Skip to content

Commit a2bbf8c

Browse files
sampras343sampras343
committed
add cli-stack for binary distribution
Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
1 parent b409e59 commit a2bbf8c

4 files changed

Lines changed: 174 additions & 0 deletions

File tree

‎.tekton/cli-v08-push.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ apiVersion: tekton.dev/v1
22
kind: PipelineRun
33
metadata:
44
annotations:
5+
build.appstudio.openshift.io/build-nudge-files: "Dockerfile.cli-stack.rh"
56
build.appstudio.openshift.io/repo: https://github.com/conforma/cli?rev={{revision}}
67
build.appstudio.redhat.com/commit_sha: '{{revision}}'
78
build.appstudio.redhat.com/target_branch: '{{target_branch}}'

‎.tekton/conforma-cli-stack-pull-request.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
apiVersion: tekton.dev/v1
2+
kind: PipelineRun
3+
metadata:
4+
annotations:
5+
build.appstudio.openshift.io/repo: https://github.com/conforma/cli?rev={{revision}}
6+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
7+
build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
8+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
9+
pipelinesascode.tekton.dev/max-keep-runs: "3"
10+
pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
11+
== "release-v0.8"
12+
creationTimestamp: null
13+
labels:
14+
appstudio.openshift.io/application: cli-stacks
15+
appstudio.openshift.io/component: conforma-cli-stack
16+
pipelines.appstudio.openshift.io/type: build
17+
name: conforma-cli-stack-on-pull-request
18+
namespace: rhtas-tenant
19+
spec:
20+
params:
21+
- name: release-version
22+
value: 1.4.0
23+
- name: dockerfile
24+
value: Dockerfile.cli-stack.rh
25+
- name: git-url
26+
value: '{{repo_url}}'
27+
- name: image-expires-after
28+
value: 5d
29+
- name: output-image
30+
value: quay.io/securesign/conforma-cli-stack:on-pr-{{revision}}
31+
- name: path-context
32+
value: .
33+
- name: revision
34+
value: '{{revision}}'
35+
- name: hermetic
36+
value: "true"
37+
- name: build-source-image
38+
value: "true"
39+
pipelineRef:
40+
params:
41+
- name: url
42+
value: https://github.com/securesign/pipelines.git
43+
- name: revision
44+
value: main
45+
- name: pathInRepo
46+
value: pipelines/docker-build-oci-ta.yaml
47+
resolver: git
48+
taskRunTemplate:
49+
serviceAccountName: build-pipeline-conforma-cli-stack
50+
workspaces:
51+
- name: git-auth
52+
secret:
53+
secretName: '{{ git_auth_secret }}'
54+
status: {}

‎.tekton/conforma-cli-stack-push.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: tekton.dev/v1
2+
kind: PipelineRun
3+
metadata:
4+
annotations:
5+
build.appstudio.openshift.io/repo: https://github.com/conforma/cli?rev={{revision}}
6+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
7+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
8+
pipelinesascode.tekton.dev/max-keep-runs: "3"
9+
pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
10+
== "release-v0.8"
11+
creationTimestamp: null
12+
labels:
13+
appstudio.openshift.io/application: cli-stacks
14+
appstudio.openshift.io/component: conforma-cli-stack
15+
pipelines.appstudio.openshift.io/type: build
16+
name: conforma-cli-stack-on-push
17+
namespace: rhtas-tenant
18+
spec:
19+
params:
20+
- name: release-version
21+
value: 1.4.0
22+
- name: dockerfile
23+
value: Dockerfile.cli-stack.rh
24+
- name: git-url
25+
value: '{{repo_url}}'
26+
- name: output-image
27+
value: quay.io/securesign/conforma-cli-stack:{{revision}}
28+
- name: path-context
29+
value: .
30+
- name: revision
31+
value: '{{revision}}'
32+
- name: hermetic
33+
value: "true"
34+
- name: build-source-image
35+
value: "true"
36+
pipelineRef:
37+
params:
38+
- name: url
39+
value: https://github.com/securesign/pipelines.git
40+
- name: revision
41+
value: main
42+
- name: pathInRepo
43+
value: pipelines/docker-build-oci-ta.yaml
44+
resolver: git
45+
taskRunTemplate:
46+
serviceAccountName: build-pipeline-conforma-cli-stack
47+
workspaces:
48+
- name: git-auth
49+
secret:
50+
secretName: '{{ git_auth_secret }}'
51+
status: {}

