tufcli/Dockerfile.cli-stack.rh at main · securesign/tufcli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
FROM registry.redhat.io/ubi9/go-toolset:9.8-1786522985@sha256:444e81b3e88d8a68b92a081a7b3abc7d3fed2450f8473ea6b3caebf3bb73a0b8 AS build-cross-platform
ENV APP_ROOT=/opt/app-root \
    GOPATH=/opt/app-root

USER root
WORKDIR $APP_ROOT/src
ADD go.mod go.sum ./
RUN go mod download

ADD ./ ./

RUN git config --global --add safe.directory /opt/app-root/src && \
    make -f Build.mak cross-platform

FROM --platform=linux/amd64   quay.io/securesign/tufcli@sha256:cf0d704d3ff785f9de965b8aa8f2f077cb10eccbe0a5aef1270d6fb727e19f37 AS build-amd64
FROM --platform=linux/arm64   quay.io/securesign/tufcli@sha256:4f568aa73679f23250dfcf48aaa21b3a3c355a69c47dd78f7fd8d7b3f5e23d1e AS build-arm64
FROM --platform=linux/ppc64le quay.io/securesign/tufcli@sha256:ac30e085dd44a662cc4271c7e9b119db05633d3f7e8a5e4101fdd7e001c14edb AS build-ppc64le
FROM --platform=linux/s390x   quay.io/securesign/tufcli@sha256:d884da6e61d4c89f40d981b27cb521f6af0279a39b63c94a647397f8c16272eb AS build-s390x

FROM registry.redhat.io/ubi9/go-toolset:9.8-1786522985@sha256:444e81b3e88d8a68b92a081a7b3abc7d3fed2450f8473ea6b3caebf3bb73a0b8 AS packager
USER root
RUN mkdir -p /binaries

# tufcli: Native Linux binaries from each arch variant
COPY --from=build-amd64 /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_amd64.tar.gz -C /tmp tufcli && \
    rm /tmp/tufcli

COPY --from=build-arm64 /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_arm64.tar.gz -C /tmp tufcli && \
    rm /tmp/tufcli

COPY --from=build-ppc64le /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_ppc64le.tar.gz -C /tmp tufcli && \
    rm /tmp/tufcli

COPY --from=build-s390x /tufcli /tmp/tufcli
RUN tar -czf /binaries/tufcli_linux_s390x.tar.gz -C /tmp tufcli && \
    rm /tmp/tufcli

# tufcli: Cross-compiled binaries
COPY --from=build-cross-platform /opt/app-root/src/tufcli_darwin_amd64 /tmp/tufcli_darwin_amd64
RUN tar -czf /binaries/tufcli_darwin_amd64.tar.gz -C /tmp tufcli_darwin_amd64 && \
    rm /tmp/tufcli_darwin_amd64

COPY --from=build-cross-platform /opt/app-root/src/tufcli_darwin_arm64 /tmp/tufcli_darwin_arm64
RUN tar -czf /binaries/tufcli_darwin_arm64.tar.gz -C /tmp tufcli_darwin_arm64 && \
    rm /tmp/tufcli_darwin_arm64

COPY --from=build-cross-platform /opt/app-root/src/tufcli_windows_amd64.exe /tmp/tufcli_windows_amd64.exe
RUN tar -czf /binaries/tufcli_windows_amd64.tar.gz -C /tmp tufcli_windows_amd64.exe && \
    rm /tmp/tufcli_windows_amd64.exe

RUN chmod -R a+rX /binaries

# Final minimal image with all binaries
FROM registry.redhat.io/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95

LABEL description="Flat image containing tufcli CLI binaries for all platforms and architectures"
LABEL io.k8s.description="Flat image containing tufcli CLI binaries for all platforms and architectures"
LABEL io.opencontainers.image.description="Flat image containing tufcli CLI binaries for all platforms and architectures"
LABEL io.k8s.display-name="tufcli CLI stack image for Red Hat Trusted Artifact Signer"
LABEL io.openshift.tags="tufcli trusted-artifact-signer cli-stack"
LABEL summary="Provides all tufcli CLI binaries as tar.gz archives for CDN distribution."
LABEL com.redhat.component="tufcli-cli-stack"
LABEL name="rhtas/tufcli-cli-stack"

COPY --from=packager /binaries/ /binaries/
COPY --from=build-amd64 /licenses/ /licenses/

USER 65532:65532