init

2025-05-21 02:07:18 +02:00 · 2025-05-21 02:07:18 +02:00 · b5265baa02
commit b5265baa02
11 changed files with 3505 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,6 @@
+/autom4te.cache
+/configure~
+/config.log
+/config.status
+/dist
+/test-reports
--- a/140
+++ b/140
@ -0,0 +1,140 @@
+BITBUCKET_REPO_SLUG := oci-images
+BITBUCKET_WORKSPACE := byteb4rb1e
+DOCKER_REGISTRY := docker.io
+DOCKER_REPO_SLUG := byteb4rb1e
+GPG_SIGNER_FINGERPRINT := "91CD826E74B0174D181903DEF97C70941CD8C4EF"
+TAG_NAME_PREFIX := $(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/
+ARCHIVE_PATH_PREFIX := dist/$(TAG_NAME_PREFIX)
+
+VERBOSE := 0
+
+
+# macro for uploading a docker image dump
+#
+# this is the fallback Docker registry infrastructure. In addition to being
+# published to a Docker registry, OCI images are publicly stored as Bitbucket
+# Cloud Download Artifact HTTP documents.
+define bitbucket-upload
+	curl \
+	    --request POST \
+	    --header "Authorization: Bearer $$BITBUCKET_ACCESS_TOKEN" \
+	    --form "files=@$(1);filename=$$(basename "$(1)")" \
+	    --fail \
+	    https://api.bitbucket.org/2.0/repositories/$(BITBUCKET_WORKSPACE)/$(BITBUCKET_REPO_SLUG)/downloads
+endef
+
+
+# macro for uploading a docker image dump
+#
+# this is the fallback Docker registry infrastructure. In addition to being
+# published to a Docker registry, OCI images are publicly stored as Bitbucket
+# Cloud Download Artifact HTTP documents.
+define bitbucket-upload-image-dump
+	$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$@.$$(git rev-parse --short HEAD).tar.gz)
+endef
+
+
+# macro for building an image by targeting a Docker image stage
+#
+# I expect variant Docker images to use staged image specifications, that share
+# a base image.  In the case of the ``build`` docker image, which provides build
+# environments, there are versioned runtime environment variants, e.g.
+# ``python39``, ``node19``, that all share a ``build`` base, resulting in full
+# image tag names such as ``build-python39`` and ``build-node19``.
+define build-image-stage
+	export rev_id=$$(git rev-parse --short HEAD); \
+	docker build \
+		-f src/$$(echo "$1" | cut -d '-' -f 1)/Dockerfile \
+		-t $(TAG_NAME_PREFIX)$@ \
+		-t $(TAG_NAME_PREFIX)$@:$$rev_id \
+		--target "$$(echo "$@" | sed 's|^$(1)||')" \
+		--build-arg VERBOSE=$(VERBOSE) \
+		src/$$(echo "$1" | cut -d '-' -f 1)
+endef
+
+
+BUILD_NODE_TARGETS := $(addprefix build-node, 19 20 21 22 23)
+BUILD_PYTHON_TARGETS := $(addprefix build-python3, 9 10 11 12 13)
+BUILD_OPENJDK_TARGETS := $(addprefix build-openjdk, 21)
+BUILD_TRIVY_TARGETS := $(addprefix build-trivy, 063)
+PROXY_SQUIDCACHE_TARGETS := $(addprefix proxy-squidcache, 613)
+ATLASSIAN_BITBUCKETRUNNER_TARGETS := $(addprefix atlassian-bitbucketrunner, 323)
+
+_clean:
+	rm -rvf configure~ autom4te.cache/ config.log config.status
+_all-ubuntu: _all-build-ubuntu
+_all-windowsserver: _all-build-windowsserver _all-atlassian-windowsserver
+_all-build-ubuntu: build-ubuntu2504 build-ubuntu _all-build-python-ubuntu _all-build-node-ubuntu _all-build-trivy-ubuntu
+_all-build-windowsserver: _all-build-openjdk-windowsserver
+_all-atlassian-windowsserver: _all-atlassian-bitbucketrunner-windowsserver
+_all-proxy-ubuntu: _all-atlassian-bitbucketrunner-windowsserver
+_all-build-python-ubuntu: $(addsuffix -ubuntu, $(BUILD_PYTHON_TARGETS))
+_all-build-node-ubuntu: $(addsuffix -ubuntu, $(BUILD_NODE_TARGETS))
