Archived
forge-recoveryandClaude Sonnet 5.5
2af1dcf3a2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
101 lines
6.7 KiB
Docker
101 lines
6.7 KiB
Docker
# Toolchain runtimes: one recipe, two build targets. `maven` adds the JDK and Maven, `node` adds Node and npm.
|
|
# Both inherit the published control image (minimal Ubuntu, Python, PyYAML, Git) and copy only the tool
|
|
# distributions out of the official source images. No OS package, library or file tree of a source image is
|
|
# inherited, and nothing is installed or downloaded when a pipeline runs. One image is built per catalog entry.
|
|
# The JavaScript-action runtime (a single `node` binary) is provided once, in the shared base stage, and is
|
|
# last on PATH so the toolchain's own `node` wins for builds. Build context is the repository root.
|
|
#
|
|
# CONTROL_IMAGE required, the published control image pinned as <name>@sha256:<digest>
|
|
# MAVEN_IMAGE source of the JDK and Maven (target maven); override per catalog entry
|
|
# NODE_IMAGE source of Node and npm (target node); override per catalog entry
|
|
# ACTIONS_NODE_IMAGE source of the JavaScript-action runtime, with ACTIONS_NODE_VERSION as its expected version
|
|
# Source-image defaults are the digests in base-image-pins.json. Every source image must be pinned by digest.
|
|
ARG CONTROL_IMAGE
|
|
ARG MAVEN_IMAGE=maven:3.9.11-eclipse-temurin-21@sha256:6fdc855a6ed81d288ca7ca37ac6ff5e9308b612485c0801d70b25a858c83d237
|
|
ARG NODE_IMAGE=node:22.20.0-bookworm@sha256:915acd9e9b885ead0c620e27e37c81b74c226e0e1c8177f37a60217b6eabb0d7
|
|
ARG ACTIONS_NODE_IMAGE=node:22.20.0-bookworm@sha256:915acd9e9b885ead0c620e27e37c81b74c226e0e1c8177f37a60217b6eabb0d7
|
|
ARG ACTIONS_NODE_VERSION=22.20.0
|
|
|
|
FROM ${MAVEN_IMAGE} AS maven-source
|
|
FROM ${NODE_IMAGE} AS node-source
|
|
FROM ${ACTIONS_NODE_IMAGE} AS actions-node-source
|
|
|
|
# Patched tool distributions (see runtime/TOOL-SECURITY.md). This stage only builds /out; it is never shipped.
|
|
# Downloads use the control image's Python standard library and are verified against upstream checksums.
|
|
FROM ${CONTROL_IMAGE} AS patched-tools
|
|
COPY --from=maven-source /usr/share/maven/ /out/maven/
|
|
RUN set -eu; \
|
|
mkdir /download; \
|
|
python_fetch() { python3 -I -c 'import base64,hashlib,sys,urllib.request as u; url,algo,want,out=sys.argv[1:]; data=u.urlopen(url,timeout=60).read(); digest=hashlib.new(algo,data).digest(); got=digest.hex() if algo=="sha256" else base64.b64encode(digest).decode(); got==want or sys.exit(f"{url}: checksum mismatch, got {got}"); open(out,"wb").write(data)' "$@"; }; \
|
|
central=https://repo.maven.apache.org/maven2; registry=https://registry.npmjs.org; \
|
|
python_fetch "${central}/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar" sha256 b530942257fb935f8b2cfaa5f8eb5bd59c555fd8e8d01b8ce98912e077ea606c /download/guava-33.7.2-jre.jar; \
|
|
python_fetch "${central}/org/codehaus/plexus/plexus-utils/3.6.1/plexus-utils-3.6.1.jar" sha256 05a63effd67e2d6b9d610cc82e2bd7473289d34802e57a529b28110f28af5679 /download/plexus-utils-3.6.1.jar; \
|
|
python_fetch "${registry}/npm/-/npm-11.21.1.tgz" sha512 YTzL6QBEJXyHcTu0JiUc7RKMp+mzlJtl7rGLmERaXUQeFHIMc9atdr6G9M9C8vDWbv40epoTQAzNL2/PtZVDhQ== /download/npm-11.21.1.tgz; \
|
|
python_fetch "${registry}/undici/-/undici-6.29.1.tgz" sha512 EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA== /download/undici-6.29.1.tgz; \
|
|
lib=/out/maven/lib; \
|
|
test -f "${lib}/guava-33.4.8-jre.jar"; \
|
|
test -f "${lib}/plexus-utils-3.6.0.jar"; \
