init
This commit is contained in:
Tiara Rodney
commit
b5265baa02
11 changed files with 3505 additions and 0 deletions
6
.gitignore
vendored
Normal file
6
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
/autom4te.cache
|
||||||
|
/configure~
|
||||||
|
/config.log
|
||||||
|
/config.status
|
||||||
|
/dist
|
||||||
|
/test-reports
|
||||||
140
Makefile
Normal file
140
Makefile
Normal file
|
|
@ -0,0 +1,140 @@
|
||||||
|
BITBUCKET_REPO_SLUG := oci-images
|
||||||
|
BITBUCKET_WORKSPACE := byteb4rb1e
|
||||||
|
DOCKER_REGISTRY := docker.io
|
||||||
|
DOCKER_REPO_SLUG := byteb4rb1e
|
||||||
|
GPG_SIGNER_FINGERPRINT := "91CD826E74B0174D181903DEF97C70941CD8C4EF"
|
||||||
|
TAG_NAME_PREFIX := $(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/
|
||||||
|
ARCHIVE_PATH_PREFIX := dist/$(TAG_NAME_PREFIX)
|
||||||
|
|
||||||
|
VERBOSE := 0
|
||||||
|
|
||||||
|
|
||||||
|
# macro for uploading a docker image dump
|
||||||
|
#
|
||||||
|
# this is the fallback Docker registry infrastructure. In addition to being
|
||||||
|
# published to a Docker registry, OCI images are publicly stored as Bitbucket
|
||||||
|
# Cloud Download Artifact HTTP documents.
|
||||||
|
define bitbucket-upload
|
||||||
|
curl \
|
||||||
|
--request POST \
|
||||||
|
--header "Authorization: Bearer $$BITBUCKET_ACCESS_TOKEN" \
|
||||||
|
--form "files=@$(1);filename=$$(basename "$(1)")" \
|
||||||
|
--fail \
|
||||||
|
https://api.bitbucket.org/2.0/repositories/$(BITBUCKET_WORKSPACE)/$(BITBUCKET_REPO_SLUG)/downloads
|
||||||
|
endef
|
||||||
|
|
||||||
|
|
||||||
|
# macro for uploading a docker image dump
|
||||||
|
#
|
||||||
|
# this is the fallback Docker registry infrastructure. In addition to being
|
||||||
|
# published to a Docker registry, OCI images are publicly stored as Bitbucket
|
||||||
|
# Cloud Download Artifact HTTP documents.
|
||||||
|
define bitbucket-upload-image-dump
|
||||||
|
$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$@.$$(git rev-parse --short HEAD).tar.gz)
|
||||||
|
endef
|
||||||
|
|
||||||
|
|
||||||
|
# macro for building an image by targeting a Docker image stage
|
||||||
|
#
|
||||||
|
# I expect variant Docker images to use staged image specifications, that share
|
||||||
|
# a base image. In the case of the ``build`` docker image, which provides build
|
||||||
|
# environments, there are versioned runtime environment variants, e.g.
|
||||||
|
# ``python39``, ``node19``, that all share a ``build`` base, resulting in full
|
||||||
|
# image tag names such as ``build-python39`` and ``build-node19``.
|
||||||
|
define build-image-stage
|
||||||
|
export rev_id=$$(git rev-parse --short HEAD); \
|
||||||
|
docker build \
|
||||||
|
-f src/$$(echo "$1" | cut -d '-' -f 1)/Dockerfile \
|
||||||
|
-t $(TAG_NAME_PREFIX)$@ \
|
||||||
|
-t $(TAG_NAME_PREFIX)$@:$$rev_id \
|
||||||
|
--target "$$(echo "$@" | sed 's|^$(1)||')" \
|
||||||
|
--build-arg VERBOSE=$(VERBOSE) \
|
||||||
|
src/$$(echo "$1" | cut -d '-' -f 1)
|
||||||
|
endef
|
||||||
|
|
||||||
|
|
||||||
|
BUILD_NODE_TARGETS := $(addprefix build-node, 19 20 21 22 23)
|
||||||
|
BUILD_PYTHON_TARGETS := $(addprefix build-python3, 9 10 11 12 13)
|
||||||
|
BUILD_OPENJDK_TARGETS := $(addprefix build-openjdk, 21)
|
||||||
|
BUILD_TRIVY_TARGETS := $(addprefix build-trivy, 063)
|
||||||
|
PROXY_SQUIDCACHE_TARGETS := $(addprefix proxy-squidcache, 613)
|
||||||
|
ATLASSIAN_BITBUCKETRUNNER_TARGETS := $(addprefix atlassian-bitbucketrunner, 323)
|
||||||
|
|
||||||
|
_clean:
|
||||||
|
rm -rvf configure~ autom4te.cache/ config.log config.status
|
||||||
|
_all-ubuntu: _all-build-ubuntu
|
||||||
|
_all-windowsserver: _all-build-windowsserver _all-atlassian-windowsserver
|
||||||
|
_all-build-ubuntu: build-ubuntu2504 build-ubuntu _all-build-python-ubuntu _all-build-node-ubuntu _all-build-trivy-ubuntu
|
||||||
|
_all-build-windowsserver: _all-build-openjdk-windowsserver
|
||||||
|
_all-atlassian-windowsserver: _all-atlassian-bitbucketrunner-windowsserver
|
||||||
|
_all-proxy-ubuntu: _all-atlassian-bitbucketrunner-windowsserver
|
||||||
|
_all-build-python-ubuntu: $(addsuffix -ubuntu, $(BUILD_PYTHON_TARGETS))
|
||||||
|
_all-build-node-ubuntu: $(addsuffix -ubuntu, $(BUILD_NODE_TARGETS))