+_all-build-openjdk-windowsserver: $(addsuffix -windowsserver, $(BUILD_OPENJDK_TARGETS))
+_all-build-trivy-ubuntu: $(addsuffix -ubuntu, $(BUILD_TRIVY_TARGETS))
+_all-atlassian-bitbucketrunner-windowsserver: $(addsuffix -windowsserver, $(ATLASSIAN_BITBUCKETRUNNER_TARGETS))
+
+
+build-ubuntu: build-ubuntu2504
+$(addsuffix -ubuntu, $(BUILD_NODE_TARGETS)) \
+$(addsuffix -ubuntu, $(BUILD_PYTHON_TARGETS)) \
+$(addsuffix -ubuntu, $(BUILD_TRIVY_TARGETS)) \
+$(addsuffix -ubuntu, $(PROXY_SQUIDCACHE_TARGETS)): build-ubuntu
+
+$(addsuffix -windowsserver, $(ATLASSIAN_BITBUCKETRUNNER_TARGETS)): build-openjdk21-windowsserver
+
+
+build-ubuntu build-ubuntu2504 \
+build-windowsserver build-windowsserver2022 \
+$(addsuffix -windowsserver, $(BUILD_OPENJDK_TARGETS)) \
+$(addsuffix -ubuntu, $(BUILD_NODE_TARGETS)) \
+$(addsuffix -ubuntu, $(BUILD_PYTHON_TARGETS)) \
+$(addsuffix -ubuntu, $(BUILD_TRIVY_TARGETS)) \
+$(addsuffix -ubuntu, $(PROXY_SQUIDCACHE_TARGETS)) \
+$(addsuffix -windowsserver, $(ATLASSIAN_BITBUCKETRUNNER_TARGETS)):
+	$(call build-image-stage,$(word 1,$(subst -, ,build-ubuntu))-)
+ifdef SCAN
+	mkdir -p "test-reports/$(TAG_NAME_PREFIX)"
+	trivy image \
+		--format json \
+		--output test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json \
+		$(TAG_NAME_PREFIX)$@
+ifdef SIGN_SCAN
+	gpg --detach-sign --local-user $(GPG_SIGNER_FINGERPRINT) -v -a --yes test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json
+endif
+endif
+ifdef ARCHIVE
+	export archive_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar"; \
+	export manifest_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json"; \
+	mkdir -p "$$(dirname $$archive_path)" && \
+	docker save -o "$$archive_path" "$(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/$@" && \
+	tar -xf "$$archive_path" manifest.json --to-stdout > $$manifest_path; \
+	gzip -vf "$$archive_path"
+ifdef SIGN_ARCHIVE
+	export archive_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar.gz"; \
+	export manifest_path="$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json"; \
+	gpg --detach-sign --local-user $(GPG_SIGNER_FINGERPRINT) -v -a --yes "$$manifest_path"; \
+	gpg --detach-sign --local-user $(GPG_SIGNER_FINGERPRINT) -v -a --yes "$$archive_path";
+endif
+ifdef PUBLISH_ARCHIVE
+ifndef BITBUCKET_ACCESS_TOKEN
+	$(error BITBUCKET_ACCESS_TOKEN not set)
+endif
+	$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar.gz)
+	$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json)
+ifdef SIGN_ARCHIVE
+	$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.tar.gz.asc)
+	$(call bitbucket-upload,$(ARCHIVE_PATH_PREFIX)$$(git rev-parse --short HEAD)-$@.manifest.json.asc)
+endif
+ifdef SCAN
+	$(call bitbucket-upload,test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json)
+ifdef SIGN_SCAN
+	$(call bitbucket-upload,test-reports/$(TAG_NAME_PREFIX)$$(git rev-parse --short HEAD)-$@.trivy.json.asc)
+endif # SIGN_SCAN
+endif # SCAN
+endif # PUBLISH_ARCHIVE
+endif # ARCHIVE
+ifdef PUBLISH
+	docker push $(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/$@
+	docker push $(DOCKER_REGISTRY)/$(DOCKER_REPO_SLUG)/$@:$$(git rev-parse --short HEAD)
+endif
--- a/README.md
+++ b/README.md
@ -0,0 +1,191 @@
+# Tiara's OCI Images
+
+Standardization for building, archiving, vulnerability scanning and publishing
+lots of actively managed GNU/Linux and Microsoft Windows OCI (Docker) images
+under a multitude of circumstances - Do it fast, conveniently and
+conventionally.
