-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #300 from cevich/multiarch_mulligan
Improve & rename main build-push script
- Loading branch information
Showing
8 changed files
with
168 additions
and
180 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 20230822t185743z-f38f37d13 | ||
| 20230918t183521z-f38f37d13 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,25 @@ | ||
| #!/bin/bash | ||
|
|
||
| # This script is intended to be used from two places only: | ||
| # 1) When building the build-push VM image, to install the scripts as-is | ||
| # in a PR in order for CI testing to operate on them. | ||
| # 2) From the autoupdate.sh script, when $BUILDPUSHAUTOUPDATED is unset | ||
| # or '0'. This clones the latest repository to install (possibly) | ||
| # updated scripts. | ||
| # This script is intended to be run from a task using a pre-existing | ||
| # build-push VM image (having an image-suffix from the IMG_SFX file). | ||
| # It's purpose is to install the latest version of the scripts in the | ||
| # `bin` directory onto the system. | ||
| # | ||
| # WARNING: Use under any other circumstances will probably screw things up. | ||
|
|
||
| if [[ -z "$BUILDPUSHAUTOUPDATED" ]]; | ||
| then | ||
| echo "This script must only be run under Packer or autoupdate.sh" | ||
| # Common automation library pre-installed into the build-push VM | ||
| if [[ -r /etc/automation_environment ]]; then | ||
| # Defines AUTOMATION_LIB_PATH and updates PATH | ||
| source /etc/automation_environment | ||
| source "$AUTOMATION_LIB_PATH/common_lib.sh" | ||
| else | ||
| echo "ERROR: The common automation library has not been installed." > /dev/stderr | ||
| exit 1 | ||
| fi | ||
|
|
||
| source /etc/automation_environment | ||
| source "$AUTOMATION_LIB_PATH/common_lib.sh" | ||
| # Defined by common automation library | ||
| # shellcheck disable=SC2154 | ||
| cd $(dirname "${BASH_SOURCE[0]}") || exit 1 | ||
|
|
||
| #shellcheck disable=SC2154 | ||
| cd $(dirname "$SCRIPT_FILEPATH") || exit 1 | ||
| # Must be installed into $AUTOMATION_LIB_PATH/../bin which is on $PATH | ||
| cp ./bin/* $AUTOMATION_LIB_PATH/../bin/ | ||
| cp ./lib/* $AUTOMATION_LIB_PATH/ | ||
| chmod +x $AUTOMATION_LIB_PATH/../bin/* | ||
| # Must be installed into $AUTOMATION_LIB_PATH/../bin which is also now on $PATH | ||
| install -g root -o root -m 550 ./bin/* $AUTOMATION_LIB_PATH/../bin/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,18 @@ | ||
| #!/bin/bash | ||
|
|
||
| # This script is not intended for humans. It should be run by automation | ||
| # at the branch-level in automation for the skopeo, buildah, and podman | ||
| # repositories. It's purpose is to produce a multi-arch container image | ||
| # based on the contents of context subdirectory. At runtime, $PWD is assumed | ||
| # to be the root of the cloned git repository. | ||
| # This script is not intended for humans. It should be run by secure | ||
| # (maintainer-only) cron-like automation to service the skopeo, buildah, | ||
| # and podman repositories. It's purpose is to produce a multi-arch container | ||
| # image based on the contents of a repository context subdirectory from their | ||
| # respective 'main' branches. | ||
| # | ||
| # The first argument to the script, should be the URL of the git repository | ||
| # in question. Though at this time, this is only used for labeling the | ||
| # resulting image. | ||
| # The first argument to the script, should be the (clone) URL of the git repository | ||
| # in question. This is used to both retrieve the build context, as well as label | ||
| # the produced images. | ||
| # | ||
| # The second argument to this script is the relative path to the build context | ||
| # subdirectory. The basename of this subdirectory may indicates the | ||
