builder/Dockerfile at main · gardenlinux/builder · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
FROM debian:testing AS mv_data
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential ca-certificates git
RUN git clone --depth=1 https://github.com/gardenlinux/mv_data
RUN make -C mv_data install

FROM debian:testing AS datefudge
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential ca-certificates git
RUN git clone --branch debian/1.26 --depth=1 https://salsa.debian.org/debian/datefudge.git
RUN make -C datefudge install

FROM debian:testing AS resizefat32
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends build-essential ca-certificates git
RUN git clone https://github.com/gardenlinux/resizefat32
RUN make -C resizefat32 install

FROM debian:testing AS syft
ARG SYFT_RELEASE="1.45.1"
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates wget jq
# getting checksums and signatures and unpack
COPY syft_${SYFT_RELEASE}_checksums.txt /syft_${SYFT_RELEASE}_checksums.txt
COPY syft_${SYFT_RELEASE}_checksums.txt.sig /syft_${SYFT_RELEASE}_checksums.txt.sig
COPY syft_${SYFT_RELEASE}_checksums.txt.pem /syft_${SYFT_RELEASE}_checksums.txt.pem
# unpack
RUN base64 -d /syft_${SYFT_RELEASE}_checksums.txt.sig > /syft_${SYFT_RELEASE}_checksums.txt.sig.unpacked
RUN base64 -d syft_${SYFT_RELEASE}_checksums.txt.pem | openssl x509 -pubkey > /syft_${SYFT_RELEASE}_checksums.txt.pem.unpacked
# verify
RUN openssl dgst -verify /syft_${SYFT_RELEASE}_checksums.txt.pem.unpacked -signature /syft_${SYFT_RELEASE}_checksums.txt.sig.unpacked syft_${SYFT_RELEASE}_checksums.txt
# get syft
RUN wget --quiet https://github.com/anchore/syft/releases/download/v${SYFT_RELEASE}/syft_${SYFT_RELEASE}_linux_$(dpkg --print-architecture).deb
# verify checksum
RUN sha256sum --ignore-missing --check /syft_${SYFT_RELEASE}_checksums.txt
# install
RUN DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends ./syft_${SYFT_RELEASE}_linux_$(dpkg --print-architecture).deb

FROM debian:testing

LABEL org.opencontainers.image.source="https://github.com/gardenlinux/builder"
LABEL org.opencontainers.image.description="Builder for Garden Linux"

COPY pkg.list /pkg.list
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $(cat /pkg.list) && rm /pkg.list
COPY --from=mv_data /usr/bin/mv_data /usr/bin/mv_data
COPY --from=datefudge /usr/lib/datefudge/datefudge.so /usr/lib/datefudge/datefudge.so
COPY --from=datefudge /usr/bin/datefudge /usr/bin/datefudge
COPY --from=resizefat32 /usr/bin/resizefat32 /usr/bin/resizefat32
COPY --from=syft /usr/bin/syft /usr/bin/syft
RUN curl "https://github.com/gardenlinux/aws-kms-pkcs11/releases/download/latest/aws_kms_pkcs11-$(dpkg --print-architecture).so" -sLo "/usr/lib/$(uname -m)-linux-gnu/pkcs11/aws_kms_pkcs11.so"
COPY builder /builder
RUN mkdir /builder/cert
COPY setup_namespace /usr/sbin/setup_namespace
RUN curl -sSLf https://github.com/gardenlinux/seccomp_fake_xattr/releases/download/latest/seccomp_fake_xattr-$(uname -m).tar.gz \
	| gzip -d \
	| tar -xO seccomp_fake_xattr-$(uname -m)/fake_xattr > /usr/bin/fake_xattr \
	&& chmod +x /usr/bin/fake_xattr
RUN mkdir /tmp/sbsign \
	&& cd /tmp/sbsign \
	&& curl -sSLf https://github.com/gardenlinux/package-sbsigntool/releases/download/0.9.4-3.2gl0/build.tar.xz.0000 | xz -d | tar -x \
	&& dpkg -i sbsigntool_*_$(dpkg --print-architecture).deb
RUN echo 'root:1:65535' | tee /etc/subuid /etc/subgid > /dev/null
ENTRYPOINT [ "/usr/sbin/setup_namespace" ]