+
+# Images
+
+<table>
+    <tr>
+        <th>Image</th>
+        <th>OS</th>
+        <th>Arch</th>
+    </tr>
+    <tr>
+        <td>atlassian-bitbucketrunner323-windowsservercore</td>
+        <td>Microsoft Windows</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-node19-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-node20-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-node21-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-node22-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-node23-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-openjdk21-windowsservercore</td>
+        <td>Microsoft Windows</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-python39-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-python310-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-python311-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-python312-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-python313-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-ubuntu</td>
+        <td>GNU/Linux</td>
+        <td>amd64</td>
+    </tr>
+    <tr>
+        <td>build-windowsservercore</td>
+        <td>Microsoft Windows</td>
+        <td>amd64</td>
+    </tr>
+</table>
+
+# Usage
+
+## Set up and verify your build environment
+
+```
+$> sh ./configure
+```
+
+## Build Images
+
+```
+make <group>-<program><programversion>-<platform>
+make all-<group>-<program>-<platform>
+make all-<group>-<platform>
+make <group>-<platform>
+make all-<platform>
+```
+
+```
+$> make build-python39-ubuntu
+$> make all-build-python-ubuntu
+$> make all-build-ubuntu
+$> make build-ubuntu
+$> make all-ubuntu
+```
+
+## Archive Images
+
+Generate a GZip-compressed tarball archive of an image under
+`dist/`.
+
+```
+$> make build-python39-ubuntu ARCHIVE=1
+```
+
+Output path can be adjusted via `$ARCHIVE_DIST_PATH`.
+
+```
+$> make build-python39-ubuntu ARCHIVE=1 ARCHIVE_DIST_PATH=dist2
+```
+
+## Publish Images
+
+Push image to a Docker registry. 
+
+> Login to Docker registry, prior to executing.
+
+```
+$> make build-python39-ubuntu PUBLISH=1
+```
+
+By default, will publish to `docker.io/byteb4rb1e`. Can be modified through
+`DOCKER_REGISTRY` and `DOCKER_REPO_SLUG`.
+
+```
+$> make all-ubuntu \
+    PUBLISH=1 \
+    DOCKER_REGISTRY=contoso.com \
+    DOCKER_REPO_SLUG=not-byteb4rb1e
+```
+
+## Scan Images
+
+Scan image with AquaSecurity Trivy Scanner for vulnerabilities and publish
+reports under `test-reports/`.
+
+```
+$> make all-ubuntu SCAN=1 
+```
+
+## Mix & Match
+
+Define specific sequences of what to make.
+
+```
+$> make build-node23-ubuntu build-python313-ubuntu SCAN=1 ARCHIVE=1 PUBLISH=1
+```
+
+## Parallelize
+
+Run independent image builds and other jobs in parallel.
+
+```
+make all-ubuntu -j8
+```
+
+# Setup
+
+Ensure the following tools are installed before proceeding:
+
+    * GNU Make (make) – Required for executing automation scripts.
+    * Docker CLI (docker) – Used for building and managing OCI images.
+    * curl, gzip, and tar – Needed for archiving and uploading image dumps.
+
+Requirements
+
+You need the optional *Containers* feature enabled, which is possible with at
+least Microsoft Windows 11 Professional (and Windows Server Editions).
+
+Additionally you need the Docker daemon and Docker client and have configured
+them.
