diff --git a/.tekton/fetch-tsa-certs-cli-stack-pull-request.yaml b/.tekton/fetch-tsa-certs-cli-stack-pull-request.yaml index 30f7d8d23..2d56aec65 100644 --- a/.tekton/fetch-tsa-certs-cli-stack-pull-request.yaml +++ b/.tekton/fetch-tsa-certs-cli-stack-pull-request.yaml @@ -8,7 +8,11 @@ metadata: build.appstudio.redhat.com/target_branch: '{{target_branch}}' pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch - == "main" + == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged() + || "Build.mak".pathChanged() || "Dockerfile.cli-stack.rh".pathChanged() + || "go.mod".pathChanged() || "go.sum".pathChanged() + || "trigger-konflux-builds.txt".pathChanged() + ) creationTimestamp: null labels: appstudio.openshift.io/application: cli-stacks diff --git a/.tekton/fetch-tsa-certs-cli-stack-push.yaml b/.tekton/fetch-tsa-certs-cli-stack-push.yaml index 791cf7282..dba91a413 100644 --- a/.tekton/fetch-tsa-certs-cli-stack-push.yaml +++ b/.tekton/fetch-tsa-certs-cli-stack-push.yaml @@ -7,7 +7,11 @@ metadata: build.appstudio.redhat.com/target_branch: '{{target_branch}}' pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch - == "main" + == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged() + || "Build.mak".pathChanged() || "Dockerfile.cli-stack.rh".pathChanged() + || "go.mod".pathChanged() || "go.sum".pathChanged() + || "trigger-konflux-builds.txt".pathChanged() + ) creationTimestamp: null labels: appstudio.openshift.io/application: cli-stacks diff --git a/.tekton/fetch-tsa-certs-pull-request.yaml b/.tekton/fetch-tsa-certs-pull-request.yaml index d644cc213..16fe2b5bf 100644 --- a/.tekton/fetch-tsa-certs-pull-request.yaml +++ b/.tekton/fetch-tsa-certs-pull-request.yaml @@ -8,9 +8,10 @@ metadata: build.appstudio.redhat.com/target_branch: '{{target_branch}}' pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch - == "main" && (".tekton/fetch-tsa-certs-pull-request.yaml".pathChanged() || "cmd/fetch-tsa-certs/***".pathChanged() - || "pkg/***".pathChanged() || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged() - || "go.mod".pathChanged() || "go.sum".pathChanged() || "trigger-konflux-builds.txt".pathChanged() + == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged() + || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged() + || "go.mod".pathChanged() || "go.sum".pathChanged() + || "trigger-konflux-builds.txt".pathChanged() ) creationTimestamp: null labels: @@ -37,23 +38,18 @@ spec: value: "true" - name: hermetic value: "true" - - name: prefetch-input - value: '{"type": "gomod", "path": "."}' - - name: go_unit_test + - name: ALLOW_CROSS_PLATFORM_IMAGES value: "true" - - name: go_test_command - value: | - CGO_ENABLED=0 go build -trimpath -o bin/timestamp-cli ./cmd/timestamp-cli - CGO_ENABLED=0 go build -trimpath -o bin/timestamp-server ./cmd/timestamp-server - go test ./... - name: build-platforms value: - linux/x86_64 - linux/arm64 - linux/ppc64le - linux/s390x - - name: fips-check - value: "true" + - name: manager-pipelinerun-selector + value: "appstudio.openshift.io/application=cli-stacks,appstudio.openshift.io/component=fetch-tsa-certs-cli-stack,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (pull_request,incoming,retest-all-comment)" + - name: manager-registry-url + value: "quay.io/securesign/fetch-tsa-certs-cli-stack" pipelineRef: params: - name: url @@ -63,13 +59,6 @@ spec: - name: pathInRepo value: pipelines/docker-build-multi-platform-oci-ta.yaml resolver: git - taskRunSpecs: - - pipelineTaskName: run-unit-test - stepSpecs: - - computeResources: - limits: - memory: 5Gi - name: run-tests taskRunTemplate: serviceAccountName: build-pipeline-fetch-tsa-certs workspaces: diff --git