-
Notifications
You must be signed in to change notification settings - Fork 32
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update: Use Debian bookworm as base docker image (#898)
* Update base docker image to debian:bookworm * Re-sign database test certs with a valid subjectAltName * Fix COSE signature tests on Golang 1.17 and later * Add /go/bin to path * Use curl instead of wget for apk signing tests * gpg2: Remove deprecated --secret-keyring option The --secret-keyring option has been silently ignored since GPG v2.1, so it never did anything anyways, and in more recent builds this now generates a console warning. We should simply remove it. This should be fine so long as we are making use of the --homedir option to prevent unexpected changes to the user's GPG keyring. * Fix verifier/contentsignature tests for Go >= 1.17 * Use debian:bookworm as image for Circle CI lint-vet-fmt job. * Install some extra packages for lint-vet-fmt job. * Combine package installation steps * Generate a sensible version.json even when developing locally * Slim down autograph container Applying the techniques from #861 to this pull request, and adding a workaround for the git error in the build_test_xpis.sh script. * Add argument to select Golang version * Bump CircleCI workers to cimg/go:1.19 * Remove staticcheck version pinning * Fix ARG reuse after FROM * Some staticcheck fixes
- Loading branch information
Showing
20 changed files
with
220 additions
and
105 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| .git/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,36 +1,82 @@ | ||
| FROM golang:1.16.10-buster | ||
| ARG GO_VERSION=1.19 | ||
|
|
||
| #------------------------------------------------------------------------------ | ||
| # Build Stage | ||
| #------------------------------------------------------------------------------ | ||
| FROM debian:bookworm as builder | ||
| ARG GO_VERSION | ||
|
|
||
| ENV DEBIAN_FRONTEND='noninteractive' \ | ||
| PATH="${PATH}:/usr/lib/go-${GO_VERSION}/bin:/go/bin" \ | ||
| GOPATH='/go' | ||
|
|
||
| ## Enable bookworm-backports | ||
| RUN echo "deb http://deb.debian.org/debian/ bookworm-backports main" > /etc/apt/sources.list.d/bookworm-backports.list | ||
| RUN echo "deb-src http://deb.debian.org/debian/ bookworm-backports main" >> /etc/apt/sources.list.d/bookworm-backports.list | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get -y upgrade && \ | ||
| apt-get -y install \ | ||
| libltdl-dev \ | ||
| gpg libncurses5 \ | ||
| devscripts \ | ||
| apksigner \ | ||
| golang-${GO_VERSION} \ | ||
| build-essential | ||
|
|
||
| ADD . /app/src/autograph | ||
|
|
||
| RUN cd /app/src/autograph && go install . | ||
| RUN cd /app/src/autograph/tools/autograph-monitor && go build -o /go/bin/autograph-monitor . | ||
| RUN cd /app/src/autograph/tools/autograph-client && go build -o /go/bin/autograph-client . | ||
|
|
||
| #------------------------------------------------------------------------------ | ||
| # Deployment Stage | ||
| #------------------------------------------------------------------------------ | ||
| FROM debian:bookworm | ||
| ARG GO_VERSION | ||
| EXPOSE 8000 | ||
|
|
||
| ENV GODEBUG=x509ignoreCN=0 | ||
|
|
||
| RUN addgroup --gid 10001 app \ | ||
| && \ | ||
| adduser --gid 10001 --uid 10001 \ | ||
| --home /app --shell /sbin/nologin \ | ||
| --disabled-password app \ | ||
| && \ | ||
| echo 'deb http://archive.debian.org/debian buster-backports main' > /etc/apt/sources.list.d/buster-backports.list && \ | ||
| apt update && \ | ||
| apt -y upgrade && \ | ||
| apt -y install libltdl-dev gpg libncurses5 devscripts && \ | ||
| apt -y install -t buster-backports apksigner && \ | ||
