Add a bullseye builder

Duplicate the current dockerfiles/ directory into a separate buster
and bullseye directories with the understanding that the buster
one is going to go away pretty soon, so it's not worth abstracting
the logic to be platform agnostic.

I dropped some packages and the timezone step that were already present
in the base `debian:bullseye` image.

Rather than rebuilding the Cython wheel for Python 3.9, I just hacked
in the sha256 hash for the source tarball, which seems to work at a pretty
minimal time cost to build. Presumably someone whose key is in the trusted
set should build a 3.9 wheel properly.

build-requirements.txt

@@ -1,6 +1,6 @@
 build==0.3.0 --hash=sha256:3fe8fac398ae76f534dee92c0db01c2960e271094f8cd52aa9d24a633c244e59
 click==7.1.2 --hash=sha256:3b0769bd65ca00ffcb57975e750fac079639a3d3ce393c5a0d4c65123141c87a
-cython==0.29.22 --hash=sha256:8c9eec7e9de2a30861ca347d0a149cc1482de12fc765fa06c414930e8ce20d0a
+cython==0.29.22 --hash=sha256:8c9eec7e9de2a30861ca347d0a149cc1482de12fc765fa06c414930e8ce20d0a --hash=sha256:df6b83c7a6d1d967ea89a2903e4a931377634a297459652e4551734c48195406
 flit-core==2.3.0 --hash=sha256:a14d6cca50a51eff2c418fc3f8e887cd31a3233a6b465451fd57074e232d7c4c
 importlib-metadata==3.7.0 --hash=sha256:35fc3ab05e060b85739da17db4ce33e8532ce1010d892d178f85a211e080e1ff
 packaging==20.9 --hash=sha256:44698376bc57a48290dc82bfdc20d339684856b24d6b8c3760b284de4eebc498

dockerfiles/bullseye/Dockerfile

@@ -0,0 +1,37 @@
+# We want to do things using Debian Bullseye's own Python
+FROM debian:bullseye
+
+# make Apt non-interactive
+RUN echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/90circleci \
+  && echo 'DPkg::Options "--force-confnew";' >> /etc/apt/apt.conf.d/90circleci
+
+ENV DEBIAN_FRONTEND=noninteractive
+# Make sure PATH includes ~/.local/bin
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839155
+# This only works for root. The circleci user is done near the end of this Dockerfile
+RUN echo 'PATH="$HOME/.local/bin:$PATH"' >> /etc/profile.d/user-local-path.sh
+
+# man directory is missing in some base images
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863199
+RUN apt-get update \
+  && mkdir -p /usr/share/man/man1 \
+  && apt-get install -y \
+    git mercurial xvfb \
+    locales sudo openssh-client ca-certificates tar parallel \
+    net-tools netcat unzip zip bzip2 gnupg curl wget make python3 python3-venv python3-pip
+
+# Use unicode
+RUN locale-gen C.UTF-8 || true
+ENV LANG=C.UTF-8
+
+RUN groupadd --gid 3434 ci \
+  && useradd --uid 3434 --gid ci --shell /bin/bash --create-home ci \
+  && echo 'ci ALL=NOPASSWD: ALL' >> /etc/sudoers.d/50-ci \
+  && echo 'Defaults    env_keep += "DEBIAN_FRONTEND"' >> /etc/sudoers.d/env_keep
+
+
+
+USER ci
+ENV PATH /home/ci/.local/bin:/home/ci/bin:${PATH}
+
+CMD ["/bin/sh"]

dockerfiles/bullseye/Makefile

@@ -0,0 +1,20 @@
+DATE_STR := $(shell date +"%Y_%m_%d")
+BUILDER_IMAGE ?= "quay.io/freedomofpress/packaging-debian-bullseye:$(DATE_STR)"
+
+.PHONY: build-container
+build-container: ## Build Docker image for Debian Bullseye wheel and package creation
+	@echo "███Building Docker image $(BUILDER_IMAGE) for Debian Bullseye wheel and package creation"
+	@docker build --no-cache -t $(BUILDER_IMAGE) .
+
+.PHONY: push-container
+push-container: ## Push the Docker image for Debian Bullseye wheel and package creation to quay.io
+	@echo "███Pushing Docker image for Debian package creation to quay.io..."
+	@./push.sh
+
+.PHONY: help
+help: ## Print this message and exit.
+	@printf "Build a Docker container for Debian package creation.\n"
+	@printf "Subcommands:\n\n"
+	@awk 'BEGIN {FS = ":.*?## "} /^[0-9a-zA-Z_-]+:.*?## / {printf "\033[36m%s\033[0m : %s\n", $$1, $$2}' $(MAKEFILE_LIST) \
+		| sort \
+		| column -s ':' -t

dockerfiles/bullseye/image_hash

@@ -0,0 +1,2 @@
+# sha256 digest quay.io/freedomofpress/packaging-debian-bullseye:2022_05_10
+197a4b1de4d4b94fc69d242a140684edae70b6760287b066afe3dd6427d4eddb

dockerfiles/bullseye/push.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+DATE_STR=$(date +"%Y_%m_%d")
+QUAY_REPO=quay.io/freedomofpress/packaging-debian-bullseye
+
+set -e
+set -x
+
+docker push "${QUAY_REPO}:${DATE_STR}"
+
+echo "# sha256 digest ${QUAY_REPO}:${DATE_STR}" > image_hash
+docker inspect --format='{{index .RepoDigests 0}}' "${QUAY_REPO}:${DATE_STR}" \
+    | sed 's/.*://g' >> image_hash