240 lines
8.6 KiB
Docker
240 lines
8.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# SPDX-License-Identifier: MIT
|
|
|
|
FROM golang:1.26.5-bookworm AS go-agent
|
|
|
|
ARG RMM_GOARCH=mipsle
|
|
ARG RMM_GOARM=7
|
|
ARG RMM_GOMIPS=softfloat
|
|
ARG RMM_GOAMD64=v1
|
|
|
|
WORKDIR /src
|
|
|
|
COPY go.mod go.sum ./
|
|
COPY agent/go agent/go
|
|
|
|
RUN export CGO_ENABLED=0 GOOS=linux GOARCH="${RMM_GOARCH}" \
|
|
&& case "${RMM_GOARCH}" in \
|
|
arm) export GOARM="${RMM_GOARM}" ;; \
|
|
mips|mipsle) export GOMIPS="${RMM_GOMIPS}" ;; \
|
|
amd64) export GOAMD64="${RMM_GOAMD64}" ;; \
|
|
esac \
|
|
&& mkdir /out \
|
|
&& go build -trimpath -ldflags="-s -w" \
|
|
-o /out/rmm-agent ./agent/go/cmd/rmm-agent
|
|
|
|
FROM debian:bookworm-slim AS sdk
|
|
|
|
ARG OPENWRT_SDK_URL="https://downloads.openwrt.org/releases/25.12.4/targets/ramips/mt7621/openwrt-sdk-25.12.4-ramips-mt7621_gcc-14.3.0_musl.Linux-x86_64.tar.zst"
|
|
ARG OPENWRT_SDK_SHA256="03f4766fcfbae86a814cbbf194226fa7e9ec66be2d4273bc1a0927a72a43a333"
|
|
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
|
|
build-essential \
|
|
ca-certificates \
|
|
curl \
|
|
file \
|
|
gawk \
|
|
gettext \
|
|
git \
|
|
libncurses-dev \
|
|
libssl-dev \
|
|
perl \
|
|
python3 \
|
|
python3-setuptools \
|
|
rsync \
|
|
unzip \
|
|
zstd \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd --create-home --uid 1000 builder
|
|
|
|
USER builder
|
|
WORKDIR /home/builder
|
|
|
|
RUN case "${OPENWRT_SDK_URL}" in \
|
|
*.tar.xz) sdk_archive="openwrt-sdk.tar.xz" ;; \
|
|
*.tar.zst) sdk_archive="openwrt-sdk.tar.zst" ;; \
|
|
*) echo "unsupported OpenWrt SDK URL: ${OPENWRT_SDK_URL}" >&2; exit 1 ;; \
|
|
esac \
|
|
&& curl --fail --location --show-error --silent \
|
|
--retry 5 --retry-all-errors --retry-delay 2 \
|
|
--output "${sdk_archive}" "${OPENWRT_SDK_URL}" \
|
|
&& echo "${OPENWRT_SDK_SHA256} ${sdk_archive}" | sha256sum --check --strict \
|
|
&& mkdir sdk \
|
|
&& case "${sdk_archive}" in \
|
|
*.tar.xz) tar --extract --xz --file "${sdk_archive}" --strip-components=1 --directory sdk ;; \
|
|
*.tar.zst) tar --extract --zstd --file "${sdk_archive}" --strip-components=1 --directory sdk ;; \
|
|
*) echo "unsupported OpenWrt SDK archive: ${sdk_archive}" >&2; exit 1 ;; \
|
|
esac \
|
|
&& rm "${sdk_archive}"
|
|
|
|
FROM sdk AS builder
|
|
|
|
ARG REQUIRE_NATIVE_SIGNATURE=false
|
|
ARG REPOSITORY_INDEX_REVISION=local
|
|
|
|
USER root
|
|
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends wget \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
USER builder
|
|
WORKDIR /home/builder/sdk
|
|
|
|
RUN ./scripts/feeds update -a \
|
|
&& for package_name in \
|
|
ca-bundle \
|
|
ip-tiny \
|
|
iwinfo \
|
|
luci-base \
|
|
mbedtls \
|
|
openssh-client \
|
|
openssh-keygen \
|
|
ubus \