|
||||||
|
_all-build-openjdk-windowsserver: $(addsuffix -windowsserver, $(BUILD_OPENJDK_TARGETS))
|
||||||
|
_all-build-trivy-ubuntu: $(addsuffix -ubuntu, $(BUILD_TRIVY_TARGETS))
|
||||||
|
_all-atlassian-bitbucketrunner-windowsserver: $(addsuffix -windowsserver, $(ATLASSIAN_BITBUCKETRUNNER_TARGETS))
|
||||||
|
|
||||||
|
|
||||||
|
build-ubuntu: build-ubuntu2504
|
||||||
|
$(addsuffix -ubuntu, $(BUILD_NODE_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(BUILD_PYTHON_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(BUILD_TRIVY_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(PROXY_SQUIDCACHE_TARGETS)): build-ubuntu
|
||||||
|
|
||||||
|
$(addsuffix -windowsserver, $(ATLASSIAN_BITBUCKETRUNNER_TARGETS)): build-openjdk21-windowsserver
|
||||||
|
|
||||||
|
|
||||||
|
build-ubuntu build-ubuntu2504 \
|
||||||
|
build-windowsserver build-windowsserver2022 \
|
||||||
|
$(addsuffix -windowsserver, $(BUILD_OPENJDK_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(BUILD_NODE_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(BUILD_PYTHON_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(BUILD_TRIVY_TARGETS)) \
|
||||||
|
$(addsuffix -ubuntu, $(PROXY_SQUIDCACHE_TARGETS)) \
|
||||||
|
$(addsuffix -windowsserver, $(ATLASSIAN_BITBUCKETRUNNER_TARGETS)):
|
||||||
|
$(call build-image-stage,$(word 1,$(subst -, ,build-ubuntu))-)
|
||||||
|
ifdef SCAN
|
||||||
|
mkdir -p "test-reports/$(TAG_NAME_PREFIX)"
|
||||||
|
trivy image \
|
||||||
|
--format json \
|
||||||
|
--output test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json \
|
||||||
|
$(TAG_NAME_PREFIX)$@
|
||||||
|
ifdef SIGN_SCAN
|
||||||
|
gpg --detach-sign --local-user $(GPG_SIGNER_FINGERPRINT) -v -a --yes test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json
|
||||||
|
endif
|
||||||
|
endif
|
||||||
|
ifdef ARCHIVE
|
||||||
|
export archive_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar"; \
|
||||||
|
export manifest_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json"; \
|
||||||
|
mkdir -p "$$(dirname $$archive_path)" && \
|
||||||
|
docker save -o "$$archive_path" "$(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/$@" && \
|
||||||
|
tar -xf "$$archive_path" manifest.json --to-stdout > $$manifest_path; \
|
||||||
|
gzip -vf "$$archive_path"
|
||||||
|
ifdef SIGN_ARCHIVE
|
||||||
|
export archive_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar.gz"; \
|
||||||
|
export manifest_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json"; \
|
||||||
|
gpg --detach-sign --local-user $(GPG_SIGNER_FINGERPRINT) -v -a --yes "$$manifest_path"; \
|
||||||
|
gpg --detach-sign --local-user $(GPG_SIGNER_FINGERPRINT) -v -a --yes "$$archive_path";
|
||||||
|
endif
|
||||||
|
ifdef PUBLISH_ARCHIVE
|
||||||
|
ifndef BITBUCKET_ACCESS_TOKEN
|
||||||
|
$(error BITBUCKET_ACCESS_TOKEN not set)
|
||||||
|
endif
|
||||||
|
$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar.gz)
|
||||||
|
$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json)
|
||||||
|
ifdef SIGN_ARCHIVE
|
||||||
|
$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar.gz.asc)
|
||||||
|
$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json.asc)
|
||||||
|
endif
|
||||||
|
ifdef SCAN
|
||||||
|
$(call bitbucket-upload,test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json)
|
||||||
|
ifdef SIGN_SCAN
|
||||||
|
$(call bitbucket-upload,test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json.asc)
|
||||||
|
endif # SIGN_SCAN
|
||||||
|
endif # SCAN
|
||||||
|
endif # PUBLISH_ARCHIVE
|
||||||
|
endif # ARCHIVE
|
||||||
|
ifdef PUBLISH
|
||||||
|
docker push $(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/$@
|
||||||
|
docker push $(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/$@:$$(git rev-parse --short HEAD)
|
||||||
|
endif
|
||||||
191
README.md
Normal file
191
README.md
Normal file
|
|
@ -0,0 +1,191 @@
|
||||||
|
# Tiara's OCI Images
|
||||||
|
|
||||||
|
Standardization for building, archiving, vulnerability scanning and publishing
|
||||||
|
lots of actively managed GNU/Linux and Microsoft Windows OCI (Docker) images
|
||||||
|
under a multitude of circumstances - Do it fast, conveniently and
|
||||||
|
conventionally.
