trillian/Dockerfile.cli-stack.rh at main · securesign/trillian · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
FROM registry.redhat.io/ubi9/go-toolset:9.8-1786522985@sha256:444e81b3e88d8a68b92a081a7b3abc7d3fed2450f8473ea6b3caebf3bb73a0b8 AS build-cross-platform
ENV APP_ROOT=/opt/app-root \
    GOPATH=/opt/app-root \
    CGO_ENABLED=0 \
    GOFIPS140=v1.0.0 \
    GOFLAGS="-buildvcs=false"

USER root
WORKDIR $APP_ROOT/src
ADD go.mod go.sum ./
ADD ./ ./

RUN go mod download && \
    git config --global --add safe.directory /opt/app-root/src && \
    go mod edit -godebug=fips140=auto && \
    make -f Build-clis.mak createtree-cross-platform && \
    make -f Build-clis.mak updatetree-cross-platform

FROM --platform=linux/amd64   quay.io/securesign/trillian-createtree@sha256:45925b1f50fc6606de8d337e761755e42de1ac795b8e1da84641770cf431f658 AS createtree-amd64
FROM --platform=linux/arm64   quay.io/securesign/trillian-createtree@sha256:bc6463af43f8dc9664a32e9b01dbae21a5692684717e75678f2ac5b68bfee670 AS createtree-arm64
FROM --platform=linux/ppc64le quay.io/securesign/trillian-createtree@sha256:cdde1632c2ce99bb7098b074ac63adc8df3b55260b15fea4e7c2d513930feb39 AS createtree-ppc64le
FROM --platform=linux/s390x   quay.io/securesign/trillian-createtree@sha256:48d7ab1659520cea453bdb5f105d9f99aa15a869c227c49f8c8f891b50e4c2e3 AS createtree-s390x

FROM --platform=linux/amd64   quay.io/securesign/trillian-updatetree@sha256:44d1b914efc623e22264d433f839560d113ff54d25e17a768615544ed8d810ef AS updatetree-amd64
FROM --platform=linux/arm64   quay.io/securesign/trillian-updatetree@sha256:c5b719df87c51370cbd3cb1afb37b736e08478c46f1491a40e0b21418d22eb38 AS updatetree-arm64
FROM --platform=linux/ppc64le quay.io/securesign/trillian-updatetree@sha256:47f7af286c38b98784249b2d84999c7253ba79420808fd946a94cfe2d76a6481 AS updatetree-ppc64le
FROM --platform=linux/s390x   quay.io/securesign/trillian-updatetree@sha256:89567834871cf02d29102c6aded0f04e682d52422b6e459f7a950730dab3a33f AS updatetree-s390x

FROM registry.redhat.io/ubi9/go-toolset:9.8-1786522985@sha256:444e81b3e88d8a68b92a081a7b3abc7d3fed2450f8473ea6b3caebf3bb73a0b8 AS packager
USER root
RUN mkdir -p /binaries

# createtree: Native Linux binaries from each arch variant
COPY --from=createtree-amd64 /createtree /tmp/createtree
RUN tar -czf /binaries/createtree_linux_amd64.tar.gz -C /tmp createtree && \
    rm /tmp/createtree

COPY --from=createtree-arm64 /createtree /tmp/createtree
RUN tar -czf /binaries/createtree_linux_arm64.tar.gz -C /tmp createtree && \
    rm /tmp/createtree

COPY --from=createtree-ppc64le /createtree /tmp/createtree
RUN tar -czf /binaries/createtree_linux_ppc64le.tar.gz -C /tmp createtree && \
    rm /tmp/createtree

COPY --from=createtree-s390x /createtree /tmp/createtree
RUN tar -czf /binaries/createtree_linux_s390x.tar.gz -C /tmp createtree && \
    rm /tmp/createtree

# createtree: Cross-compiled binaries
COPY --from=build-cross-platform /opt/app-root/src/createtree-darwin-amd64 /tmp/createtree
RUN tar -czf /binaries/createtree_darwin_amd64.tar.gz -C /tmp createtree && \
    rm /tmp/createtree

COPY --from=build-cross-platform /opt/app-root/src/createtree-darwin-arm64 /tmp/createtree
RUN tar -czf /binaries/createtree_darwin_arm64.tar.gz -C /tmp createtree && \
    rm /tmp/createtree

COPY --from=build-cross-platform /opt/app-root/src/createtree-windows-amd64.exe /tmp/createtree.exe
RUN tar -czf /binaries/createtree_windows_amd64.tar.gz -C /tmp createtree.exe && \
    rm /tmp/createtree.exe

# updatetree: Native Linux binaries from each arch variant
COPY --from=updatetree-amd64 /updatetree /tmp/updatetree
RUN tar -czf /binaries/updatetree_linux_amd64.tar.gz -C /tmp updatetree && \
    rm /tmp/updatetree

COPY --from=updatetree-arm64 /updatetree /tmp/updatetree
RUN tar -czf /binaries/updatetree_linux_arm64.tar.gz -C /tmp updatetree && \
    rm /tmp/updatetree

COPY --from=updatetree-ppc64le /updatetree /tmp/updatetree
RUN tar -czf /binaries/updatetree_linux_ppc64le.tar.gz -C /tmp updatetree && \
    rm /tmp/updatetree

COPY --from=updatetree-s390x /updatetree /tmp/updatetree
RUN tar -czf /binaries/updatetree_linux_s390x.tar.gz -C /tmp updatetree && \
    rm /tmp/updatetree

# updatetree: Cross-compiled binaries
COPY --from=build-cross-platform /opt/app-root/src/updatetree-darwin-amd64 /tmp/updatetree
RUN tar -czf /binaries/updatetree_darwin_amd64.tar.gz -C /tmp updatetree && \
    rm /tmp/updatetree

COPY --from=build-cross-platform /opt/app-root/src/updatetree-darwin-arm64 /tmp/updatetree
RUN tar -czf /binaries/updatetree_darwin_arm64.tar.gz -C /tmp updatetree && \
    rm /tmp/updatetree

COPY --from=build-cross-platform /opt/app-root/src/updatetree-windows-amd64.exe /tmp/updatetree.exe
RUN tar -czf /binaries/updatetree_windows_amd64.tar.gz -C /tmp updatetree.exe && \
    rm /tmp/updatetree.exe

RUN chmod -R a+rX /binaries

# Final minimal image with all binaries
FROM registry.redhat.io/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95

LABEL description="Flat image containing createtree and updatetree CLI binaries for all platforms and architectures"
LABEL io.k8s.description="Flat image containing createtree and updatetree CLI binaries for all platforms and architectures"
LABEL io.opencontainers.image.description="Flat image containing createtree and updatetree CLI binaries for all platforms and architectures"
LABEL io.k8s.display-name="Trillian CLI stack image for Red Hat Trusted Artifact Signer"
LABEL io.openshift.tags="trillian createtree updatetree trusted-artifact-signer cli-stack"
LABEL summary="Provides all trillian CLI binaries (createtree, updatetree) as tar.gz archives for CDN distribution."
LABEL com.redhat.component="trillian-cli-stack"
LABEL name="rhtas/trillian-cli-stack"

COPY --from=packager /binaries/ /binaries/
COPY --from=createtree-amd64 /licenses/ /licenses/

USER 65532:65532