|
|
uclient-fetch; \
|
|
do \
|
|
./scripts/feeds install "${package_name}"; \
|
|
done
|
|
|
|
COPY --chown=builder:builder agent/package/rmm-agent-go-production package/rmm-agent-go-production
|
|
COPY --from=go-agent --chown=builder:builder /out/rmm-agent package/rmm-agent-go-production/files/usr/bin/rmm-agent
|
|
|
|
RUN printf '%s\n' \
|
|
'# CONFIG_ALL is not set' \
|
|
'# CONFIG_ALL_KMODS is not set' \
|
|
'# CONFIG_ALL_NONSHARED is not set' \
|
|
'CONFIG_PACKAGE_libmbedtls=y' \
|
|
'CONFIG_PACKAGE_libustream-mbedtls=y' \
|
|
'CONFIG_PACKAGE_rmm-agent-go-production=m' \
|
|
> .config \
|
|
&& make defconfig \
|
|
&& awk ' \
|
|
/^CONFIG_PACKAGE_(ca-bundle|ip-tiny|iwinfo|libopenssl|openssh-client|openssh-keygen|rmm-agent-go-production|zlib)=m$/ { \
|
|
print; \
|
|
next; \
|
|
} \
|
|
/^CONFIG_PACKAGE_[^=]+=m$/ { \
|
|
split($0, parts, "="); \
|
|
print "# " parts[1] " is not set"; \
|
|
next; \
|
|
} \
|
|
{ print; } \
|
|
' .config > .config.packages-pruned \
|
|
&& mv .config.packages-pruned .config \
|
|
&& grep -q '^CONFIG_PACKAGE_rmm-agent-go-production=m$' .config
|
|
|
|
RUN make -j"$(nproc)" package/feeds/base/mbedtls/compile \
|
|
&& make -j"$(nproc)" package/feeds/base/ustream-ssl/compile
|
|
|
|
RUN if ! make -j"$(nproc)" package/rmm-agent-go-production/compile V=s \
|
|
> /tmp/rmm-openwrt-build.log 2>&1; then \
|
|
tail -n 400 /tmp/rmm-openwrt-build.log; \
|
|
exit 1; \
|
|
fi
|
|
|
|
COPY --chown=builder:builder agent/package/luci-app-rmm-agent package/luci-app-rmm-agent
|
|
|
|
RUN rm -rf tmp/info \
|
|
&& rm -f \
|
|
tmp/.config-package.in \
|
|
tmp/.packagedeps \
|
|
tmp/.packageinfo
|
|
|
|
RUN printf '%s\n' 'CONFIG_PACKAGE_luci-app-rmm-agent=m' >> .config \
|
|
&& make defconfig \
|
|
&& awk ' \
|
|
/^CONFIG_PACKAGE_(ca-bundle|ip-tiny|iwinfo|libopenssl|luci-app-rmm-agent|openssh-client|openssh-keygen|rmm-agent-go-production|zlib)=m$/ { \
|
|
print; \
|
|
next; \
|
|
} \
|
|
/^CONFIG_PACKAGE_[^=]+=m$/ { \
|
|
split($0, parts, "="); \
|
|
print "# " parts[1] " is not set"; \
|
|
next; \
|
|
} \
|
|
{ print; } \
|
|
' .config > .config.packages-pruned \
|
|
&& mv .config.packages-pruned .config \
|
|
&& grep -q '^CONFIG_PACKAGE_luci-app-rmm-agent=m$' .config
|
|
|
|
RUN make -j1 package/luci-app-rmm-agent/compile V=s
|
|
|
|
COPY --chown=builder:builder keys/openwrt /home/builder/release-keys
|
|
|
|
RUN --mount=type=secret,id=openwrt_usign_secret_b64,uid=1000,required=false \
|
|
--mount=type=secret,id=openwrt_apk_secret_b64,uid=1000,required=false \
|
|
set -eu; \
|
|
export PATH="/home/builder/sdk/staging_dir/host/bin:${PATH}"; \
|
|
test -n "${REPOSITORY_INDEX_REVISION}"; \
|
|
mkdir -p /home/builder/artifacts; \
|
|
find bin -type f \
|
|
\( -name 'luci-app-rmm-agent*.apk' \
|
|