|
||||||
|
|
||||||
|
# Images
|
||||||
|
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Image</th>
|
||||||
|
<th>OS</th>
|
||||||
|
<th>Arch</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>atlassian-bitbucketrunner323-windowsservercore</td>
|
||||||
|
<td>Microsoft Windows</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-node19-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-node20-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-node21-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-node22-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-node23-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-openjdk21-windowsservercore</td>
|
||||||
|
<td>Microsoft Windows</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-python39-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-python310-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-python311-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-python312-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-python313-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-ubuntu</td>
|
||||||
|
<td>GNU/Linux</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>build-windowsservercore</td>
|
||||||
|
<td>Microsoft Windows</td>
|
||||||
|
<td>amd64</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
# Usage
|
||||||
|
|
||||||
|
## Set up and verify your build environment
|
||||||
|
|
||||||
|
```
|
||||||
|
$> sh ./configure
|
||||||
|
```
|
||||||
|
|
||||||
|
## Build Images
|
||||||
|
|
||||||
|
```
|
||||||
|
make <group>-<program><programversion>-<platform>
|
||||||
|
make all-<group>-<program>-<platform>
|
||||||
|
make all-<group>-<platform>
|
||||||
|
make <group>-<platform>
|
||||||
|
make all-<platform>
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make build-python39-ubuntu
|
||||||
|
$> make all-build-python-ubuntu
|
||||||
|
$> make all-build-ubuntu
|
||||||
|
$> make build-ubuntu
|
||||||
|
$> make all-ubuntu
|
||||||
|
```
|
||||||
|
|
||||||
|
## Archive Images
|
||||||
|
|
||||||
|
Generate a GZip-compressed tarball archive of an image under
|
||||||
|
`dist/`.
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make build-python39-ubuntu ARCHIVE=1
|
||||||
|
```
|
||||||
|
|
||||||
|
Output path can be adjusted via `$ARCHIVE_DIST_PATH`.
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make build-python39-ubuntu ARCHIVE=1 ARCHIVE_DIST_PATH=dist2
|
||||||
|
```
|
||||||
|
|
||||||
|
## Publish Images
|
||||||
|
|
||||||
|
Push image to a Docker registry.
|
||||||
|
|
||||||
|
> Login to Docker registry, prior to executing.
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make build-python39-ubuntu PUBLISH=1
|
||||||
|
```
|
||||||
|
|
||||||
|
By default, will publish to `docker.io/byteb4rb1e`. Can be modified through
|
||||||
|
`DOCKER_REGISTRY` and `DOCKER_REPO_SLUG`.
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make all-ubuntu \
|
||||||
|
PUBLISH=1 \
|
||||||
|
DOCKER_REGISTRY=contoso.com \
|
||||||
|
DOCKER_REPO_SLUG=not-byteb4rb1e
|
||||||
|
```
|
||||||
|
|
||||||
|
## Scan Images
|
||||||
|
|
||||||
|
Scan image with AquaSecurity Trivy Scanner for vulnerabilities and publish
|
||||||
|
reports under `test-reports/`.
