james.maesandClaude Sonnet 5.5
e19feb01a8
Both Dockerfiles copied 0.1.0-SNAPSHOT jars that the reactor no longer produces
(version is ${revision}), so neither built a released version. They now resolve the
released qbit-document-renderer and qqq-remote-renderer-transport (and their runtime
libraries) at an exact, required RENDERER_VERSION / TRANSPORT_VERSION from the
QRun-IO Gitea Maven registry and Maven Central, refusing SNAPSHOT and local
(*forge*) versions. The reviewed hardening is unchanged: digest-pinned
BUILD_IMAGE/JAVA_IMAGE, non-root 65532, read-only-root friendly, Zint built from
vendor/. The reactor build context is no longer needed.
Adds IMAGE-PUBLISH.md (repeatable build/scan/publish steps and the 1.0.0 pins) and
image-pins.sh (prints the gg-forge-cd classpath and SHA256 pins from a published
image). Images for 1.0.0 were built, smoke-tested over mTLS and published to GHCR
under gg-engineering by hand; no workflow publishes images.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
26 lines
1.2 KiB
Bash
26 lines
1.2 KiB
Bash
#!/bin/sh
|
|
# Print the gg-forge-cd echoRenderer.* pins (non-secret) for a PUBLISHED service image, read from the image itself:
|
|
# sh renderer/image-pins.sh ghcr.io/gg-engineering/qqq-remote-renderer@sha256:<manifest digest>
|
|
# The classpath is /renderer/renderer.jar followed by /renderer/lib/*.jar in byte order; hashes are SHA256 of the files in the image.
|
|
set -eu
|
|
image=${1:?image reference by digest required}
|
|
case "$image" in *@sha256:*) ;; *) echo 'Reference the image by @sha256: digest' >&2; exit 2;; esac
|
|
repository=${image%@*}
|
|
digest=${image#*@}
|
|
docker pull "$image" >/dev/null
|
|
image_id=$(docker image inspect "$image" --format '{{.Id}}')
|
|
echo "echoRenderer:"
|
|
echo " image:"
|
|
echo " repository: $repository"
|
|
echo " digest: $digest"
|
|
echo " imageId: $image_id"
|
|
docker run --rm --pull never --network none --user 65532:65532 --entrypoint sh "$image" -c '
|
|
set -eu
|
|
echo " classpath:"
|
|
echo " - /renderer/renderer.jar"
|
|
for f in $(LC_ALL=C ls /renderer/lib/*.jar); do echo " - $f"; done
|
|
echo " fileHashes:"
|
|
for f in /opt/java/openjdk/bin/java /renderer/renderer.jar /usr/local/bin/zint /usr/share/doc/qqq-zint/patchset-id.txt $(LC_ALL=C ls /renderer/lib/*.jar); do
|
|
printf " %s: %s\n" "$f" "$(sha256sum "$f" | cut -d" " -f1)"
|
|
done'
|