Skip to content

Commit acf6011

Browse files
jan-kiszkajan-kiszka
committed
scripts: Add scripts for building and reproducing kas containers
Provide a script to build container images reproducibly. A wrapper script around this allows to rebuild a specified image and check its identity. Signed-off-by: Jan Kiszka <[email protected]>
1 parent 3cf1f29 commit acf6011

File tree

3 files changed

+214
-1
lines changed

3 files changed

+214
-1
lines changed

‎scripts/build-container.sh

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
#!/bin/sh
2+
#
3+
# kas - setup tool for bitbake based projects
4+
#
5+
# Copyright (c) Siemens AG, 2024
6+
#
7+
# Authors:
8+
# Jan Kiszka <[email protected]>
9+
#
10+
# Permission is hereby granted, free of charge, to any person obtaining a copy
11+
# of this software and associated documentation files (the "Software"), to deal
12+
# in the Software without restriction, including without limitation the rights
13+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14+
# copies of the Software, and to permit persons to whom the Software is
15+
# furnished to do so, subject to the following conditions:
16+
#
17+
# The above copyright notice and this permission notice shall be
18+
# included in all copies or substantial portions of the Software.
19+
#
20+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
23+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26+
# SOFTWARE.
27+
28+
usage()
29+
{
30+
DEFAULT_DEBIAN_TAG=$(grep -m 1 'ARG DEBIAN_TAG=' "$(dirname "$0")/../Dockerfile" |
31+
sed 's/.*DEBIAN_TAG=\(.*\)-\(.*\)/\1-<LATEST>-\2/')
32+
33+
printf "%b" "Usage: $0 [OPTIONS]\n"
34+
printf "%b" "\nOptional arguments:\n"
35+
printf "%b" "--arch\t\tBuild for specified architecture, rather than the native one\n"
36+
printf "%b" "--clean\t\tRemove local images (ghcr.io/siemens/kas/TARGET:TAG) before\n" \
37+
"\t\tstarting the build and do not use image cache\n"
38+
printf "%b" "--debian-tag\tUse specified tag for Debian base image\n" \
39+
"\t\t(default=$DEFAULT_DEBIAN_TAG)\n"
40+
printf "%b" "--tag\t\tTag container with specified name (default=next)\n"
41+
printf "%b" "--target\tBuild specified target(s) (default=\"kas kas-isar\")\n"
42+
}
43+
44+
build_image()
45+
{
46+
IMAGE_NAME="ghcr.io/siemens/kas/$1:$TAG"
47+
48+
OLD_IMAGE_ID=$(docker images -q "$IMAGE_NAME" 2>/dev/null)
49+
50+
PLATFORM_OPT=
51+
if [ -n "$ARCH" ]; then
52+
PLATFORM_OPT="--platform linux/$ARCH"
53+
fi
54+
NOCHACHE_OPT=
55+
if [ "$CLEAN" = y ]; then
56+
NOCHACHE_OPT="--no-cache"
57+
fi
58+
# shellcheck disable=SC2086
59+
if ! docker buildx build --build-arg SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)" \
60+
--output type=docker,rewrite-timestamp=true \
61+
--tag "$IMAGE_NAME" --build-arg DEBIAN_TAG="$DEBIAN_TAG" \
62+
--target "$1" $PLATFORM_OPT $NOCHACHE_OPT .; then
63+
echo "Build failed!"
64+
return 1
65+
fi
66+
67+
if [ -n "$OLD_IMAGE_ID" ]; then
68+
if [ "$(docker images -q "$IMAGE_NAME")" = "$OLD_IMAGE_ID" ]; then
69+
echo "Reproduced identical image $IMAGE_NAME $OLD_IMAGE_ID"
70+
else
71+
echo "Deleting old image $OLD_IMAGE_ID"
72+
docker rmi "$OLD_IMAGE_ID"
73+
fi
74+
fi
75+
76+
return 0
77+
}
78+
79+
ARCH=
80+
CLEAN=
81+
DEBIAN_TAG=
82+
TARGETS=
83+
TAG=next
84+
while [ $# -gt 0 ]; do
85+
case "$1" in
86+
--arch)
87+
shift
88+
ARCH="$1"
89+
;;
90+
--clean)
91+
CLEAN=y
92+
;;
93+
--debian-tag)
94+
shift
95+
DEBIAN_TAG="$1"
96+
;;
97+
--tag)
98+
shift
99+
TAG="$1"
100+
;;
101+
--target)
102+
shift
103+
TARGETS="$TARGETS $1"
104+
;;
105+
*)
106+
usage
107+
exit 1
108+
esac
109+
shift
110+
done
111+
112+
TARGETS="${TARGETS:-kas kas-isar}"
113+
114+
if [ -z "$DEBIAN_TAG" ]; then
115+
DEBIAN_RELEASE=$(grep -m 1 'ARG DEBIAN_TAG=' "$(dirname "$0")/../Dockerfile" |
116+
sed 's/.*DEBIAN_TAG=\(.*\)-.*/\1/')
117+
DEBIAN_TAG=$(podman image search --list-tags debian --limit 1000000000 | \
118+
grep "$DEBIAN_RELEASE-.*-slim" | sort -r | head -1 | sed 's/.*[ ]\+//')
119+
fi
120+
121+
if [ "$CLEAN" = y ]; then
122+
for TARGET in $TARGETS; do
123+
docker rmi "ghcr.io/siemens/kas/$TARGET:$TAG" 2>/dev/null
124+
done
125+
fi
126+
127+
KAS_CLONE=$(mktemp -d --tmpdir kas-tmp.XXXXXXXXXX)
128+
git clone . "$KAS_CLONE"
129+
cd "$KAS_CLONE" || exit 1
130+
131+
RESULT=0
132+
for TARGET in $TARGETS; do
133+
if ! build_image "$TARGET"; then
134+
RESULT=1
135+
break
136+
fi
137+
done
138+
139+
cd - >/dev/null || exit 1
140+
rm -rf "$KAS_CLONE"
141+
142+
exit $RESULT