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make all-ubuntu SCAN=1
|
||||||
|
```
|
||||||
|
|
||||||
|
## Mix & Match
|
||||||
|
|
||||||
|
Define specific sequences of what to make.
|
||||||
|
|
||||||
|
```
|
||||||
|
$> make build-node23-ubuntu build-python313-ubuntu SCAN=1 ARCHIVE=1 PUBLISH=1
|
||||||
|
```
|
||||||
|
|
||||||
|
## Parallelize
|
||||||
|
|
||||||
|
Run independent image builds and other jobs in parallel.
|
||||||
|
|
||||||
|
```
|
||||||
|
make all-ubuntu -j8
|
||||||
|
```
|
||||||
|
|
||||||
|
# Setup
|
||||||
|
|
||||||
|
Ensure the following tools are installed before proceeding:
|
||||||
|
|
||||||
|
* GNU Make (make) – Required for executing automation scripts.
|
||||||
|
* Docker CLI (docker) – Used for building and managing OCI images.
|
||||||
|
* curl, gzip, and tar – Needed for archiving and uploading image dumps.
|
||||||
|
|
||||||
|
Requirements
|
||||||
|
|
||||||
|
You need the optional *Containers* feature enabled, which is possible with at
|
||||||
|
least Microsoft Windows 11 Professional (and Windows Server Editions).
|
||||||
|
|
||||||
|
Additionally you need the Docker daemon and Docker client and have configured
|
||||||
|
them.
|
||||||
|
|
||||||
|
Also, you will need a build of *GNU Make*, which is available through
|
||||||
|
environments such as Cygwin, MinGW or MSYS2. I suggest using MSYS2
|
||||||
1
TARGET
Normal file
1
TARGET
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
_all-ubuntu
|
||||||
17
bitbucket-pipelines.yml
Normal file
17
bitbucket-pipelines.yml
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
image: byteb4rb1e/build-trivy063-ubuntu:latest
|
||||||
|
definitions:
|
||||||
|
steps:
|
||||||
|
- step: &make
|
||||||
|
name: _all-ubuntu
|
||||||
|
services:
|
||||||
|
- docker
|
||||||
|
caches:
|
||||||
|
- docker
|
||||||
|
script:
|
||||||
|
- echo "$_GPG_SIGNING_KEY" | base64 -d | gpg --import
|
||||||
|
- docker login -u $DOCKER_USERNAME --password-stdin <<< $DOCKER_PASSWORD
|
||||||
|
- sh configure
|
||||||
|
- make $(cat TARGET | tr "\n" " ") PUBLISH=1 ARCHIVE=1 PUBLISH_ARCHIVE=1 SIGN_ARCHIVE=1 SCAN=1 SIGN_SCAN=1 -j2
|
||||||
|
pipelines:
|
||||||
|
default:
|
||||||
|
- step: *make
|
||||||
78
configure.ac
Normal file
78
configure.ac
Normal file
|
|
@ -0,0 +1,78 @@
|
||||||
|
AC_INIT
|
||||||
|
|
||||||
|
AC_CHECK_PROGS([MAKE], [make], [no])
|
||||||
|
AS_IF([test "$MAKE" == "no"],
|
||||||
|
[AC_MSG_ERROR([install GNU Make, before continuiing])])
|
||||||
|
|
||||||
|
AC_CHECK_PROGS([DOCKER], [docker], [no])
|
||||||
|
AS_IF([test "$DOCKER" == "no"],
|
||||||
|
[AC_MSG_ERROR([install Docker CLI, before continuiing])])
|
||||||
|
|
||||||
|
AC_CHECK_PROGS([TRIVY], [trivy], [no])
|
||||||
|
AS_IF([test "$TRIVY" == "no"],
|
||||||
|
[AC_MSG_WARN([install Trivy CLI, before continuiing])])
|
||||||
|
|
||||||
|
AC_CHECK_PROGS([CURL], [curl], [no])
|
||||||
|
AS_IF([test "$CURL" == "no"],
|
||||||
|
[AC_MSG_ERROR([install curl, before continuiing])])
|
||||||
|
|
||||||
|
AC_CHECK_PROGS([TAR], [tar], [no])
|
||||||
|
AS_IF([test "$TAR" == "no"],
|
||||||
|
[AC_MSG_ERROR([install curl, before continuiing])])
|
||||||
|
|
||||||
|
AC_CHECK_PROGS([GZIP], [gzip], [no])
|
