From dbdbf029f2efc93171742edcc371e4b80eaea49d Mon Sep 17 00:00:00 2001 From: Laurent Goderre Date: Thu, 11 Jul 2024 11:43:35 -0400 Subject: [PATCH 1/2] Make the notary version detectable --- .gitignore | 1 - Dockerfile-builder.template | 21 +++++---------------- Dockerfile.template | 2 +- apply-templates.sh | 8 -------- notary-builder/Dockerfile | 8 +++++--- notary-server/Dockerfile | 2 +- notary-signer/Dockerfile | 2 +- 7 files changed, 13 insertions(+), 31 deletions(-) diff --git a/.gitignore b/.gitignore index c8db931..d548f66 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ .jq-template.awk -.template-helper-functions.jq diff --git a/Dockerfile-builder.template b/Dockerfile-builder.template index 2cde8b6..3a36f87 100644 --- a/Dockerfile-builder.template +++ b/Dockerfile-builder.template @@ -1,4 +1,3 @@ -{{ include ".template-helper-functions" -}} FROM golang:1.19-alpine{{ .alpine }} RUN apk add --no-cache git make @@ -11,6 +10,8 @@ ENV GOFLAGS -mod=vendor WORKDIR /go/src/$NOTARYPKG RUN set -eux; \ git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ +# In case the version in file doens't match the tag (like in 0.7.0) + echo "${TAG//v/}" > NOTARY_VERSION; \ # https://github.com/notaryproject/notary/pull/1635 git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ @@ -18,21 +19,9 @@ RUN set -eux; \ go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ go mod vendor; \ # TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) +# Make the version detectable by scanners + sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ /notary-server --version; \ - /notary-signer --version; \ - \ - echo {{ - { - name: "notary", - version: .version, - params: { - os_name: "alpine", - os_version: .alpine - }, - licenses: [ - "Apache-2.0" - ] - } | sbom | tostring | @sh - }} > /notary.spdx.json; + /notary-signer --version; diff --git a/Dockerfile.template b/Dockerfile.template index 08a9d0d..6cee8c0 100644 --- a/Dockerfile.template +++ b/Dockerfile.template @@ -12,7 +12,7 @@ ENV INSTALLDIR /notary/{{ env.variant }} ENV PATH=$PATH:${INSTALLDIR} WORKDIR ${INSTALLDIR} -COPY --from=notary:{{ .version }}-builder /notary-{{ env.variant }} /notary.spdx.json ./ +COPY --from=notary:{{ .version }}-builder /notary-{{ env.variant }} ./ RUN ./notary-{{ env.variant }} --version COPY ./{{ env.variant }}-config.json . diff --git a/apply-templates.sh b/apply-templates.sh index d2fe7a6..7d5a307 100755 --- a/apply-templates.sh +++ b/apply-templates.sh @@ -13,14 +13,6 @@ elif [ "$BASH_SOURCE" -nt "$jqt" ]; then wget -qO "$jqt" 'https://github.com/docker-library/bashbrew/raw/9f6a35772ac863a0241f147c820354e4008edf38/scripts/jq-template.awk' fi -jqf='.template-helper-functions.jq' -if [ -n "${BASHBREW_SCRIPTS:-}" ]; then - jqf="$BASHBREW_SCRIPTS/template-helper-functions.jq" -elif [ "$BASH_SOURCE" -nt "$jqf" ]; then - wget -qO "$jqf" 'https://github.com/docker-library/bashbrew/raw/master/scripts/template-helper-functions.jq' -fi - - generated_warning() { cat <<-EOH # diff --git a/notary-builder/Dockerfile b/notary-builder/Dockerfile index cb3c0d0..bb66da5 100644 --- a/notary-builder/Dockerfile +++ b/notary-builder/Dockerfile @@ -16,6 +16,8 @@ ENV GOFLAGS -mod=vendor WORKDIR /go/src/$NOTARYPKG RUN set -eux; \ git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ +# In case the version in file doens't match the tag (like in 0.7.0) + echo "${TAG//v/}" > NOTARY_VERSION; \ # https://github.com/notaryproject/notary/pull/1635 git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ @@ -23,9 +25,9 @@ RUN set -eux; \ go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ go mod vendor; \ # TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) +# Make