a/.tekton/fetch-tsa-certs-push.yaml b/.tekton/fetch-tsa-certs-push.yaml index a8a7d1257..edc6671b1 100644 --- a/.tekton/fetch-tsa-certs-push.yaml +++ b/.tekton/fetch-tsa-certs-push.yaml @@ -2,15 +2,16 @@ apiVersion: tekton.dev/v1 kind: PipelineRun metadata: annotations: - build.appstudio.openshift.io/build-nudge-files: "Dockerfile.clients.rh,Dockerfile.cli-stack.rh" + build.appstudio.openshift.io/build-nudge-files: "Dockerfile.clients.rh" build.appstudio.openshift.io/repo: https://github.com/securesign/timestamp-authority?rev={{revision}} build.appstudio.redhat.com/commit_sha: '{{revision}}' build.appstudio.redhat.com/target_branch: '{{target_branch}}' pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch - == "main" && (".tekton/fetch-tsa-certs-push.yaml".pathChanged() || "cmd/fetch-tsa-certs/***".pathChanged() - || "pkg/***".pathChanged() || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged() - || "go.mod".pathChanged() || "go.sum".pathChanged() || "trigger-konflux-builds.txt".pathChanged() + == "main" && ("cmd/fetch-tsa-certs/***".pathChanged() || "pkg/***".pathChanged() + || "Build.mak".pathChanged() || "Dockerfile.fetch_tsa_certs.rh".pathChanged() + || "go.mod".pathChanged() || "go.sum".pathChanged() + || "trigger-konflux-builds.txt".pathChanged() ) creationTimestamp: null labels: @@ -35,23 +36,18 @@ spec: value: "true" - name: hermetic value: "true" - - name: prefetch-input - value: '{"type": "gomod", "path": "."}' - - name: go_unit_test + - name: ALLOW_CROSS_PLATFORM_IMAGES value: "true" - - name: go_test_command - value: | - CGO_ENABLED=0 go build -trimpath -o bin/timestamp-cli ./cmd/timestamp-cli - CGO_ENABLED=0 go build -trimpath -o bin/timestamp-server ./cmd/timestamp-server - go test ./... - name: build-platforms value: - linux/x86_64 - linux/arm64 - linux/ppc64le - linux/s390x - - name: fips-check - value: "true" + - name: manager-pipelinerun-selector + value: "appstudio.openshift.io/application=cli-stacks,appstudio.openshift.io/component=fetch-tsa-certs-cli-stack,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (push,incoming,retest-all-comment)" + - name: manager-registry-url + value: "quay.io/securesign/fetch-tsa-certs-cli-stack" pipelineRef: params: - name: url @@ -61,13 +57,6 @@ spec: - name: pathInRepo value: pipelines/docker-build-multi-platform-oci-ta.yaml resolver: git - taskRunSpecs: - - pipelineTaskName: run-unit-test - stepSpecs: - - computeResources: - limits: - memory: 5Gi - name: run-tests taskRunTemplate: serviceAccountName: build-pipeline-fetch-tsa-certs workspaces: diff --git a/Build.mak b/Build.mak index 768ea0231..81680fdf7 100644 --- a/Build.mak +++ b/Build.mak @@ -1,20 +1,40 @@ FIPS_MODULE ?= latest +BUILD_FLAGS = -mod=readonly -tags=no_openssl -buildvcs=false -trimpath .PHONY: fetch-tsa-certs-linux fetch-tsa-certs-linux: ## Build native Linux binary (FIPS) - env CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -mod=readonly -tags=no_openssl -buildvcs=false -o fetch_tsa_certs -trimpath ./cmd/fetch-tsa-certs + env CGO_ENABLED=0 GOFIPS140=v1.0.0 go build $(BUILD_FLAGS) -o fetch_tsa_certs ./cmd/fetch-tsa-certs -.PHONY: +.PHONY: fetch-tsa-certs-linux-amd64 +fetch-tsa-certs-linux-amd64: ## Build for Linux amd64 + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=amd64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_amd64 ./cmd/fetch-tsa-certs + +.PHONY: fetch-tsa-certs-linux-arm64 +fetch-tsa-certs-linux-arm64: ## Build for Linux arm64 + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=arm64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_arm64 ./cmd/fetch-tsa-certs + +.PHONY: fetch-tsa-certs-linux-ppc64le +fetch-tsa-certs-linux-ppc64le: ## Build for