-o -name 'luci-app-rmm-agent*.ipk' \
|
|
-o -name 'rmm-agent*.apk' \
|
|
-o -name 'rmm-agent*.ipk' \) \
|
|
-exec cp '{}' /home/builder/artifacts/ \;; \
|
|
test -n "$(find /home/builder/artifacts -maxdepth 1 -type f \( -name '*.apk' -o -name '*.ipk' \) -print -quit)"; \
|
|
cd /home/builder/artifacts; \
|
|
if find . -maxdepth 1 -type f -name '*.ipk' -print -quit | grep -q .; then \
|
|
MKHASH=/home/builder/sdk/staging_dir/host/bin/mkhash \
|
|
/home/builder/sdk/scripts/ipkg-make-index.sh . > Packages; \
|
|
gzip -9nc Packages > Packages.gz; \
|
|
test -s Packages; \
|
|
test -s Packages.gz; \
|
|
if [ -s /run/secrets/openwrt_usign_secret_b64 ]; then \
|
|
base64 -d /run/secrets/openwrt_usign_secret_b64 > /tmp/usign.sec; \
|
|
chmod 600 /tmp/usign.sec; \
|
|
/home/builder/sdk/staging_dir/host/bin/usign -S -m Packages \
|
|
-s /tmp/usign.sec -x Packages.sig; \
|
|
/home/builder/sdk/staging_dir/host/bin/usign -V -m Packages \
|
|
-x Packages.sig \
|
|
-p /home/builder/release-keys/usign/7fb0908fb6bc82c8; \
|
|
test -s Packages.sig; \
|
|
cp /home/builder/release-keys/usign/7fb0908fb6bc82c8 ./; \
|
|
rm -f /tmp/usign.sec; \
|
|
elif [ "${REQUIRE_NATIVE_SIGNATURE}" = "true" ]; then \
|
|
echo 'IPK release signing keys are required' >&2; \
|
|
exit 1; \
|
|
fi; \
|
|
else \
|
|
if [ -s /run/secrets/openwrt_apk_secret_b64 ]; then \
|
|
base64 -d /run/secrets/openwrt_apk_secret_b64 > /tmp/apk-signing.pem; \
|
|
chmod 600 /tmp/apk-signing.pem; \
|
|
/home/builder/sdk/staging_dir/host/bin/openssl ec \
|
|
-in /tmp/apk-signing.pem -pubout -out /tmp/apk-signing.pub.pem; \
|
|
cmp /tmp/apk-signing.pub.pem /home/builder/release-keys/apk/rmm-openwrt.pem; \
|
|
cp /home/builder/release-keys/apk/rmm-openwrt.pem ./; \
|
|
/home/builder/sdk/staging_dir/host/bin/apk mkndx \
|
|
--root /home/builder/sdk \
|
|
--keys-dir /home/builder/artifacts \
|
|
--allow-untrusted \
|
|
--sign /tmp/apk-signing.pem \
|
|
--output packages.adb \
|
|
./*.apk; \
|
|
rm -f /tmp/apk-signing.pem /tmp/apk-signing.pub.pem; \
|
|
elif [ "${REQUIRE_NATIVE_SIGNATURE}" = "true" ]; then \
|
|
echo 'APK release signing key is required' >&2; \
|
|
exit 1; \
|
|
else \
|
|
/home/builder/sdk/staging_dir/host/bin/apk mkndx \
|
|
--root /home/builder/sdk \
|
|
--keys-dir /home/builder/artifacts \
|
|
--allow-untrusted \
|
|
--output packages.adb \
|
|
./*.apk; \
|
|
fi; \
|
|
fi; \
|
|
find . -maxdepth 1 -type f \( \
|
|
-name '*.apk' -o -name '*.ipk' \
|
|
-o -name 'Packages' -o -name 'Packages.gz' -o -name 'Packages.sig' \
|
|
-o -name 'packages.adb' -o -name 'rmm-openwrt.pem' \
|
|
-o -name '????????????????' \) -print \
|
|
| LC_ALL=C sort \
|
|
| xargs sha256sum > SHA256SUMS; \
|
|
test -s SHA256SUMS
|
|
|
|
FROM scratch AS artifacts
|
|
|
|
COPY --from=builder /home/builder/artifacts/ /
|