||||||
|
AS_IF([test "$GZIP" == "no"],
|
||||||
|
[AC_MSG_ERROR([install curl, before continuiing])])
|
||||||
|
|
||||||
|
AC_MSG_CHECKING([env for DOCKER_USERNAME])
|
||||||
|
if ! test -z "$DOCKER_USERNAME"; then
|
||||||
|
AC_MSG_RESULT([yes])
|
||||||
|
AC_MSG_NOTICE([Use `make <TARGET> PUBLISH=1 to publish.`])
|
||||||
|
else
|
||||||
|
AC_MSG_RESULT([no])
|
||||||
|
AC_MSG_NOTICE([DOCKER_USERNAME in env is required for publishing])
|
||||||
|
fi
|
||||||
|
|
||||||
|
AC_MSG_CHECKING([env for DOCKER_PASSWORD])
|
||||||
|
if ! test -z "$DOCKER_PASSWORD"; then
|
||||||
|
AC_MSG_RESULT([yes])
|
||||||
|
AC_MSG_NOTICE([Use `make <TARGET> PUBLISH=1 to publish.`])
|
||||||
|
else
|
||||||
|
AC_MSG_RESULT([no])
|
||||||
|
AC_MSG_NOTICE([DOCKER_PASSWORD in env is required for publishing])
|
||||||
|
fi
|
||||||
|
|
||||||
|
AC_MSG_CHECKING([env for BITBUCKET_ACCESS_TOKEN])
|
||||||
|
if ! test -z "$BITBUCKET_ACCESS_TOKEN"; then
|
||||||
|
AC_MSG_RESULT([yes])
|
||||||
|
AC_MSG_NOTICE([Use `make <TARGET> ARCHIVE=1 to archive.`])
|
||||||
|
else
|
||||||
|
AC_MSG_RESULT([no])
|
||||||
|
AC_MSG_NOTICE([BITBUCKET_ACCESS_TOKEN in env is required for archiving])
|
||||||
|
fi
|
||||||
|
|
||||||
|
AC_MSG_CHECKING([env for BITBUCKET_WORKSPACE])
|
||||||
|
if ! test -z "$BITBUCKET_WORKSPACE"; then
|
||||||
|
AC_MSG_RESULT([yes])
|
||||||
|
AC_MSG_NOTICE([Use `make <TARGET> ARCHIVE=1 to archive.`])
|
||||||
|
else
|
||||||
|
AC_MSG_RESULT([no])
|
||||||
|
AC_MSG_NOTICE([BITBUCKET_WORKSPACE in env is required for archiving])
|
||||||
|
fi
|
||||||
|
|
||||||
|
AC_MSG_CHECKING([env for BITBUCKET_REPO_SLUG])
|
||||||
|
if ! test -z "$BITBUCKET_REPO_SLUG"; then
|
||||||
|
AC_MSG_RESULT([yes])
|
||||||
|
AC_MSG_NOTICE([Use `make <TARGET> ARCHIVE=1 to archive.`])
|
||||||
|
else
|
||||||
|
AC_MSG_RESULT([no])
|
||||||
|
AC_MSG_NOTICE([BITBUCKET_REPO_SLUG in env is required for archiving])
|
||||||
|
fi
|
||||||
|
|
||||||
|
sh -ex << 'EOF'
|
||||||
|
uname
|
||||||
|
docker --version
|
||||||
|
trivy --version
|
||||||
|
EOF
|
||||||
|
|
||||||
|
AC_OUTPUT
|
||||||
9
src/atlassian/Dockerfile
Normal file
9
src/atlassian/Dockerfile
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
FROM docker.io/byteb4rb1e/build-openjdk21-windowsserver AS bitbucketrunner323-windowsserver
|
||||||
|
#ADD https://product-downloads.atlassian.com/software/bitbucket/pipelines/atlassian-bitbucket-pipelines-runner-3.23.0.zip .
|
||||||
|
ADD http://localhost:8000/atlassian-bitbucket-pipelines-runner-3.23.0.zip .
|
||||||
|
RUN 7z x atlassian-bitbucket-pipelines-runner-3.23.0.zip -o"C:\\Program Files\\Atlassian\\Bitbucket Pipelines Runner" & \
|
||||||
|
del atlassian-bitbucket-pipelines-runner-3.23.0.zip & \
|
||||||
|
pacman -S --noconfirm git
|
||||||
|
WORKDIR C:\\Program Files\\Atlassian\\Bitbucket Pipelines Runner\\bin
|
||||||
|
|
||||||
|
ENTRYPOINT ["powershell"]
|
||||||
148
src/build/Dockerfile
Normal file
148
src/build/Dockerfile
Normal file
|
|
@ -0,0 +1,148 @@
|
||||||
|
|
||||||
|
FROM mcr.microsoft.com/windows/nanoserver:ltsc2022 AS windowsserver2025
|
||||||
|
USER ContainerAdministrator
|
||||||
|
WORKDIR C:\\Windows\\temp
|
||||||
|
ADD https://cygwin.com/setup-x86_64.exe .
