-
Notifications
You must be signed in to change notification settings - Fork 513
/
Copy pathDockerfile
130 lines (121 loc) · 4.89 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
#
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
#
# PLEASE DO NOT EDIT IT DIRECTLY.
#
FROM buildpack-deps:bullseye-scm AS build
ENV PATH /usr/local/go/bin:$PATH
ENV GOLANG_VERSION 1.22.8
RUN set -eux; \
now="$(date '+%s')"; \
arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
url=; \
case "$arch" in \
'amd64') \
url='https://dl.google.com/go/go1.22.8.linux-amd64.tar.gz'; \
sha256='5f467d29fc67c7ae6468cb6ad5b047a274bae8180cac5e0b7ddbfeba3e47e18f'; \
;; \
'armhf') \
url='https://dl.google.com/go/go1.22.8.linux-armv6l.tar.gz'; \
sha256='5191e87a51a85d88edddc028ab30dfbfa2d7c37cf35d536655e7a063bfb2c9d2'; \
;; \
'arm64') \
url='https://dl.google.com/go/go1.22.8.linux-arm64.tar.gz'; \
sha256='5c616b32dab04bb8c4c8700478381daea0174dc70083e4026321163879278a4a'; \
;; \
'i386') \
url='https://dl.google.com/go/go1.22.8.linux-386.tar.gz'; \
sha256='0c8e9f824bf443f51e06ac017b9ae402ea066d761b309d880dbb2ca5793db8a2'; \
;; \
'mips64el') \
url='https://dl.google.com/go/go1.22.8.linux-mips64le.tar.gz'; \
sha256='34bc1c285189130d7e14daae7da90fa7fa392dc0b60d8fb2f54187850d859231'; \
;; \
'ppc64el') \
url='https://dl.google.com/go/go1.22.8.linux-ppc64le.tar.gz'; \
sha256='c546f27866510bf8e54e86fe6f58c705af0e894341e5572c91f197a734152c27'; \
;; \
'riscv64') \
url='https://dl.google.com/go/go1.22.8.linux-riscv64.tar.gz'; \
sha256='f53174ee946b206afe66e043646a6f37af9375d5a9ce420c0f974790508f9e39'; \
;; \
's390x') \
url='https://dl.google.com/go/go1.22.8.linux-s390x.tar.gz'; \
sha256='fabb3adc241474e28ae151a00e1421983deb35184d31cc76e90025b1b389f6bf'; \
;; \
*) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \
esac; \
\
wget -O go.tgz.asc "$url.asc"; \
wget -O go.tgz "$url" --progress=dot:giga; \
echo "$sha256 *go.tgz" | sha256sum -c -; \
\
# https://github.com/golang/go/issues/14739#issuecomment-324767697
GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
# https://www.google.com/linuxrepositories/
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 'EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796'; \
# let's also fetch the specific subkey of that key explicitly that we expect "go.tgz.asc" to be signed by, just to make sure we definitely have it
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys '2F52 8D36 D67B 69ED F998 D857 78BD 6547 3CB3 BD13'; \
gpg --batch --verify go.tgz.asc go.tgz; \
gpgconf --kill all; \
rm -rf "$GNUPGHOME" go.tgz.asc; \
\
tar -C /usr/local -xzf go.tgz; \
rm go.tgz; \
\
# save the timestamp from the tarball so we can restore it for reproducibility, if necessary (see below)
SOURCE_DATE_EPOCH="$(stat -c '%Y' /usr/local/go)"; \
export SOURCE_DATE_EPOCH; \
touchy="$(date -d "@$SOURCE_DATE_EPOCH" '+%Y%m%d%H%M.%S')"; \
# for logging validation/edification
date --date "@$SOURCE_DATE_EPOCH" --rfc-2822; \
# sanity check (detected value should be older than our wall clock)
[ "$SOURCE_DATE_EPOCH" -lt "$now" ]; \
\
if [ "$arch" = 'armhf' ]; then \
[ -s /usr/local/go/go.env ]; \
before="$(go env GOARM)"; [ "$before" != '7' ]; \
{ \
echo; \
echo '# https://github.com/docker-library/golang/issues/494'; \
echo 'GOARM=7'; \
} >> /usr/local/go/go.env; \
after="$(go env GOARM)"; [ "$after" = '7' ]; \
# (re-)clamp timestamp for reproducibility (allows "COPY --link" to be more clever/useful)
touch -t "$touchy" /usr/local/go/go.env /usr/local/go; \
fi; \
\
# ideally at this point, we would just "COPY --link ... /usr/local/go/ /usr/local/go/" but BuildKit insists on creating the parent directories (perhaps related to https://github.com/opencontainers/image-spec/pull/970), and does so with unreproducible timestamps, so we instead create a whole new "directory tree" that we can "COPY --link" to accomplish what we want
mkdir /target /target/usr /target/usr/local; \
mv -vT /usr/local/go /target/usr/local/go; \
ln -svfT /target/usr/local/go /usr/local/go; \
touch -t "$touchy" /target/usr/local /target/usr /target; \
\
# smoke test
go version; \
# make sure our reproducibile timestamp is probably still correct (best-effort inline reproducibility test)
epoch="$(stat -c '%Y' /target/usr/local/go)"; \
[ "$SOURCE_DATE_EPOCH" = "$epoch" ]; \
find /target -newer /target/usr/local/go -exec sh -c 'ls -ld "$@" && exit "$#"' -- '{}' +
FROM buildpack-deps:bullseye-scm
# install cgo-related dependencies
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
g++ \
gcc \
libc6-dev \
make \
pkg-config \
; \
rm -rf /var/lib/apt/lists/*
ENV GOLANG_VERSION 1.22.8
# don't auto-upgrade the gotoolchain
# https://github.com/docker-library/golang/issues/472
ENV GOTOOLCHAIN=local
ENV GOPATH /go
ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH
# (see notes above about "COPY --link")
COPY --from=build --link /target/ /
RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH"
WORKDIR $GOPATH