|
|
rm "${lib}/guava-33.4.8-jre.jar" "${lib}/plexus-utils-3.6.0.jar"; \
|
|
cp /download/guava-33.7.2-jre.jar /download/plexus-utils-3.6.1.jar "${lib}/"; \
|
|
test "$(find /out/maven -name 'guava-*.jar' | wc -l)" = 1; \
|
|
test "$(find /out/maven -name 'plexus-utils-*.jar' | wc -l)" = 1; \
|
|
mkdir /out/npm; \
|
|
tar -xzf /download/npm-11.21.1.tgz -C /out/npm --strip-components=1; \
|
|
grep -q '"version": "11.21.1"' /out/npm/package.json; \
|
|
grep -q '"version": "6.29.0"' /out/npm/node_modules/undici/package.json; \
|
|
rm -r /out/npm/node_modules/undici; \
|
|
mkdir /out/npm/node_modules/undici; \
|
|
tar -xzf /download/undici-6.29.1.tgz -C /out/npm/node_modules/undici --strip-components=1; \
|
|
grep -q '"version": "6.29.1"' /out/npm/node_modules/undici/package.json; \
|
|
test "$(find /out/npm -type d -name undici -path '*node_modules/undici' | wc -l)" = 1
|
|
|
|
FROM ${CONTROL_IMAGE} AS base
|
|
ARG CONTROL_IMAGE
|
|
ARG ACTIONS_NODE_IMAGE
|
|
ARG ACTIONS_NODE_VERSION
|
|
COPY --from=actions-node-source /usr/local/bin/node /opt/actions-node/bin/node
|
|
ENV PATH="${PATH}:/opt/actions-node/bin"
|
|
RUN set -eu; \
|
|
printf '%s' "${CONTROL_IMAGE}" | grep -Eq '@sha256:[0-9a-f]{64}$' || { echo 'CONTROL_IMAGE must be pinned by @sha256 digest' >&2; exit 1; }; \
|
|
printf '%s' "${ACTIONS_NODE_IMAGE}" | grep -Eq '@sha256:[0-9a-f]{64}$' || { echo 'ACTIONS_NODE_IMAGE must be pinned by @sha256 digest' >&2; exit 1; }; \
|
|
test "$(/opt/actions-node/bin/node --version)" = "v${ACTIONS_NODE_VERSION}"
|
|
LABEL io.platform-ci.control-image="${CONTROL_IMAGE}"
|
|
|
|
FROM base AS maven
|
|
ARG MAVEN_IMAGE
|
|
COPY --from=maven-source /opt/java/openjdk/ /opt/java/openjdk/
|
|
COPY --from=patched-tools /out/maven/ /usr/share/maven/
|
|
ENV JAVA_HOME=/opt/java/openjdk
|
|
ENV MAVEN_HOME=/usr/share/maven
|
|
ENV PATH="${JAVA_HOME}/bin:${MAVEN_HOME}/bin:${PATH}"
|
|
# Temurin's Ubuntu images point the JDK trust store at a file made by an OS Java package. That package is not
|
|
# installed here, so when the link has no target the store is built from the system CA certificates instead.
|
|
RUN set -eu; \
|
|
printf '%s' "${MAVEN_IMAGE}" | grep -Eq '@sha256:[0-9a-f]{64}$' || { echo 'MAVEN_IMAGE must be pinned by @sha256 digest' >&2; exit 1; }; \
|
|
store="${JAVA_HOME}/lib/security/cacerts"; \
|
|
if [ ! -e "${store}" ]; then \
|
|
rm -f "${store}"; \
|
|
mkdir /tmp/ca-split; \
|
|
csplit -s -z -f /tmp/ca-split/cert- /etc/ssl/certs/ca-certificates.crt '/-----BEGIN CERTIFICATE-----/' '{*}'; \
|
|
for certificate in /tmp/ca-split/cert-*; do \
|
|
keytool -importcert -noprompt -trustcacerts -storetype PKCS12 -keystore "${store}" -storepass changeit -alias "$(basename "${certificate}")" -file "${certificate}" >/dev/null; \
|
|
done; \
|
|
rm -rf /tmp/ca-split; \
|
|
fi; \
|
|
keytool -list -cacerts -storepass changeit | grep -q trustedCertEntry; \
|
|
java -version; \
|
|
mvn --version; \
|
|
mvn --version | grep -q 'Apache Maven 3.9.11'
|
|
|
|
FROM base AS node
|
|
ARG NODE_IMAGE
|
|
COPY --from=node-source /usr/local/bin/node /usr/local/bin/node
|
|
COPY --from=patched-tools /out/npm/ /usr/local/lib/node_modules/npm/
|
|
RUN set -eu; \
|
|
printf '%s' "${NODE_IMAGE}" | grep -Eq '@sha256:[0-9a-f]{64}$' || { echo 'NODE_IMAGE must be pinned by @sha256 digest' >&2; exit 1; }; \
|
|
ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm; \
|
|
ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx; \
|
|
test "$(npm --version)" = "11.21.1"; \
|
|
node --version; \
|
|
npm --version
|