| # image flavor (i.e. `upstream`, `testing`, or `stable`). Depending | ||
| # subdirectory. The basename of this subdirectory may (see next paragraph) | ||
| # indicate the image flavor (i.e. `upstream`, `testing`, or `stable`). Depending | ||
| # on this value, the image may be pushed to multiple container registries | ||
| # under slightly different rules (see the next option). | ||
| # | ||
|
|
@@ -27,27 +27,27 @@ if [[ -r "/etc/automation_environment" ]]; then | |
| source /etc/automation_environment # defines AUTOMATION_LIB_PATH | ||
| #shellcheck disable=SC1090,SC2154 | ||
| source "$AUTOMATION_LIB_PATH/common_lib.sh" | ||
| #shellcheck source=../lib/autoupdate.sh | ||
| source "$AUTOMATION_LIB_PATH/autoupdate.sh" | ||
| else | ||
| echo "Expecting to find automation common library installed." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Careful: Changing the error message below could break auto-update test. | ||
| if [[ "$#" -lt 2 ]]; then | ||
| #shellcheck disable=SC2145 | ||
| die "Must be called with at least two arguments, got '$@'" | ||
| fi | ||
|
|
||
| if [[ -z $(type -P build-push.sh) ]]; then | ||
| die "It does not appear that build-push.sh is installed properly" | ||
| fi | ||
|
|
||
| if ! [[ -d "$PWD/.git" ]]; then | ||
| die "The current directory ($PWD) does not appear to be the root of a git repo." | ||
| if [[ -z "$1" ]]; then | ||
| die "Expecting a git repository URI as the first argument." | ||
| fi | ||
|
|
||
| # Careful: Changing the error message below could break auto-update test. | ||
| if [[ "$#" -lt 2 ]]; then | ||
| #shellcheck disable=SC2145 | ||
| die "Must be called with at least two arguments, got '$*'" | ||
| fi | ||
|
|
||
| req_env_vars CI | ||
|
|
||
| # Assume transitive debugging state for build-push.sh if set | ||
| if [[ "$(automation_version | cut -d '.' -f 1)" -ge 4 ]]; then | ||
| # Valid for version 4.0.0 and above only | ||
|
|
@@ -101,27 +101,67 @@ if ((DRYRUN)); then | |
| warn "Operating in dry-run mode with $_DRNOPUSH" | ||
| fi | ||
|
|
||
| # SCRIPT_PATH defined by automation library | ||
| # shellcheck disable=SC2154 | ||
| CLONE_TMP=$(mktemp -p "" -d "tmp_${SCRIPT_FILENAME}_XXXX") | ||
| trap "rm -rf '$CLONE_TMP'" EXIT | ||
|
|
||
| ### MAIN | ||
|
|
||
| declare -a build_args | ||
| if [[ -n "$FLAVOR_NAME" ]]; then | ||
| build_args=(--build-arg "FLAVOR=$FLAVOR_NAME") | ||
| build_args=("--build-arg=FLAVOR=$FLAVOR_NAME") | ||
| fi | ||
|
|
||
| # Labels to add to all images | ||
| # N/B: These won't show up in the manifest-list itself, only it's constituents. | ||
| lblargs="\ | ||
| --label=org.opencontainers.image.source=$REPO_URL \ | ||
| --label=org.opencontainers.image.created=$(date -u --iso-8601=seconds)" | ||
| dbg "lblargs=$lblargs" | ||
| dbg "Cloning '$REPO_URL' into $CLONE_TMP" | ||
| git clone --depth 1 "$REPO_URL" "$CLONE_TMP" | ||
| cd "$CLONE_TMP" | ||
| head_sha=$(git rev-parse HEAD) | ||
| dbg "HEAD is $head_sha" | ||
|
|
||
| req_env_vars CIRRUS_TASK_ID CIRRUS_CHANGE_IN_REPO CIRRUS_REPO_NAME | ||
|
|
||
| # Labels to add to all images as per | ||
| # https://specs.opencontainers.org/image-spec/annotations/?v=v1.0.1 | ||
| declare -a label_args | ||
|
|
||
| # Use both labels and annotations since some older tools only support labels | ||
| # CIRRUS_TASK_ID provided by CI and verified non-empty | ||
| # shellcheck disable=SC2154 | ||
| for arg in "--label" "--annotation"; do | ||
| label_args+=(\ | ||
| "$arg=org.opencontainers.image.source=$REPO_URL" | ||
| "$arg=org.opencontainers.image.revision=$head_sha" | ||
| "$arg=org.opencontainers.image.created=$(date -u --iso-8601=seconds)" | ||
| "$arg=org.opencontainers.image.documentation=${REPO_URL%.git}/tree/$CTX_SUB/README.md" | ||
| "$arg[email protected]" | ||
| ) | ||
|
|
||
| # Perhaps slightly outside the intended purpose, but it kind of fits, and may help | ||