Linux ppc64le + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=ppc64le go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_ppc64le ./cmd/fetch-tsa-certs + +.PHONY: fetch-tsa-certs-linux-s390x +fetch-tsa-certs-linux-s390x: ## Build for Linux s390x + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=linux GOARCH=s390x go build $(BUILD_FLAGS) -o fetch_tsa_certs_linux_s390x ./cmd/fetch-tsa-certs + +.PHONY: cross-platform cross-platform: fetch-tsa-certs-darwin-arm64 fetch-tsa-certs-darwin-amd64 fetch-tsa-certs-windows ## Build all distributable (cross-platform) binaries +.PHONY: all-platforms +all-platforms: fetch-tsa-certs-linux-amd64 fetch-tsa-certs-linux-arm64 fetch-tsa-certs-linux-ppc64le fetch-tsa-certs-linux-s390x cross-platform ## Build all binaries for all platforms + .PHONY: fetch-tsa-certs-darwin-arm64 fetch-tsa-certs-darwin-arm64: ## Build for mac M1 - env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_darwin_arm64 -trimpath ./cmd/fetch-tsa-certs + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=arm64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_darwin_arm64 ./cmd/fetch-tsa-certs .PHONY: fetch-tsa-certs-darwin-amd64 fetch-tsa-certs-darwin-amd64: ## Build for Darwin (macOS) - env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_darwin_amd64 -trimpath ./cmd/fetch-tsa-certs + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=darwin GOARCH=amd64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_darwin_amd64 ./cmd/fetch-tsa-certs .PHONY: fetch-tsa-certs-windows fetch-tsa-certs-windows: ## Build for Windows - env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build -mod=readonly -buildvcs=false -o fetch_tsa_certs_windows_amd64.exe -trimpath ./cmd/fetch-tsa-certs + env CGO_ENABLED=0 GOFIPS140=$(FIPS_MODULE) GOOS=windows GOARCH=amd64 go build $(BUILD_FLAGS) -o fetch_tsa_certs_windows_amd64.exe ./cmd/fetch-tsa-certs diff --git a/Dockerfile.cli-stack.rh b/Dockerfile.cli-stack.rh index 405b52229..376a4f69a 100644 --- a/Dockerfile.cli-stack.rh +++ b/Dockerfile.cli-stack.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS build-cross-platform +FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS build-all-platforms ENV APP_ROOT=/opt/app-root \ GOPATH=/opt/app-root @@ -7,46 +7,38 @@ WORKDIR $APP_ROOT/src ADD go.mod go.sum ./ ADD ./ ./ -RUN git config --global --add safe.directory /opt/app-root/src && \ - go mod download && \ - make -f Build.mak cross-platform - -FROM --platform=linux/amd64 quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-amd64 -FROM --platform=linux/arm64 quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-arm64 -FROM --platform=linux/ppc64le quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-ppc64le -FROM --platform=linux/s390x quay.io/securesign/fetch-tsa-certs@sha256:83b5762cd5c7a041727da61038215960dbb828fd93979140be1216f45e185253 AS build-s390x +RUN go mod download && \ + make -f Build.mak all-platforms FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS packager USER root RUN mkdir -p /binaries -# fetch_tsa_certs: Native Linux binaries from each arch variant -COPY --from=build-amd64 /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_amd64 /tmp/fetch_tsa_certs RUN tar -czf /binaries/fetch_tsa_certs_linux_amd64.tar.gz -C /tmp fetch_tsa_certs && \ rm /tmp/fetch_tsa_certs -COPY --from=build-arm64 /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_arm64 /tmp/fetch_tsa_certs RUN tar -czf /binaries/fetch_tsa_certs_linux_arm64.tar.gz -C /tmp fetch_tsa_certs && \ rm /tmp/fetch_tsa_certs -COPY --from=build-ppc64le /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_ppc64le /tmp/fetch_tsa_certs RUN tar -czf /binaries/fetch_tsa_certs_linux_ppc64le.tar.gz -C /tmp fetch_tsa_certs && \ rm /tmp/fetch_tsa_certs -COPY --from=build-s390x /usr/local/bin/fetch_tsa_certs /tmp/fetch_tsa_certs +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_linux_s390x /tmp/fetch_tsa_certs RUN tar -czf /binaries/fetch_tsa_certs_linux_s390x.tar.gz -C /tmp fetch_tsa_certs && \ rm /tmp/fetch_tsa_certs -# fetch_tsa_certs: Cross-compiled binaries -COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_darwin_amd64 /tmp/fetch_tsa_certs_darwin_amd64 +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_darwin_amd64 /tmp/fetch_tsa_certs_darwin_amd64 RUN tar -czf /binaries/fetch_tsa_certs_darwin_amd64.tar.gz -C /tmp fetch_tsa_certs_darwin_amd64 && \ rm /tmp/fetch_tsa_certs_darwin_amd64 -COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_darwin_arm64 /tmp/fetch_tsa_certs_darwin_arm64 +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_darwin_arm64 /tmp/fetch_tsa_certs_darwin_arm64 RUN tar -czf /binaries/fetch_tsa_certs_darwin_arm64.tar.gz -C /tmp fetch_tsa_certs_darwin_arm64 && \ rm /tmp/fetch_tsa_certs_darwin_arm64 -COPY --from=build-cross-platform /opt/app-root/src/fetch_tsa_certs_windows_amd64.exe /tmp/fetch_tsa_certs_windows_amd64.exe +COPY --from=build-all-platforms /opt/app-root/src/fetch_tsa_certs_windows_amd64.exe /tmp/fetch_tsa_certs_windows_amd64.exe RUN tar -czf /binaries/fetch_tsa_certs_windows_amd64.tar.gz -C /tmp fetch_tsa_certs_windows_amd64.exe && \ rm /tmp/fetch_tsa_certs_windows_amd64.exe @@ -65,6 +57,6 @@ LABEL com.redhat.component="fetch-tsa-certs-cli-stack" LABEL name="rhtas/fetch-tsa-certs-cli-stack" COPY --from=packager /binaries/ /binaries/ -COPY --from=build-amd64 /licenses/ /licenses/ +COPY --from=build-all-platforms /opt/app-root/src/LICENSE /licenses/license.txt USER 65532:65532 diff --git a/Dockerfile.fetch_tsa_certs.rh b/Dockerfile.fetch_tsa_certs.rh index df2340f0a..1c126e837 100644 --- a/Dockerfile.fetch_tsa_certs.rh +++ b/Dockerfile.fetch_tsa_certs.rh @@ -1,22 +1,14 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 as build-env -ENV APP_ROOT=/opt/app-root -ENV GOPATH=$APP_ROOT -ENV CGO_ENABLED=0 -ENV GOFIPS140=v1.0.0 -WORKDIR $APP_ROOT/src/ +ARG IMG=quay.io/securesign/fetch-tsa-certs-cli-stack:latest +FROM --platform=linux/amd64 ${IMG} AS cli-stack -ADD go.mod go.sum $APP_ROOT/src/ -RUN go mod download - -ADD ./cmd/ $APP_ROOT/src/cmd/ -ADD ./pkg/ $APP_ROOT/src/pkg/ -ADD ./Build.mak $APP_ROOT/src/Build.mak - -RUN make -f Build.mak fetch-tsa-certs-linux +FROM registry.redhat.io/ubi9/go-toolset:9.8@sha256:355b23fe885cf565c9313a7e98db742df0aec21456244e808942c56489594251 AS extractor +USER root +ARG TARGETARCH +COPY --from=cli-stack /binaries/ /tmp/binaries/ +RUN tar -xzf /tmp/binaries/fetch_tsa_certs_linux_${TARGETARCH}.tar.gz -C /tmp/ && \ + rm -rf /tmp/binaries FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:83006d535923fcf1345067873524a3980316f51794f01d8655be55d6e9387183 -ENV APP_ROOT=/opt/app-root -WORKDIR $APP_ROOT/src/ LABEL description="The fetch_tsa_certs binary is a cli used to configure the kms and tink signer types for Timestamp Authority." LABEL io.k8s.description="The fetch_tsa_certs binary is a cli used to configure the kms and tink signer types for Timestamp Authority." @@ -26,9 +18,8 @@ LABEL summary="Provides fetch_tsa_certs images." LABEL com.redhat.component="fetch_tsa_certs" LABEL name="rhtas/fetch-tsa-certs-rhel9" -COPY LICENSE /licenses/license.txt - -COPY --from=build-env $APP_ROOT/src/fetch_tsa_certs /usr/local/bin/fetch_tsa_certs +COPY --from=cli-stack /licenses/license.txt /licenses/license.txt +COPY --from=extractor /tmp/fetch_tsa_certs /usr/local/bin/fetch_tsa_certs USER 65532:65532