the version detectable by scanners + sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ /notary-server --version; \ - /notary-signer --version; \ - \ - echo '{"spdxVersion":"SPDX-2.3","SPDXID":"SPDXRef-DOCUMENT","name":"notary-sbom","packages":[{"name":"notary","versionInfo":"0.7.0","SPDXID":"SPDXRef-Package--notary","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:generic/notary@0.7.0?os_name=alpine&os_version=3.16"}],"licenseDeclared":"Apache-2.0"}]}' > /notary.spdx.json; + /notary-signer --version; diff --git a/notary-server/Dockerfile b/notary-server/Dockerfile index 285818a..fe75eb5 100644 --- a/notary-server/Dockerfile +++ b/notary-server/Dockerfile @@ -13,7 +13,7 @@ ENV INSTALLDIR /notary/server ENV PATH=$PATH:${INSTALLDIR} WORKDIR ${INSTALLDIR} -COPY --from=notary:0.7.0-builder /notary-server /notary.spdx.json ./ +COPY --from=notary:0.7.0-builder /notary-server ./ RUN ./notary-server --version COPY ./server-config.json . diff --git a/notary-signer/Dockerfile b/notary-signer/Dockerfile index ddc1b20..9c236ca 100644 --- a/notary-signer/Dockerfile +++ b/notary-signer/Dockerfile @@ -14,7 +14,7 @@ ENV INSTALLDIR /notary/signer ENV PATH=$PATH:${INSTALLDIR} WORKDIR ${INSTALLDIR} -COPY --from=notary:0.7.0-builder /notary-signer /notary.spdx.json ./ +COPY --from=notary:0.7.0-builder /notary-signer ./ RUN ./notary-signer --version COPY ./signer-config.json . From cf64d96ec88220102f2824a4b8b161dfbfd52879 Mon Sep 17 00:00:00 2001 From: Laurent Goderre Date: Wed, 7 Aug 2024 09:45:29 -0400 Subject: [PATCH 2/2] Removed the builder variant --- .github/workflows/ci.yml | 4 ---- Dockerfile-builder.template | 27 --------------------------- Dockerfile.template | 30 +++++++++++++++++++++++++++++- apply-templates.sh | 10 ++-------- notary-builder/Dockerfile | 33 --------------------------------- notary-server/Dockerfile | 30 +++++++++++++++++++++++++++++- notary-signer/Dockerfile | 30 +++++++++++++++++++++++++++++- 7 files changed, 89 insertions(+), 75 deletions(-) delete mode 100644 Dockerfile-builder.template delete mode 100644 notary-builder/Dockerfile diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index db937ad..54e431f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,10 +10,6 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - - run: | - docker build notary-builder --tag notary:builder - tag="$(docker run --rm notary:builder sh -c 'echo $TAG' | awk '{gsub(/^v/, ""); print}')" - docker tag notary:builder "notary:${tag}-builder" - run: docker build notary-server --tag notary:server - run: docker build notary-signer --tag notary:signer - uses: actions/checkout@v3 # clone Notary upstream repo (used for generating necessary certificates to test against) diff --git a/Dockerfile-builder.template b/Dockerfile-builder.template deleted file mode 100644 index 3a36f87..0000000 --- a/Dockerfile-builder.template +++ /dev/null @@ -1,27 +0,0 @@ -FROM golang:1.19-alpine{{ .alpine }} - -RUN apk add --no-cache git make - -ENV NOTARYPKG github.com/theupdateframework/notary -ENV TAG v{{ .version }} - -ENV GOFLAGS -mod=vendor - -WORKDIR /go/src/$NOTARYPKG -RUN set -eux; \ - git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ -# In case the version in file doens't match the tag (like in 0.7.0) - echo "${TAG//v/}" > NOTARY_VERSION; \ -# https://github.com/notaryproject/notary/pull/1635 - git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ - git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ -# https://github.com/notaryproject/notary/issues/1602 (rough cherry-pick of ca095023296d2d710ad9c6dec019397d46bf8576) - go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ - go mod vendor; \ -# TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) -# Make the version detectable by scanners - sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ - make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ - cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ - /notary-server --version; \ - /notary-signer --version; diff --git a/Dockerfile.template b/Dockerfile.template index 6cee8c0..0fcc23c 100644 --- a/Dockerfile.template +++ b/Dockerfile.template @@ -1,3 +1,31 @@ +FROM golang:1.19-alpine{{ .alpine }} AS build + +RUN apk add --no-cache git make + +ENV NOTARYPKG github.com/theupdateframework/notary +ENV TAG v{{ .version }} + +ENV GOFLAGS -mod=vendor + +WORKDIR /go/src/$NOTARYPKG +RUN set -eux; \ + git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ +# In case the version in file doens't match the tag (like in 0.7.0) + echo "${TAG//v/}" > NOTARY_VERSION; \ +# https://github.com/notaryproject/notary/pull/1635 + git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ + git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ +# https://github.com/notaryproject/notary/issues/1602 (rough cherry-pick of ca095023296d2d710ad9c6dec019397d46bf8576) + go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ + go mod vendor; \ +# TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) +# Make the version detectable by scanners + sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ + make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ + cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ + /notary-server --version; \ + /notary-signer --version; + FROM alpine:{{ .alpine }} RUN adduser -D -H -g "" notary @@ -12,7 +40,7 @@ ENV INSTALLDIR /notary/{{ env.variant }} ENV PATH=$PATH:${INSTALLDIR} WORKDIR ${INSTALLDIR} -COPY --from=notary:{{ .version }}-builder /notary-{{ env.variant }} ./ +COPY --from=build /notary-{{ env.variant }} ./ RUN ./notary-{{ env.variant }} --version COPY ./{{ env.variant }}-config.json . diff --git a/apply-templates.sh b/apply-templates.sh index 7d5a307..54cbb29 100755 --- a/apply-templates.sh +++ b/apply-templates.sh @@ -26,7 +26,7 @@ generated_warning() { export version=latest -for variant in builder signer server; do +for variant in signer server; do export variant dockerfile= @@ -34,13 +34,7 @@ for variant in builder signer server; do rm "$dest" - case "$variant" in - builder) - dockerfile="Dockerfile-$variant.template" - ;; - *) - dockerfile="Dockerfile.template" - esac + dockerfile="Dockerfile.template" { generated_warning diff --git a/notary-builder/Dockerfile b/notary-builder/Dockerfile deleted file mode 100644 index bb66da5..0000000 --- a/notary-builder/Dockerfile +++ /dev/null @@ -1,33 +0,0 @@ -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# - -FROM golang:1.19-alpine3.16 - -RUN apk add --no-cache git make - -ENV NOTARYPKG github.com/theupdateframework/notary -ENV TAG v0.7.0 - -ENV GOFLAGS -mod=vendor - -WORKDIR /go/src/$NOTARYPKG -RUN set -eux; \ - git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ -# In case the version in file doens't match the tag (like in 0.7.0) - echo "${TAG//v/}" > NOTARY_VERSION; \ -# https://github.com/notaryproject/notary/pull/1635 - git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ - git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ -# https://github.com/notaryproject/notary/issues/1602 (rough cherry-pick of ca095023296d2d710ad9c6dec019397d46bf8576) - go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ - go mod vendor; \ -# TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) -# Make the version detectable by scanners - sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ - make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ - cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ - /notary-server --version; \ - /notary-signer --version; diff --git a/notary-server/Dockerfile b/notary-server/Dockerfile index fe75eb5..d325276 100644 --- a/notary-server/Dockerfile +++ b/notary-server/Dockerfile @@ -4,6 +4,34 @@ # PLEASE DO NOT EDIT IT DIRECTLY. # +FROM golang:1.19-alpine3.16 AS build + +RUN apk add --no-cache git make + +ENV NOTARYPKG github.com/theupdateframework/notary +ENV TAG v0.7.0 + +ENV GOFLAGS -mod=vendor + +WORKDIR /go/src/$NOTARYPKG +RUN set -eux; \ + git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ +# In case the version in file doens't match the tag (like in 0.7.0) + echo "${TAG//v/}" > NOTARY_VERSION; \ +# https://github.com/notaryproject/notary/pull/1635 + git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ + git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ +# https://github.com/notaryproject/notary/issues/1602 (rough cherry-pick of ca095023296d2d710ad9c6dec019397d46bf8576) + go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ + go mod vendor; \ +# TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) +# Make the version detectable by scanners + sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ + make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ + cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ + /notary-server --version; \ + /notary-signer --version; + FROM alpine:3.16 RUN adduser -D -H -g "" notary @@ -13,7 +41,7 @@ ENV INSTALLDIR /notary/server ENV PATH=$PATH:${INSTALLDIR} WORKDIR ${INSTALLDIR} -COPY --from=notary:0.7.0-builder /notary-server ./ +COPY --from=build /notary-server ./ RUN ./notary-server --version COPY ./server-config.json . diff --git a/notary-signer/Dockerfile b/notary-signer/Dockerfile index 9c236ca..7cd6f79 100644 --- a/notary-signer/Dockerfile +++ b/notary-signer/Dockerfile @@ -4,6 +4,34 @@ # PLEASE DO NOT EDIT IT DIRECTLY. # +FROM golang:1.19-alpine3.16 AS build + +RUN apk add --no-cache git make + +ENV NOTARYPKG github.com/theupdateframework/notary +ENV TAG v0.7.0 + +ENV GOFLAGS -mod=vendor + +WORKDIR /go/src/$NOTARYPKG +RUN set -eux; \ + git clone -b "$TAG" --depth 1 "https://$NOTARYPKG.git" .; \ +# In case the version in file doens't match the tag (like in 0.7.0) + echo "${TAG//v/}" > NOTARY_VERSION; \ +# https://github.com/notaryproject/notary/pull/1635 + git fetch --depth 2 origin efc35b02698644af16f6049c7b585697352451b8; \ + git -c user.name=foo -c user.email=foo@example.com cherry-pick -x efc35b02698644af16f6049c7b585697352451b8; \ +# https://github.com/notaryproject/notary/issues/1602 (rough cherry-pick of ca095023296d2d710ad9c6dec019397d46bf8576) + go get github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b; \ + go mod vendor; \ +# TODO remove for the next release of Notary (which should include efc35b02698644af16f6049c7b585697352451b8 & ca095023296d2d710ad9c6dec019397d46bf8576) +# Make the version detectable by scanners + sed -i -r -E 's|(version.NotaryVersion=\$\(NOTARY_VERSION\))|\1 -X $(NOTARY_PKG)/version.Version=$(NOTARY_VERSION)|' Makefile; \ + make SKIPENVCHECK=1 PREFIX=. ./bin/static/notary-server ./bin/static/notary-signer; \ + cp -vL ./bin/static/notary-server ./bin/static/notary-signer /; \ + /notary-server --version; \ + /notary-signer --version; + FROM alpine:3.16 RUN adduser -D -H -g "" notary @@ -14,7 +42,7 @@ ENV INSTALLDIR /notary/signer ENV PATH=$PATH:${INSTALLDIR} WORKDIR ${INSTALLDIR} -COPY --from=notary:0.7.0-builder /notary-signer ./ +COPY --from=build /notary-signer ./ RUN ./notary-signer --version COPY ./signer-config.json .