cosign/Dockerfile.cli-stack.rh at main · securesign/cosign · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
FROM registry.redhat.io/ubi9/go-toolset:9.8-1783679445@sha256:ffc84dd3e27836987c95f9a33485c3aac784571a7ee9d13db51a690e5c27e30e AS build-cross-platform
ENV APP_ROOT=/opt/app-root \
    GOPATH=/opt/app-root

USER root
WORKDIR $APP_ROOT/src
ADD go.mod go.sum ./
ADD ./ ./

RUN git config --global --add safe.directory /opt/app-root/src && \
    git update-index --assume-unchanged Dockerfile.cosign.rh && \
    git update-index --assume-unchanged Dockerfile.cli-stack.rh && \
    go mod vendor && \
    make -f Build.mak cross-platform

FROM --platform=linux/amd64   quay.io/securesign/cli-cosign@sha256:8fd4bb8417aa96edf26b7589412f8f8cb2f79e86ba4039b802b90ccf62fb9874 AS build-amd64
FROM --platform=linux/arm64   quay.io/securesign/cli-cosign@sha256:01c85ceb3b98aeea2cd36adfc369b3b98e209aa8caa9a83d4aef641fed209482 AS build-arm64
FROM --platform=linux/ppc64le quay.io/securesign/cli-cosign@sha256:70914cf03ad27e419f19db9010ad997602e60f6bf4d3071ed1373ce46339d40a AS build-ppc64le
FROM --platform=linux/s390x   quay.io/securesign/cli-cosign@sha256:17d1889f9d97058e7c26f5b2a63189f3ce4ee6e3a8acabac5b87fa7f048d8dad AS build-s390x

FROM registry.redhat.io/ubi9/go-toolset:9.8-1783679445@sha256:ffc84dd3e27836987c95f9a33485c3aac784571a7ee9d13db51a690e5c27e30e AS packager
USER root
RUN mkdir -p /binaries

# cosign: Native Linux binaries from each arch variant
COPY --from=build-amd64 /usr/local/bin/cosign /tmp/cosign
RUN tar -czf /binaries/cosign_linux_amd64.tar.gz -C /tmp cosign && \
    rm /tmp/cosign

COPY --from=build-arm64 /usr/local/bin/cosign /tmp/cosign
RUN tar -czf /binaries/cosign_linux_arm64.tar.gz -C /tmp cosign && \
    rm /tmp/cosign

COPY --from=build-ppc64le /usr/local/bin/cosign /tmp/cosign
RUN tar -czf /binaries/cosign_linux_ppc64le.tar.gz -C /tmp cosign && \
    rm /tmp/cosign

COPY --from=build-s390x /usr/local/bin/cosign /tmp/cosign
RUN tar -czf /binaries/cosign_linux_s390x.tar.gz -C /tmp cosign && \
    rm /tmp/cosign

# cosign: Cross-compiled binaries
COPY --from=build-cross-platform /opt/app-root/src/cosign-darwin-amd64 /tmp/cosign
RUN tar -czf /binaries/cosign_darwin_amd64.tar.gz -C /tmp cosign && \
    rm /tmp/cosign

COPY --from=build-cross-platform /opt/app-root/src/cosign-darwin-arm64 /tmp/cosign
RUN tar -czf /binaries/cosign_darwin_arm64.tar.gz -C /tmp cosign && \
    rm /tmp/cosign

COPY --from=build-cross-platform /opt/app-root/src/cosign-windows-amd64.exe /tmp/cosign.exe
RUN tar -czf /binaries/cosign_windows_amd64.tar.gz -C /tmp cosign.exe && \
    rm /tmp/cosign.exe

RUN chmod -R a+rX /binaries

# Final minimal image with all binaries
FROM registry.redhat.io/ubi9/ubi-micro:9.8-1782840931@sha256:35de56a9413112f1474e392ebc35e0cf6f0fb484c8e8877bbae59b513694b41f

LABEL description="Flat image containing cosign CLI binaries for all platforms and architectures"
LABEL io.k8s.description="Flat image containing cosign CLI binaries for all platforms and architectures"
LABEL io.opencontainers.image.description="Flat image containing cosign CLI binaries for all platforms and architectures"
LABEL io.k8s.display-name="Cosign CLI stack image for Red Hat Trusted Artifact Signer"
LABEL io.openshift.tags="cosign trusted-artifact-signer cli-stack"
LABEL summary="Provides all cosign CLI binaries as tar.gz archives for CDN distribution."
LABEL com.redhat.component="cosign-cli-stack"
LABEL name="rhtas/cosign-cli-stack"

COPY --from=packager /binaries/ /binaries/
COPY --from=build-amd64 /licenses/ /licenses/

USER 65532:65532