Git-Mirrors/qubes-mirage-firewall
1
0
Fork 0
mirror of https://github.com/mirage/qubes-mirage-firewall.git synced 2024-10-01 01:05:39 -04:00
Code Issues Packages Projects Releases Wiki Activity
acac245840
qubes-mirage-firewall/Dockerfile

36 lines
2.3 KiB
Docker
Raw Normal View History

Pin Docker base image to a specific hash Requested by Joanna Rutkowska.
2017-01-31 04:26:57 -05:00
# Pin the base image to a specific hash for maximum reproducibility.
Switch Docker base image from Alpine to Fedora There seems to be a problem with Xen events getting lost on Alpine.
2020-10-26 11:19:30 -04:00
# It will probably still work on newer images, though, unless an update
Pin Docker base image to a specific hash Requested by Joanna Rutkowska.
2017-01-31 04:26:57 -05:00
# changes some compiler optimisations (unlikely).
change snapshots for debian ones
2023-11-07 07:47:12 -05:00
# bookworm-slim taken from https://hub.docker.com/_/debian/tags?page=1&name=bookworm-slim
update the compilation toolchain, including upgrade to mirage 4.5.0
2024-04-23 12:10:32 -04:00
FROM debian@sha256:3d5df92588469a4c503adbead0e4129ef3f88e223954011c2169073897547cac
check opam hashsum in Dockerfile
2023-11-09 08:41:16 -05:00
# install remove default packages repository
change snapshots for debian ones
2023-11-07 07:47:12 -05:00
RUN rm /etc/apt/sources.list.d/debian.sources
update build script
2023-04-18 05:46:45 -04:00
# and set the package source to a specific release too
change snapshots for debian ones
2023-11-07 07:47:12 -05:00
# taken from https://snapshot.debian.org/archive/debian
update the compilation toolchain, including upgrade to mirage 4.5.0
2024-04-23 12:10:32 -04:00
RUN printf "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20240419T024211Z bookworm main\n" > /etc/apt/sources.list
change snapshots for debian ones
2023-11-07 07:47:12 -05:00
# taken from https://snapshot.debian.org/archive/debian-security/
update the compilation toolchain, including upgrade to mirage 4.5.0
2024-04-23 12:10:32 -04:00
RUN printf "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20240419T111010Z bookworm-security main\n" >> /etc/apt/sources.list
update docker build for mirage 4.2
2022-08-09 08:16:16 -04:00
update build script
2023-04-18 05:46:45 -04:00
RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip bzip2 make gcc g++ libc-dev
Apply suggestions from code review
2023-07-05 11:06:00 -04:00
RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.1.5/opam-2.1.5-i686-linux && chmod 755 /usr/bin/opam
check opam hashsum in Dockerfile
2023-11-09 08:41:16 -05:00
# taken from https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh
RUN test `sha512sum /usr/bin/opam | cut -d' ' -f1` = \
"38802b3079eeceb27aab3465bfd0f9f05a710dccf9487eb35fa2c02fbaf9a0659e1447aa19dd36df9cd01f760229de28c523c08c1c86a3aa3f5e25dbe7b551dd" || exit
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building.
2017-01-28 08:44:21 -05:00
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker
2022-11-13 06:22:59 -05:00
ENV OPAMROOT=/tmp
ENV OPAMCONFIRMLEVEL=unsafe-yes
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building.
2017-01-28 08:44:21 -05:00
# Pin last known-good version for reproducible builds.
Pin Docker base image to a specific hash Requested by Joanna Rutkowska.
2017-01-31 04:26:57 -05:00
# Remove this line (and the base image pin above) if you want to test with the
# latest versions.
change snapshots for debian ones
2023-11-07 07:47:12 -05:00
# taken from https://github.com/ocaml/opam-repository
update the compilation toolchain, including upgrade to mirage 4.5.0
2024-04-23 12:10:32 -04:00
RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#4399f486aa6edefdc96d5e206a65ce42288ebfdd
update build script
2023-04-18 05:46:45 -04:00
RUN opam switch create myswitch 4.14.1
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker
2022-11-13 06:22:59 -05:00
RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5
RUN mkdir /tmp/orb-build
ADD config.ml /tmp/orb-build/config.ml
WORKDIR /tmp/orb-build
pin to specific overlays hashes
2023-11-08 04:20:59 -05:00
CMD opam exec -- sh -exc 'mirage configure -t xen --extra-repos=\
update the compilation toolchain, including upgrade to mirage 4.5.0
2024-04-23 12:10:32 -04:00
opam-overlays:https://github.com/dune-universe/opam-overlays.git#4e75ee36715b27550d5bdb87686bb4ae4c9e89c4,\
mirage-overlays:https://github.com/dune-universe/mirage-opam-overlays.git#797cb363df3ff763c43c8fbec5cd44de2878757e \
&& make depend && make tar'
Reference in New Issue Copy Permalink