|
||||||
|
ADD https://live.sysinternals.com/procmon.exe .
|
||||||
|
|
||||||
|
# Lucky find... This was once tagged latest, but I'm unable to identify its base
|
||||||
|
# image. It's 4.81 GB, with a the smallest tagged sibling image
|
||||||
|
# (lts-7.4-windowsservercore-ltsc2022) being 5.45 GB in size...
|
||||||
|
# TODO: Open an issue about this
|
||||||
|
FROM mcr.microsoft.com/powershell@sha256:810c4f1e0c9d23022c3ec18c50a6205ee4b60766f1739d329b2948df1fd7d5b0 AS windowsserver2022
|
||||||
|
LABEL org.opencontainers.image.description="Minimal GNU Toolchain for Windows Server"
|
||||||
|
WORKDIR C:\\Windows\\temp
|
||||||
|
#ADD --link https://7-zip.org/a/7z2409-x64.msi .
|
||||||
|
ADD --link http://localhost:8000/7z2409-x64.msi .
|
||||||
|
RUN 7z2409-x64.msi INSTALLDIR="C:\\Program Files\\7-Zip" & \
|
||||||
|
del 7z2409-x64.msi & \
|
||||||
|
mkdir C:\\Program Files\\7-Zip\\shims
|
||||||
|
WORKDIR C:\\Program Files\\7-Zip\\shims
|
||||||
|
RUN mklink 7z.exe ..\\7z.exe & \
|
||||||
|
setx /M path "%PATH%C:\\Program Files\\7-Zip\\shims;"
|
||||||
|
WORKDIR C:\\Windows\\temp
|
||||||
|
#ADD --link http://repo.msys2.org/distrib/msys2-x86_64-latest.tar.xz .
|
||||||
|
ADD --link http://localhost:8000/msys2-x86_64-latest.tar.xz .
|
||||||
|
RUN 7z e msys2-x86_64-latest.tar.xz & \
|
||||||
|
7z x msys2-x86_64-latest.tar -o"C:\\Program Files" & \
|
||||||
|
setx /M path "%PATH%C:\Program Files\msys64\usr\bin;" & \
|
||||||
|
del msys2-x86_64-latest.tar & \
|
||||||
|
del msys2-x86_64-latest.tar.xz
|
||||||
|
RUN bash -l & \
|
||||||
|
pacman -S --noconfirm git gzip tar make unzip curl gnupg
|
||||||
|
LABEL org.opencontainers.image.rev=$REVISION
|
||||||
|
|
||||||
|
FROM windowsserver2022 AS windowsserver
|
||||||
|
|
||||||
|
FROM windowsserver AS openjdk21-windowsserver
|
||||||
|
LABEL org.opencontainers.image.description="Build environment for Microsoft OpenJDK 21 on Windows Server"
|
||||||
|
#ADD --checksum=3666844f620635cf07315c9c8fa423655b91f2bde4aa079b3a33d09f6b05f285 https://aka.ms/download-jdk/microsoft-jdk-21.0.7-windows-x64.zip .
|
||||||
|
ADD http://localhost:8000/microsoft-jdk-21.0.7-windows-x64.zip .
|
||||||
|
RUN powershell -Command "\
|
||||||
|
7z x microsoft-jdk-21.0.7-windows-x64.zip -o'C:\\Program Files\\Microsoft'; \
|
||||||
|
del microsoft-jdk-21.0.7-windows-x64.zip; \
|
||||||
|
$base = Get-ChildItem \
|
||||||
|
-Path 'C:\\Program Files\\Microsoft' \
|
||||||
|
-Filter java.exe -Recurse; \
|
||||||
|
setx /M path "${env:PATH}$($base.Directory.FullName);"; \
|
||||||
|
setx /M JAVA_HOME "$($base.Directory.Parent.FullName)"";
|
||||||
|
|
||||||
|
FROM docker.io/ubuntu:25.04@sha256:79efa276fdefa2ee3911db29b0608f8c0561c347ec3f4d4139980d43b168d991 AS ubuntu2504
|
||||||
|
LABEL org.opencontainers.image.description="minimal build environment on Ubuntu 25.04"
|
||||||
|
RUN apt-get update && apt-get install -y git gzip tar make unzip curl gpg
|
||||||
|
|
||||||
|
FROM ubuntu2504 AS ubuntu
|
||||||
|
|
||||||
|
FROM ubuntu AS pyenv-ubuntu
|
||||||
|
LABEL org.opencontainers.image.description="build environment with latest Ubuntu for latest pyenv"
|
||||||
|
RUN apt-get update && apt-get install -y gcc build-essential libssl-dev zlib1g-dev \
|
||||||
|
libbz2-dev libreadline-dev libsqlite3-dev libncursesw5-dev xz-utils tk-dev libxml2-dev \
|
||||||
|