+
+Also, you will need a build of *GNU Make*, which is available through
+environments such as Cygwin, MinGW or MSYS2. I suggest using MSYS2
--- a/1
+++ b/1
@ -0,0 +1 @@
+_all-ubuntu
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@ -0,0 +1,17 @@
+image: byteb4rb1e/build-trivy063-ubuntu:latest
+definitions:
+    steps:
+        - step: &make
+            name: _all-ubuntu
+            services:
+                - docker
+            caches:
+                - docker
+            script:
+                - echo "$_GPG_SIGNING_KEY" | base64 -d | gpg --import
+                - docker login -u $DOCKER_USERNAME --password-stdin <<< $DOCKER_PASSWORD
+                - sh configure
+                - make $(cat TARGET | tr "\n" " ") PUBLISH=1 ARCHIVE=1 PUBLISH_ARCHIVE=1 SIGN_ARCHIVE=1 SCAN=1 SIGN_SCAN=1 -j2
+pipelines:
+    default:
+        - step: *make
--- a/2840
+++ b/2840
--- a/configure.ac
+++ b/configure.ac
@ -0,0 +1,78 @@
+AC_INIT
+
+AC_CHECK_PROGS([MAKE], [make], [no])
+AS_IF([test "$MAKE" == "no"], 
+      [AC_MSG_ERROR([install GNU Make, before continuiing])])
+
+AC_CHECK_PROGS([DOCKER], [docker], [no])
+AS_IF([test "$DOCKER" == "no"], 
+      [AC_MSG_ERROR([install Docker CLI, before continuiing])])
+
+AC_CHECK_PROGS([TRIVY], [trivy], [no])
+AS_IF([test "$TRIVY" == "no"], 
+      [AC_MSG_WARN([install Trivy CLI, before continuiing])])
+
+AC_CHECK_PROGS([CURL], [curl], [no])
+AS_IF([test "$CURL" == "no"], 
+      [AC_MSG_ERROR([install curl, before continuiing])])
+
+AC_CHECK_PROGS([TAR], [tar], [no])
+AS_IF([test "$TAR" == "no"], 
+      [AC_MSG_ERROR([install curl, before continuiing])])
+
+AC_CHECK_PROGS([GZIP], [gzip], [no])
+AS_IF([test "$GZIP" == "no"], 
+      [AC_MSG_ERROR([install curl, before continuiing])])
+
+AC_MSG_CHECKING([env for DOCKER_USERNAME])
+if ! test -z "$DOCKER_USERNAME"; then
+    AC_MSG_RESULT([yes])
+    AC_MSG_NOTICE([Use `make <TARGET> PUBLISH=1 to publish.`])
+else
+    AC_MSG_RESULT([no])
+    AC_MSG_NOTICE([DOCKER_USERNAME in env is required for publishing])
+fi
+
+AC_MSG_CHECKING([env for DOCKER_PASSWORD])
+if ! test -z "$DOCKER_PASSWORD"; then
+    AC_MSG_RESULT([yes])
+    AC_MSG_NOTICE([Use `make <TARGET> PUBLISH=1 to publish.`])
+else
+    AC_MSG_RESULT([no])
+    AC_MSG_NOTICE([DOCKER_PASSWORD in env is required for publishing])
+fi
+
+AC_MSG_CHECKING([env for BITBUCKET_ACCESS_TOKEN])
+if ! test -z "$BITBUCKET_ACCESS_TOKEN"; then
+    AC_MSG_RESULT([yes])
+    AC_MSG_NOTICE([Use `make <TARGET> ARCHIVE=1 to archive.`])
+else
+    AC_MSG_RESULT([no])
+    AC_MSG_NOTICE([BITBUCKET_ACCESS_TOKEN in env is required for archiving])
+fi
+
+AC_MSG_CHECKING([env for BITBUCKET_WORKSPACE])
+if ! test -z "$BITBUCKET_WORKSPACE"; then
+    AC_MSG_RESULT([yes])
+    AC_MSG_NOTICE([Use `make <TARGET> ARCHIVE=1 to archive.`])
+else
+    AC_MSG_RESULT([no])
+    AC_MSG_NOTICE([BITBUCKET_WORKSPACE in env is required for archiving])
+fi
+
+AC_MSG_CHECKING([env for BITBUCKET_REPO_SLUG])
+if ! test -z "$BITBUCKET_REPO_SLUG"; then
+    AC_MSG_RESULT([yes])
+    AC_MSG_NOTICE([Use `make <TARGET> ARCHIVE=1 to archive.`])
+else
+    AC_MSG_RESULT([no])
+    AC_MSG_NOTICE([BITBUCKET_REPO_SLUG in env is required for archiving])
+fi
+
+sh -ex << 'EOF'
+uname
+docker --version
+trivy --version
+EOF
+
+AC_OUTPUT
--- a/src/atlassian/Dockerfile
+++ b/src/atlassian/Dockerfile
@ -0,0 +1,9 @@
+FROM docker.io/byteb4rb1e/build-openjdk21-windowsserver AS bitbucketrunner323-windowsserver
+#ADD https://product-downloads.atlassian.com/software/bitbucket/pipelines/atlassian-bitbucket-pipelines-runner-3.23.0.zip .