| # somebody ascertain provenance a little better. Note: Even if the console logs | ||
| # are blank, the Cirrus-CI GraphQL API keeps build and task metadata for years. | ||
| label_args+=(\ | ||
| "$arg=org.opencontainers.image.url=https://cirrus-ci.com/task/$CIRRUS_TASK_ID" | ||
| ) | ||
|
|
||
| # Definitely not any official spec., but offers a quick reference to exactly what produced | ||
| # the images and it's current signature. | ||
| label_args+=(\ | ||
| "$arg=built.by.repo=${CIRRUS_REPO_NAME}" | ||
| "$arg=built.by.commit=${CIRRUS_CHANGE_IN_REPO}" | ||
| "$arg=built.by.exec=$(basename ${BASH_SOURCE[0]})" | ||
| "$arg=built.by.digest=sha256:$(sha256sum<${BASH_SOURCE[0]} | awk '{print $1}')" | ||
| ) | ||
| done | ||
|
|
||
| modcmdarg="tag_version.sh $FLAVOR_NAME" | ||
|
|
||
| # For stable images, the version number of the command is needed for tagging. | ||
| # For stable images, the version number of the command is needed for tagging and labeling. | ||
| if [[ "$FLAVOR_NAME" == "stable" ]]; then | ||
| # only native arch is needed to extract the version | ||
| dbg "Building local-arch image to extract stable version number" | ||
| podman build -t $REPO_FQIN "${build_args[@]}" ./$CTX_SUB | ||
| dbg "Building temporary local-arch image to extract stable version number" | ||
| FQIN_TMP="$REPO_NAME:temp" | ||
| showrun podman build -t $FQIN_TMP "${build_args[@]}" ./$CTX_SUB | ||
|
|
||
| case "$REPO_NAME" in | ||
| skopeo) version_cmd="--version" ;; | ||
|
|
@@ -131,42 +171,42 @@ if [[ "$FLAVOR_NAME" == "stable" ]]; then | |
| *) die "Unknown/unsupported repo '$REPO_NAME'" ;; | ||
| esac | ||
|
|
||
| pvcmd="podman run -i --rm $REPO_FQIN $version_cmd" | ||
| pvcmd="podman run -i --rm $FQIN_TMP $version_cmd" | ||
| dbg "Extracting version with command: $pvcmd" | ||
| version_output=$($pvcmd) | ||
| dbg "version output: | ||
| $version_output | ||
| " | ||
| dbg "version output: '$version_output'" | ||
| img_cmd_version=$(awk -r -e '/^.+ version /{print $3}' <<<"$version_output") | ||
| dbg "parsed version: $img_cmd_version" | ||
| test -n "$img_cmd_version" | ||
| lblargs="$lblargs --label=org.opencontainers.image.version=$img_cmd_version" | ||
| # Prevent temporary build colliding with multi-arch manifest list (built next) | ||
| # but preserve image (by ID) for use as cache. | ||
| dbg "Un-tagging $REPO_FQIN" | ||
| podman untag $REPO_FQIN | ||
|
|
||
| label_args+=("--label=org.opencontainers.image.version=$img_cmd_version" | ||
| "--annotation=org.opencontainers.image.version=$img_cmd_version") | ||
|
|
||
| # tag-version.sh expects this arg. when FLAVOR_NAME=stable | ||
| modcmdarg+=" $img_cmd_version" | ||
|
|
||
| dbg "Building stable-flavor manifest-list '$_REG/containers/$REPO_NAME'" | ||
|
|
||
| # Stable images get pushed to 'containers' namespace as latest & version-tagged | ||
| build-push.sh \ | ||
| showrun build-push.sh \ | ||
| $_DRNOPUSH \ | ||
| --arches=$ARCHES \ | ||
| --arches="$ARCHES" \ | ||
| --modcmd="$modcmdarg" \ | ||
| $_REG/containers/$REPO_NAME \ | ||
| ./$CTX_SUB \ | ||
| $lblargs \ | ||
| "${build_args[@]}" | ||
| "$_REG/containers/$REPO_NAME" \ | ||
| "./$CTX_SUB" \ | ||
| "${build_args[@]}" \ | ||
| "${label_args[@]}" | ||
| fi | ||
|
|
||
| dbg "Building manifest-list '$REPO_FQIN'" | ||
|
|
||
| # All images are pushed to quay.io/<reponame>, both | ||
| # latest and version-tagged (if available). | ||
| build-push.sh \ | ||
| showrun build-push.sh \ | ||
| $_DRNOPUSH \ | ||
| --arches=$ARCHES \ | ||
| --arches="$ARCHES" \ | ||
| --modcmd="$modcmdarg" \ | ||
| $REPO_FQIN \ | ||
| ./$CTX_SUB \ | ||
| $lblargs \ | ||
| "${build_args[@]}" | ||
| "$REPO_FQIN" \ | ||
| "./$CTX_SUB" \ | ||
| "${build_args[@]}" \ | ||
| "${label_args[@]}" | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.