tufcli/Dockerfile.rh at main · securesign/tufcli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Build stage
FROM registry.redhat.io/ubi9/go-toolset:9.8-1789040808@sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 AS builder

USER root
WORKDIR /app

COPY . .

ENV CGO_ENABLED=1
ENV GOFIPS140=v1.0.0

RUN cp -r hack/pcsc-lite/PCSC /usr/include/PCSC && \
    cp hack/pcsc-lite/libpcsclite.pc /usr/lib64/pkgconfig/libpcsclite.pc && \
    gcc -shared -o /usr/lib64/libpcsclite.so.1 hack/pcsc-lite/pcsc_stub.c -Wl,-soname,libpcsclite.so.1 && \
    ln -sf libpcsclite.so.1 /usr/lib64/libpcsclite.so
RUN go mod edit -godebug=fips140=auto
RUN go mod vendor
RUN go build -buildvcs=false -tags=no_openssl,piv -o tufcli .

# Final stage
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7b8e25a1b56ca4d00219198f3b5b51a3e1693a5c4f5369c5e190d7d6cb3f980e

COPY --from=builder /app/tufcli /tufcli
COPY --from=builder /usr/lib64/libpcsclite.so.1 /usr/lib64/libpcsclite.so.1
COPY LICENSE /licenses/LICENSE

LABEL description="tufcli is a Go command-line utility for generating and signing TUF repositories"
LABEL io.k8s.description="tufcli is a Go command-line utility for generating and signing TUF repositories"
LABEL io.k8s.display-name="tufcli container image for Red Hat Trusted Artifact Signer"
LABEL io.openshift.tags="tufcli Trusted Artifact Signer"
LABEL summary="Provides the tufcli binary for generating and signing TUF repositories"
LABEL com.redhat.component="tufcli"
LABEL name="rhtas/tufcli-rhel9"

USER 65532:65532

#ENTRYPOINT
ENTRYPOINT ["/tufcli"]