+ADD http://localhost:8000/atlassian-bitbucket-pipelines-runner-3.23.0.zip .
+RUN 7z x atlassian-bitbucket-pipelines-runner-3.23.0.zip -o"C:\\Program Files\\Atlassian\\Bitbucket Pipelines Runner" & \
+    del atlassian-bitbucket-pipelines-runner-3.23.0.zip & \
+    pacman -S --noconfirm git
+WORKDIR C:\\Program Files\\Atlassian\\Bitbucket Pipelines Runner\\bin
+
+ENTRYPOINT ["powershell"]
--- a/src/build/Dockerfile
+++ b/src/build/Dockerfile
@ -0,0 +1,148 @@
+
+FROM mcr.microsoft.com/windows/nanoserver:ltsc2022 AS windowsserver2025
+USER ContainerAdministrator
+WORKDIR C:\\Windows\\temp
+ADD https://cygwin.com/setup-x86_64.exe .
+ADD https://live.sysinternals.com/procmon.exe .
+
+# Lucky find... This was once tagged latest, but I'm unable to identify its base
+# image. It's 4.81 GB, with a the smallest tagged sibling image
+# (lts-7.4-windowsservercore-ltsc2022) being 5.45 GB in size...
+# TODO: Open an issue about this
+FROM mcr.microsoft.com/powershell@sha256:810c4f1e0c9d23022c3ec18c50a6205ee4b60766f1739d329b2948df1fd7d5b0 AS windowsserver2022
+LABEL org.opencontainers.image.description="Minimal GNU Toolchain for Windows Server"
+WORKDIR C:\\Windows\\temp
+#ADD --link https://7-zip.org/a/7z2409-x64.msi .
+ADD --link http://localhost:8000/7z2409-x64.msi .
+RUN 7z2409-x64.msi INSTALLDIR="C:\\Program Files\\7-Zip" & \
+    del 7z2409-x64.msi & \
+    mkdir C:\\Program Files\\7-Zip\\shims
+WORKDIR C:\\Program Files\\7-Zip\\shims
+RUN mklink 7z.exe ..\\7z.exe & \
+    setx /M path "%PATH%C:\\Program Files\\7-Zip\\shims;"
+WORKDIR C:\\Windows\\temp
+#ADD --link http://repo.msys2.org/distrib/msys2-x86_64-latest.tar.xz .
+ADD --link http://localhost:8000/msys2-x86_64-latest.tar.xz .
+RUN 7z e msys2-x86_64-latest.tar.xz & \
+    7z x msys2-x86_64-latest.tar -o"C:\\Program Files" & \
+    setx /M path "%PATH%C:\Program Files\msys64\usr\bin;" & \
+    del msys2-x86_64-latest.tar & \
+    del msys2-x86_64-latest.tar.xz
+RUN bash -l & \
+    pacman -S --noconfirm git gzip tar make unzip curl gnupg
+LABEL org.opencontainers.image.rev=$REVISION
+
+FROM windowsserver2022 AS windowsserver
+
+FROM windowsserver AS openjdk21-windowsserver
+LABEL org.opencontainers.image.description="Build environment for Microsoft OpenJDK 21 on Windows Server"
+#ADD --checksum=3666844f620635cf07315c9c8fa423655b91f2bde4aa079b3a33d09f6b05f285 https://aka.ms/download-jdk/microsoft-jdk-21.0.7-windows-x64.zip .
+ADD http://localhost:8000/microsoft-jdk-21.0.7-windows-x64.zip .