libxmlsec1-dev libffi-dev liblzma-dev git curl make
|
||||||
|
COPY Makefile Makefile
|
||||||
|
ARG VERBOSE=0
|
||||||
|
ARG PYENV_ROOT=/opt/pyenv
|
||||||
|
RUN make pyenv PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
|
||||||
|
|
||||||
|
FROM ubuntu AS nvm-ubuntu
|
||||||
|
LABEL org.opencontainers.image.description="build environment with latest Ubuntu for latest nvm"
|
||||||
|
RUN apt-get update && apt-get install -y curl make coreutils util-linux \
|
||||||
|
bsdutils file openssl libssl-dev locales ca-certificates curl git gcc g++ \
|
||||||
|
xz-utils build-essential bash-completion
|
||||||
|
COPY Makefile Makefile
|
||||||
|
ARG NVM_DIR=/opt/nvm
|
||||||
|
|
||||||
|
FROM ubuntu AS trivy063-ubuntu
|
||||||
|
RUN curl https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | tee /usr/share/keyrings/trivy.gpg > /dev/null; \
|
||||||
|
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | tee -a /etc/apt/sources.list.d/trivy.list; \
|
||||||
|
apt-get update; \
|
||||||
|
apt-get install trivy
|
||||||
|
|
||||||
|
FROM nvm-ubuntu AS nvm19-ubuntu
|
||||||
|
RUN make nvm19 NVM_DIR=$NVM_DIR
|
||||||
|
|
||||||
|
FROM nvm-ubuntu AS nvm20-ubuntu
|
||||||
|
RUN make nvm20 NVM_DIR=$NVM_DIR
|
||||||
|
|
||||||
|
FROM nvm-ubuntu AS nvm21-ubuntu
|
||||||
|
RUN make nvm21 NVM_DIR=$NVM_DIR
|
||||||
|
|
||||||
|
FROM nvm-ubuntu AS nvm22-ubuntu
|
||||||
|
RUN make nvm22 NVM_DIR=$NVM_DIR
|
||||||
|
|
||||||
|
FROM nvm-ubuntu AS nvm23-ubuntu
|
||||||
|
RUN make nvm23 NVM_DIR=$NVM_DIR
|
||||||
|
|
||||||
|
FROM pyenv-ubuntu AS pyenv39-ubuntu
|
||||||
|
RUN make pyenv39 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
|
||||||
|
|
||||||
|
FROM pyenv-ubuntu AS pyenv310-ubuntu
|
||||||
|
RUN make pyenv310 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
|
||||||
|
|
||||||
|
FROM pyenv-ubuntu AS pyenv311-ubuntu
|
||||||
|
RUN make pyenv311 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
|
||||||
|
|
||||||
|
FROM pyenv-ubuntu AS pyenv312-ubuntu
|
||||||
|
RUN make pyenv312 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
|
||||||
|
|
||||||
|
FROM pyenv-ubuntu AS pyenv313-ubuntu
|
||||||
|
RUN make pyenv313 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
|
||||||
|
|
||||||
|
FROM ubuntu AS node19-ubuntu
|
||||||
|
COPY --from=nvm19-ubuntu /opt/nvm /opt/nvm
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS node20-ubuntu
|
||||||
|
COPY --from=nvm20-ubuntu /opt/nvm /opt/nvm
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS node21-ubuntu
|
||||||
|
COPY --from=nvm21-ubuntu /opt/nvm /opt/nvm
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS node22-ubuntu
|
||||||
|
COPY --from=nvm22-ubuntu /opt/nvm /opt/nvm
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS node23-ubuntu
|
||||||
|
COPY --from=nvm23-ubuntu /opt/nvm /opt/nvm
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS python39-ubuntu
|
||||||
|
COPY --from=pyenv39-ubuntu /opt/pyenv /opt/pyenv
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS python310-ubuntu
|
||||||
|
COPY --from=pyenv310-ubuntu /opt/pyenv /opt/pyenv
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS python311-ubuntu
|
||||||
|
COPY --from=pyenv311-ubuntu /opt/pyenv /opt/pyenv
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS python312-ubuntu
|
||||||
|
COPY --from=pyenv312-ubuntu /opt/pyenv /opt/pyenv