‎Dockerfile.cli-stack.rh‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Per-arch digests are managed by the Konflux nudge mechanism.
2+
# Replace placeholders with actual per-arch digests before first build.
3+
FROM --platform=linux/amd64 quay.io/redhat-user-workloads/rhtap-contract-tenant/ec-v08/cli-v08@sha256:REPLACE_AMD64 AS build-amd64
4+
FROM --platform=linux/arm64 quay.io/redhat-user-workloads/rhtap-contract-tenant/ec-v08/cli-v08@sha256:REPLACE_ARM64 AS build-arm64
5+
FROM --platform=linux/ppc64le quay.io/redhat-user-workloads/rhtap-contract-tenant/ec-v08/cli-v08@sha256:REPLACE_PPC64LE AS build-ppc64le
6+
FROM --platform=linux/s390x quay.io/redhat-user-workloads/rhtap-contract-tenant/ec-v08/cli-v08@sha256:REPLACE_S390X AS build-s390x
7+
8+
FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS packager
9+
USER root
10+
RUN mkdir -p /binaries
11+
12+
# Native Linux binaries from each arch variant
13+
COPY --from=build-amd64 /usr/local/bin/ec_linux_amd64.gz /tmp/ec_linux_amd64.gz
14+
RUN gzip -d /tmp/ec_linux_amd64.gz && \
15+
tar -czf /binaries/ec_linux_amd64.tar.gz -C /tmp ec_linux_amd64 && \
16+
rm /tmp/ec_linux_amd64
17+
18+
COPY --from=build-arm64 /usr/local/bin/ec_linux_arm64.gz /tmp/ec_linux_arm64.gz
19+
RUN gzip -d /tmp/ec_linux_arm64.gz && \
20+
tar -czf /binaries/ec_linux_arm64.tar.gz -C /tmp ec_linux_arm64 && \
21+
rm /tmp/ec_linux_arm64
22+
23+
COPY --from=build-ppc64le /usr/local/bin/ec_linux_ppc64le.gz /tmp/ec_linux_ppc64le.gz
24+
RUN gzip -d /tmp/ec_linux_ppc64le.gz && \
25+
tar -czf /binaries/ec_linux_ppc64le.tar.gz -C /tmp ec_linux_ppc64le && \
26+
rm /tmp/ec_linux_ppc64le
27+
28+
COPY --from=build-s390x /usr/local/bin/ec_linux_s390x.gz /tmp/ec_linux_s390x.gz
29+
RUN gzip -d /tmp/ec_linux_s390x.gz && \
30+
tar -czf /binaries/ec_linux_s390x.tar.gz -C /tmp ec_linux_s390x && \
31+
rm /tmp/ec_linux_s390x
32+
33+
# Cross-compiled binaries (same across all variants, taken from amd64)
34+
# Darwin amd64
35+
COPY --from=build-amd64 /usr/local/bin/ec_darwin_amd64.gz /tmp/ec_darwin_amd64.gz
36+
RUN gzip -d /tmp/ec_darwin_amd64.gz && \
37+
tar -czf /binaries/ec_darwin_amd64.tar.gz -C /tmp ec_darwin_amd64 && \
38+
rm /tmp/ec_darwin_amd64
39+
40+
# Darwin arm64
41+
COPY --from=build-amd64 /usr/local/bin/ec_darwin_arm64.gz /tmp/ec_darwin_arm64.gz
42+
RUN gzip -d /tmp/ec_darwin_arm64.gz && \
43+
tar -czf /binaries/ec_darwin_arm64.tar.gz -C /tmp ec_darwin_arm64 && \
44+
rm /tmp/ec_darwin_arm64
45+
46+
# Windows amd64
47+
COPY --from=build-amd64 /usr/local/bin/ec_windows_amd64.exe.gz /tmp/ec_windows_amd64.exe.gz
48+
RUN gzip -d /tmp/ec_windows_amd64.exe.gz && \
49+
tar -czf /binaries/ec_windows_amd64.tar.gz -C /tmp ec_windows_amd64.exe && \
50+
rm /tmp/ec_windows_amd64.exe
51+
52+
# Final minimal image with all binaries
53+
FROM registry.redhat.io/ubi9/ubi-minimal@sha256:69f5c9886ecb19b23e88275a5cd904c47dd982dfa370fbbd0c356d7b1047ef68
54+
55+
LABEL description="Flat image containing Conforma CLI binaries for all platforms and architectures"
56+
LABEL io.k8s.description="Flat image containing Conforma CLI binaries for all platforms and architectures"
57+
LABEL io.opencontainers.image.description="Flat image containing Conforma CLI binaries for all platforms and architectures"
58+
LABEL io.k8s.display-name="Conforma CLI stack image for Red Hat Trusted Artifact Signer"
59+
LABEL io.openshift.tags="conforma trusted-artifact-signer cli-stack"
60+
LABEL summary="Provides Conforma CLI binaries as tar.gz archives for CDN distribution."
61+
LABEL com.redhat.component="conforma-cli-stack"
62+
63+
COPY --from=packager /binaries/ /binaries/
64+
COPY --from=build-amd64 /licenses/ /licenses/
65+
66+
RUN chown -R root:0 /binaries && chmod -R g+r /binaries
67+
68+
USER 65532:65532

0 commit comments

Comments
 (0)