+RUN powershell -Command "\
+7z x microsoft-jdk-21.0.7-windows-x64.zip -o'C:\\Program Files\\Microsoft'; \
+del microsoft-jdk-21.0.7-windows-x64.zip; \
+$base = Get-ChildItem \
+    -Path 'C:\\Program Files\\Microsoft' \
+    -Filter java.exe -Recurse; \
+setx /M path "${env:PATH}$($base.Directory.FullName);"; \
+setx /M JAVA_HOME "$($base.Directory.Parent.FullName)"";
+
+FROM docker.io/ubuntu:25.04@sha256:79efa276fdefa2ee3911db29b0608f8c0561c347ec3f4d4139980d43b168d991 AS ubuntu2504
+LABEL org.opencontainers.image.description="minimal build environment on Ubuntu 25.04"
+RUN apt-get update && apt-get install -y git gzip tar make unzip curl gpg
+
+FROM ubuntu2504 AS ubuntu
+
+FROM ubuntu AS pyenv-ubuntu
+LABEL org.opencontainers.image.description="build environment with latest Ubuntu for latest pyenv"
+RUN apt-get update && apt-get install -y gcc build-essential libssl-dev zlib1g-dev \
+libbz2-dev libreadline-dev libsqlite3-dev libncursesw5-dev xz-utils tk-dev libxml2-dev \
+libxmlsec1-dev libffi-dev liblzma-dev git curl make
+COPY Makefile Makefile
+ARG VERBOSE=0
+ARG PYENV_ROOT=/opt/pyenv
+RUN make pyenv PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
+
+FROM ubuntu AS nvm-ubuntu
+LABEL org.opencontainers.image.description="build environment with latest Ubuntu for latest nvm"
+RUN apt-get update && apt-get install -y curl make coreutils util-linux \
+bsdutils file openssl libssl-dev locales ca-certificates curl git gcc g++ \
+xz-utils build-essential bash-completion
+COPY Makefile Makefile
+ARG NVM_DIR=/opt/nvm
+
+FROM ubuntu AS trivy063-ubuntu
+RUN curl https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | tee /usr/share/keyrings/trivy.gpg > /dev/null; \
+    echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | tee -a /etc/apt/sources.list.d/trivy.list; \
+    apt-get update; \
+    apt-get install trivy
+
+FROM nvm-ubuntu AS nvm19-ubuntu
+RUN make nvm19 NVM_DIR=$NVM_DIR
+
+FROM nvm-ubuntu AS nvm20-ubuntu
+RUN make nvm20 NVM_DIR=$NVM_DIR
+
+FROM nvm-ubuntu AS nvm21-ubuntu
+RUN make nvm21 NVM_DIR=$NVM_DIR
+
+FROM nvm-ubuntu AS nvm22-ubuntu
+RUN make nvm22 NVM_DIR=$NVM_DIR
+
+FROM nvm-ubuntu AS nvm23-ubuntu
+RUN make nvm23 NVM_DIR=$NVM_DIR
+
+FROM pyenv-ubuntu AS pyenv39-ubuntu
+RUN make pyenv39 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
+
+FROM pyenv-ubuntu AS pyenv310-ubuntu
+RUN make pyenv310 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
+
+FROM pyenv-ubuntu AS pyenv311-ubuntu
+RUN make pyenv311 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
+
+FROM pyenv-ubuntu AS pyenv312-ubuntu
+RUN make pyenv312 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
+
+FROM pyenv-ubuntu AS pyenv313-ubuntu
+RUN make pyenv313 PYENV_ROOT=$PYENV_ROOT VERBOSE=$VERBOSE
+
+FROM ubuntu AS node19-ubuntu
+COPY --from=nvm19-ubuntu /opt/nvm /opt/nvm
+RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
+
+FROM ubuntu AS node20-ubuntu
+COPY --from=nvm20-ubuntu /opt/nvm /opt/nvm
+RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
+
+FROM ubuntu AS node21-ubuntu
+COPY --from=nvm21-ubuntu /opt/nvm /opt/nvm
+RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
+
+FROM ubuntu AS node22-ubuntu
+COPY --from=nvm22-ubuntu /opt/nvm /opt/nvm
+RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
+
+FROM ubuntu AS node23-ubuntu
+COPY --from=nvm23-ubuntu /opt/nvm /opt/nvm
+RUN cd /usr/local/bin; ln -vs ../../..$NVM_DIR/shims/* .