| apt-get clean | ||
| ENV DEBIAN_FRONTEND='noninteractive' \ | ||
| PATH="${PATH}:/usr/lib/go-${GO_VERSION}/bin:/go/bin" \ | ||
| GOPATH='/go' | ||
|
|
||
| ## Enable bookworm-backports | ||
| RUN echo "deb http://deb.debian.org/debian/ bookworm-backports main" > /etc/apt/sources.list.d/bookworm-backports.list | ||
| RUN echo "deb-src http://deb.debian.org/debian/ bookworm-backports main" >> /etc/apt/sources.list.d/bookworm-backports.list | ||
|
|
||
| # Install required packages | ||
| RUN apt-get update && \ | ||
| apt-get -y upgrade && \ | ||
| apt-get -y install --no-install-recommends \ | ||
| libltdl-dev \ | ||
| gpg \ | ||
| libncurses5 \ | ||
| devscripts \ | ||
| apksigner \ | ||
| golang-${GO_VERSION} \ | ||
| build-essential \ | ||
| curl \ | ||
| jq | ||
|
|
||
| # Cleanup after package installation | ||
| RUN apt-get clean && \ | ||
| rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # fetch the RDS CA bundles | ||
| # https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions | ||
| RUN curl -o /usr/local/share/old-rds-ca-bundle.pem https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem && \ | ||
| curl -o /usr/local/share/new-rds-ca-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem && \ | ||
| cat /usr/local/share/old-rds-ca-bundle.pem /usr/local/share/new-rds-ca-bundle.pem > /usr/local/share/rds-combined-ca-bundle.pem | ||
|
|
||
| # Copy compiled appliation from the builder. | ||
| ADD . /app/src/autograph | ||
| ADD autograph.yaml /app | ||
| ADD version.json /app | ||
| COPY --from=builder /go/bin /go/bin/ | ||
|
|
||
| RUN cd /app/src/autograph && go install . | ||
|
|
||
| RUN cd /app/src/autograph/tools/autograph-monitor && go build -o /go/bin/autograph-monitor . | ||
| RUN cd /app/src/autograph/tools/autograph-client && go build -o /go/bin/autograph-client . | ||
|
|
||
| # Setup the worker and entrypoint. | ||
| RUN useradd --uid 10001 --home-dir /app --shell /sbin/nologin app | ||
| USER app | ||
| WORKDIR /app | ||
| CMD /go/bin/autograph |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,7 +21,7 @@ install-goveralls: | |
| go install github.com/mattn/[email protected] | ||
|
|
||
| install-staticcheck: | ||
| go install honnef.co/go/tools/cmd/staticcheck@v0.2.2 | ||
| go install honnef.co/go/tools/cmd/staticcheck@v0.4.7 | ||
|
|
||
| install-go-mod-upgrade: | ||
| go get github.com/oligot/go-mod-upgrade | ||
|
|
@@ -69,7 +69,7 @@ race: | |
| go test -race -covermode=atomic -count=1 $(PACKAGE_NAMES) | ||
|
|
||
| staticcheck: | ||
| $(GOPATH)/bin/staticcheck -go 1.16 $(PACKAGE_NAMES) | tee /tmp/autograph-staticcheck.txt | ||
| $(GOPATH)/bin/staticcheck $(PACKAGE_NAMES) | tee /tmp/autograph-staticcheck.txt | ||
| # ignore errors in pkgs | ||
| # ignore SA1019 for DSA being deprecated refs: GH #667 | ||
| test 0 -eq $$(grep -c -Pv '^/go/pkg/mod/|SA1019' /tmp/autograph-staticcheck.txt) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Generate the self-signed root certificate. | ||
| if [ ! -f root.key ] || [ ! -f root.crt ]; then | ||
| openssl req -x509 -nodes -out root.crt -keyout root.key \ | ||
| -subj "/CN=db-root" -addext "subjectAltName = DNS:db-root" | ||
| fi | ||
|
|
||
| # Re-use existing server keys, if present. | ||
| SERVERKEYARG="-keyout" | ||
| if [ -f server.key ]; then | ||
| SERVERKEYARG="-key" | ||
| fi | ||
|
|
||
| # Generate the database server certificate. | ||
| openssl req -new -nodes -out server.csr ${SERVERKEYARG} server.key \ | ||
| -subj "/CN=db" -addext "subjectAltName = DNS:db" | ||
| openssl x509 -req -in server.csr -days 3650 -text -out server.crt \ | ||
| -CA root.crt -CAkey root.key -copy_extensions copy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.