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
|
||||||
|
|
||||||
|
FROM ubuntu AS python313-ubuntu
|
||||||
|
COPY --from=pyenv313-ubuntu /opt/pyenv /opt/pyenv
|
||||||
|
RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
|
||||||
40
src/build/Makefile
Normal file
40
src/build/Makefile
Normal file
|
|
@ -0,0 +1,40 @@
|
||||||
|
PYENV_ROOT = $(HOME)/.pyenv
|
||||||
|
NVM_DIR = $(HOME)/.nvm
|
||||||
|
VERBOSE := 0
|
||||||
|
|
||||||
|
pyenv_targets := $(addprefix pyenv3, 9 10 11 12 13)
|
||||||
|
nvm_targets := $(addprefix nvm, 19 20 21 22 23)
|
||||||
|
|
||||||
|
all: $(pyenv_targets) $(nvm_targets)
|
||||||
|
|
||||||
|
pyenv: $(PYENV_ROOT)
|
||||||
|
nvm: $(NVM_DIR)
|
||||||
|
|
||||||
|
$(PYENV_ROOT):
|
||||||
|
curl -fsSL https://pyenv.run | bash
|
||||||
|
|
||||||
|
export PYENV_ROOT := $(PYENV_ROOT)
|
||||||
|
export PATH := $(PYENV_ROOT)/bin:$(PATH)
|
||||||
|
$(pyenv_targets): $(PYENV_ROOT)
|
||||||
|
export version="3.$$(echo "$@" | sed 's|^pyenv3||')"; \
|
||||||
|
sh -cx "pyenv install $(if $(filter-out 1,$(VERBOSE)),,-v) $$version"; \
|
||||||
|
rm -v $(PYENV_ROOT)/shims/*; \
|
||||||
|
sh -cx "cd $(PYENV_ROOT)/shims; ln -s "../versions/$$(basename "$$(pyenv prefix $$version)")/bin/*" ."
|
||||||
|
|
||||||
|
$(NVM_DIR):
|
||||||
|
mkdir -p $(NVM_DIR)
|
||||||
|
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
|
||||||
|
# build node target, create a directory for symbolicly linking the targeted node versions binaries and link them
|
||||||
|
|
||||||
|
export NVM_DIR := $(NVM_DIR)
|
||||||
|
$(nvm_targets): $(NVM_DIR)
|
||||||
|
@export version="$$(echo "$@" | sed 's|^nvm||')"; \
|
||||||
|
sh -c ". $(NVM_DIR)/nvm.sh; nvm install -s "$$version"" && \
|
||||||
|
mkdir -vp $(NVM_DIR)/shims && cd $(NVM_DIR)/shims; \
|
||||||
|
sh -cx pwd; \
|
||||||
|
export rversion=$$(sh -c ". $(NVM_DIR)/nvm.sh; nvm version "$$version""); \
|
||||||
|
for path in ../versions/node/$$rversion/bin/*; do \
|
||||||
|
ln -vsf "$$path" .; \
|
||||||
|
ln -vsf "$$path" ./$$(basename "$$path")$$version; \
|
||||||
|
done
|
||||||
|
|
||||||
35
src/build/README.md
Normal file
35
src/build/README.md
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
<a name="build-node19-ubuntu"></a>
|
||||||
|
# build-node19-ubuntu
|
||||||
|
|
||||||
|
<a name="build-node20-ubuntu"></a>
|
||||||
|
# build-node20-ubuntu
|
||||||
|
|
||||||
|
<a name="build-node21-ubuntu"></a>
|
||||||
|
# build-node21-ubuntu
|
||||||
|
|
||||||
|
<a name="build-node22-ubuntu"></a>
|
||||||
|
# build-node22-ubuntu
|
||||||
|
|
||||||
|
<a name="build-node23-ubuntu"></a>
|
||||||
|
# build-node23-ubuntu
|
||||||
|
|
||||||
|
<a name="build-python39-ubuntu"></a>
|
||||||
|
# build-python39-ubuntu
|
||||||
|
|
||||||
|
<a name="build-python310-ubuntu"></a>
|
||||||
|
# build-python310-ubuntu
|
||||||
|
|
||||||
|
<a name="build-python311-ubuntu"></a>
|
||||||
|
# build-python311-ubuntu
|
||||||
|
|
||||||
|
<a name="build-python312-ubuntu"></a>
|
||||||
|
# build-python312-ubuntu
|
||||||
|
|
||||||
|
<a name="build-python313-ubuntu"></a>
|
||||||
|
# build-python313-ubuntu
|
||||||
|
|
||||||
|
<a name="build-ubuntu"></a>
|
||||||
|
# build-ubuntu
|
||||||
|
|
||||||
|
<a name="build-windowsservercore"></a>
|
||||||
|
# build-windowsservercore
|
||||||
Loading…
Add table
Add a link
Reference in a new issue