Git-Mirrors/qubes-mirage-firewall
1
0
Fork 0
mirror of https://github.com/mirage/qubes-mirage-firewall.git synced 2024-07-03 09:31:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
cbf6c8c941
qubes-mirage-firewall/Dockerfile

24 lines
1.3 KiB
Docker
Raw Normal View History

Pin Docker base image to a specific hash Requested by Joanna Rutkowska.
2017-01-31 09:26:57 +00:00
# Pin the base image to a specific hash for maximum reproducibility.
Switch Docker base image from Alpine to Fedora There seems to be a problem with Xen events getting lost on Alpine.
2020-10-26 15:19:30 +00:00
# It will probably still work on newer images, though, unless an update
Pin Docker base image to a specific hash Requested by Joanna Rutkowska.
2017-01-31 09:26:57 +00:00
# changes some compiler optimisations (unlikely).
update build script
2023-04-18 09:46:45 +00:00
# bookworm-slim
FROM debian@sha256:07c6cb2ae86479dcc1942a89b0a1f4049b6e9415f7de327ff641aed58b8e3100
# and set the package source to a specific release too
RUN echo deb http://snapshot.notset.fr/archive/debian/20230418T024659Z bookworm main > /etc/apt/sources.list
update docker build for mirage 4.2
2022-08-09 12:16:16 +00:00
update build script
2023-04-18 09:46:45 +00:00
RUN apt update && apt install --no-install-recommends --no-install-suggests -y wget ca-certificates git patch unzip bzip2 make gcc g++ libc-dev
RUN wget -O /usr/bin/opam https://github.com/ocaml/opam/releases/download/2.1.4/opam-2.1.4-i686-linux && chmod 755 /usr/bin/opam
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building.
2017-01-28 13:44:21 +00:00
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker
2022-11-13 11:22:59 +00:00
ENV OPAMROOT=/tmp
ENV OPAMCONFIRMLEVEL=unsafe-yes
Fix opam-repository commit for reproducible builds Also, display the actual and expected SHA hashes after building.
2017-01-28 13:44:21 +00:00
# Pin last known-good version for reproducible builds.
Pin Docker base image to a specific hash Requested by Joanna Rutkowska.
2017-01-31 09:26:57 +00:00
# Remove this line (and the base image pin above) if you want to test with the
# latest versions.
update build script
2023-04-18 09:46:45 +00:00
RUN opam init --disable-sandboxing -a --bare https://github.com/ocaml/opam-repository.git#28b35f67988702df5018fbf30d1c725734425670
RUN opam switch create myswitch 4.14.1
Reproducible build systems: use in GitHub action the build-with-docker.sh Also upload the artifact to GitHub action, and in addition use the same setup (ubuntu 20.04 image) and build directories as done on builds.robur.coop. Also use `strip` on the resulting binary to reduce it's size (since the debug section aren't mapped into the running unikernel, there's nothing we get from them -- also they are preserved (as .debug file) and uploaded to https://builds.robur.coop if one needs them). This entails binary reproducibility between the different systems: - a developer using ./build-with-docker.sh - GitHub action (run on every PR) - builds.robur.coop with the ubuntu-20.04 worker
2022-11-13 11:22:59 +00:00
RUN opam exec -- opam install -y mirage opam-monorepo ocaml-solo5
RUN mkdir /tmp/orb-build
ADD config.ml /tmp/orb-build/config.ml
WORKDIR /tmp/orb-build
CMD opam exec -- sh -exc 'mirage configure -t xen --allocation-policy=best-fit && make depend && make tar'
Reference in New Issue Copy Permalink