usr/local/bin/createtree-darwin-amd64.gz
38-
COPY --from=build /opt/app-root/src/createtree-windows-amd64.exe.gz /usr/local/bin/createtree-windows-amd64.exe.gz
39-
COPY --from=build /opt/app-root/src/createtree-darwin-arm64.gz /usr/local/bin/createtree-darwin-arm64.gz
40-
41-
RUN chown root:0 createtree && chmod g+wx createtree && \
42-
chown root:0 /usr/local/bin/createtree.gz && chmod g+wx /usr/local/bin/createtree.gz && \
43-
chown root:0 /usr/local/bin/createtree-darwin-amd64.gz && chmod g+wx /usr/local/bin/createtree-darwin-amd64.gz && \
44-
chown root:0 /usr/local/bin/createtree-darwin-arm64.gz && chmod g+wx /usr/local/bin/createtree-darwin-arm64.gz && \
45-
chown root:0 /usr/local/bin/createtree-windows-amd64.exe.gz && chmod g+wx /usr/local/bin/createtree-windows-amd64.exe.gz
30+
COPY --from=build /opt/app-root/src/createtree /createtree
31+
32+
RUN chown root:0 createtree && chmod g+wx createtree
4633

4734
# Configure home directory
4835
ENV HOME=/home

‎Dockerfile.updatetree.rh‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,7 @@ ADD ./ ./
1111

1212
RUN go mod download && \
1313
git config --global --add safe.directory /opt/app-root/src && \
14-
go build -mod=mod -o updatetree -trimpath ./cmd/updatetree && \
15-
gzip -k updatetree && \
16-
make -f Build-clis.mak updatetree-cross-platform && \
17-
gzip updatetree-darwin-amd64 && \
18-
gzip updatetree-darwin-arm64 && \
19-
gzip updatetree-windows-amd64.exe
14+
go build -mod=mod -o updatetree -trimpath ./cmd/updatetree
2015

2116
# Multi-Stage production build
2217
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:12db9874bd753eb98b1ab3d840e75de5d6842ac0604fbd68c012adefe97140be AS deploy
@@ -32,17 +27,9 @@ LABEL summary="Provides the trillian updatetree binary for updating merkel trees
3227
LABEL com.redhat.component="updatetree"
3328
LABEL name="rhtas/updatetree-rhel9"
3429

35-
COPY --from=build /opt/app-root/src/updatetree /
36-
COPY --from=build /opt/app-root/src/updatetree.gz /usr/local/bin/updatetree.gz
37-
COPY --from=build /opt/app-root/src/updatetree-darwin-amd64.gz /usr/local/bin/updatetree-darwin-amd64.gz
38-
COPY --from=build /opt/app-root/src/updatetree-windows-amd64.exe.gz /usr/local/bin/updatetree-windows-amd64.exe.gz
39-
COPY --from=build /opt/app-root/src/updatetree-darwin-arm64.gz /usr/local/bin/updatetree-darwin-arm64.gz
40-
41-
RUN chown root:0 updatetree && chmod g+wx updatetree && \
42-
chown root:0 /usr/local/bin/updatetree.gz && chmod g+wx /usr/local/bin/updatetree.gz && \
43-
chown root:0 /usr/local/bin/updatetree-darwin-amd64.gz && chmod g+wx /usr/local/bin/updatetree-darwin-amd64.gz && \
44-
chown root:0 /usr/local/bin/updatetree-darwin-arm64.gz && chmod g+wx /usr/local/bin/updatetree-darwin-arm64.gz && \
45-
chown root:0 /usr/local/bin/updatetree-windows-amd64.exe.gz && chmod g+wx /usr/local/bin/updatetree-windows-amd64.exe.gz
30+
COPY --from=build /opt/app-root/src/updatetree /updatetree
31+
32+
RUN chown root:0 updatetree && chmod g+wx updatetree
4633

4734
##Configure home directory
4835
ENV HOME=/home

0 commit comments

Comments
 (0)