+
+FROM ubuntu AS python39-ubuntu
+COPY --from=pyenv39-ubuntu /opt/pyenv /opt/pyenv
+RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
+
+FROM ubuntu AS python310-ubuntu
+COPY --from=pyenv310-ubuntu /opt/pyenv /opt/pyenv
+RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
+
+FROM ubuntu AS python311-ubuntu
+COPY --from=pyenv311-ubuntu /opt/pyenv /opt/pyenv
+RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
+
+FROM ubuntu AS python312-ubuntu
+COPY --from=pyenv312-ubuntu /opt/pyenv /opt/pyenv
+RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
+
+FROM ubuntu AS python313-ubuntu
+COPY --from=pyenv313-ubuntu /opt/pyenv /opt/pyenv
+RUN cd /usr/local/bin; ln -vs ../../..$PYENV_ROOT/shims/* .
--- a/src/build/Makefile
+++ b/src/build/Makefile
@ -0,0 +1,40 @@
+PYENV_ROOT = $(HOME)/.pyenv
+NVM_DIR = $(HOME)/.nvm
+VERBOSE := 0
+
+pyenv_targets := $(addprefix pyenv3, 9 10 11 12 13)
+nvm_targets := $(addprefix nvm, 19 20 21 22 23)
+
+all: $(pyenv_targets) $(nvm_targets)
+
+pyenv: $(PYENV_ROOT)
+nvm: $(NVM_DIR)
+
+$(PYENV_ROOT):
+	curl -fsSL https://pyenv.run | bash
+
+export PYENV_ROOT := $(PYENV_ROOT)
+export PATH := $(PYENV_ROOT)/bin:$(PATH)
+$(pyenv_targets): $(PYENV_ROOT)
+	export version="3.$$(echo "$@" | sed 's|^pyenv3||')"; \
+	sh -cx "pyenv install $(if $(filter-out 1,$(VERBOSE)),,-v) $$version"; \
+	rm -v $(PYENV_ROOT)/shims/*; \
+	sh -cx "cd $(PYENV_ROOT)/shims; ln -s "../versions/$$(basename "$$(pyenv prefix $$version)")/bin/*" ."
+
+$(NVM_DIR):
+	mkdir -p $(NVM_DIR)
+	curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
+# build node target, create a directory for symbolicly linking the targeted node versions binaries and link them
+
+export NVM_DIR := $(NVM_DIR)
+$(nvm_targets): $(NVM_DIR)
+	@export version="$$(echo "$@" | sed 's|^nvm||')"; \
+	sh -c ". $(NVM_DIR)/nvm.sh; nvm install -s "$$version"" && \
+	mkdir -vp $(NVM_DIR)/shims && cd $(NVM_DIR)/shims; \
+	sh -cx pwd; \
+	export rversion=$$(sh -c ". $(NVM_DIR)/nvm.sh; nvm version "$$version""); \
+	for path in ../versions/node/$$rversion/bin/*; do \
+	    ln -vsf "$$path" .; \
+	    ln -vsf "$$path" ./$$(basename "$$path")$$version; \
+	done
+	
--- a/src/build/README.md
+++ b/src/build/README.md
@ -0,0 +1,35 @@
+<a name="build-node19-ubuntu"></a>
+# build-node19-ubuntu
+
+<a name="build-node20-ubuntu"></a>
+# build-node20-ubuntu
+
+<a name="build-node21-ubuntu"></a>
+# build-node21-ubuntu
+
+<a name="build-node22-ubuntu"></a>
+# build-node22-ubuntu
+
+<a name="build-node23-ubuntu"></a>
+# build-node23-ubuntu
+
+<a name="build-python39-ubuntu"></a>
+# build-python39-ubuntu
+
+<a name="build-python310-ubuntu"></a>
+# build-python310-ubuntu
+
+<a name="build-python311-ubuntu"></a>
+# build-python311-ubuntu
+
+<a name="build-python312-ubuntu"></a>
+# build-python312-ubuntu
+
+<a name="build-python313-ubuntu"></a>
+# build-python313-ubuntu
+
+<a name="build-ubuntu"></a>
+# build-ubuntu
+
+<a name="build-windowsservercore"></a>
+# build-windowsservercore