‎scripts/checkcode.sh

+6-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@ echo "Checking with doc8"
1818
doc8 "$SRCDIR"/docs --ignore-path "$SRCDIR"/docs/_build || ERROR=$((ERROR + 4))
1919

2020
echo "Checking with shellcheck"
21-
shellcheck "$SRCDIR"/kas-container "$SRCDIR"/scripts/release.sh "$SRCDIR"/scripts/checkcode.sh "$SRCDIR"/container-entrypoint || ERROR=$((ERROR + 8))
21+
shellcheck "$SRCDIR"/kas-container \
22+
"$SRCDIR"/scripts/release.sh \
23+
"$SRCDIR"/scripts/checkcode.sh \
24+
"$SRCDIR"/scripts/build-container.sh \
25+
"$SRCDIR"/scripts/reproduce-container.sh \
26+
"$SRCDIR"/container-entrypoint || ERROR=$((ERROR + 8))
2227

2328
exit $ERROR

‎scripts/reproduce-container.sh

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/bin/sh
2+
#
3+
# kas - setup tool for bitbake based projects
4+
#
5+
# Copyright (c) Siemens AG, 2024
6+
#
7+
# Authors:
8+
# Jan Kiszka <[email protected]>
9+
#
10+
# Permission is hereby granted, free of charge, to any person obtaining a copy
11+
# of this software and associated documentation files (the "Software"), to deal
12+
# in the Software without restriction, including without limitation the rights
13+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14+
# copies of the Software, and to permit persons to whom the Software is
15+
# furnished to do so, subject to the following conditions:
16+
#
17+
# The above copyright notice and this permission notice shall be
18+
# included in all copies or substantial portions of the Software.
19+
#
20+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
23+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26+
# SOFTWARE.
27+
28+
if [ -z "$1" ] || [ "$1" = "--help" ]; then
29+
echo "Usage: $0 kas[-isar]:<tag> [architecture]"
30+
exit 0
31+
fi
32+
33+
TARGET=$(echo "$1" | sed 's/:.*//')
34+
TAG=$(echo "$1" | sed 's/.*://')
35+
ARCH=$2
36+
37+
ARCH_OPT=
38+
PLATFORM_OPT=
39+
if [ -n "$ARCH" ]; then
40+
ARCH_OPT="--arch $ARCH"
41+
PLATFORM_OPT="--platform linux/$ARCH"
42+
fi
43+
44+
# shellcheck disable=SC2086
45+
DEBIAN_TAG=$(docker run --entrypoint "" --rm -t $PLATFORM_OPT \
46+
"ghcr.io/siemens/kas/$TARGET:$TAG" \
47+
sh -c 'printf "%b" $DEBIAN_BASE_IMAGE_TAG')
48+
if [ -z "$DEBIAN_TAG" ]; then
49+
echo "Cannot determine base image of ghcr.io/siemens/kas/$TARGET:$TAG"
50+
exit 1
51+
fi
52+
53+
# shellcheck disable=SC2086
54+
"$(dirname "$0")/build-container.sh" $ARCH_OPT --target "$TARGET" \
55+
--tag repro-test --debian-tag "$DEBIAN_TAG" --clean || exit 1
56+
57+
echo ""
58+
59+
docker images --digests | grep "^REPOSITORY\|^ghcr.io/siemens/kas/${TARGET}[ ]*\($TAG\|repro-test\)"
60+
printf "%b" "\nReproduction test "
61+
if [ "$(docker images -q "ghcr.io/siemens/kas/$1")" = "$(docker images -q "ghcr.io/siemens/kas/$TARGET:repro-test")" ]; then
62+
printf "%b" "SUCCEEDED\n"
63+
docker rmi "ghcr.io/siemens/kas/$TARGET:repro-test" >/dev/null
64+
else
65+
printf "%b" "FAILED\n"
66+
fi

0 commit comments

Comments
 (0)