tough/Dockerfile.cli-stack.rh at develop · securesign/tough · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
FROM --platform=linux/amd64   quay.io/securesign/cli-tuftool@sha256:a3e956432a3453483561a43c7f42e6d2402ea43ad55080743fb9e051eddfc431 AS build-amd64
FROM --platform=linux/arm64   quay.io/securesign/cli-tuftool@sha256:b81dd1cb039336808b07a8545caa998202484d94b01cee156fd13197158ed0c0 AS build-arm64
FROM --platform=linux/ppc64le quay.io/securesign/cli-tuftool@sha256:3cc7177c677f52459ef0c811a075f0e83a4b5577a704e4cda326b69dd59525d4 AS build-ppc64le
FROM --platform=linux/s390x   quay.io/securesign/cli-tuftool@sha256:4a63ab6911f97f42f2e7736946d2363b411657fef12cdef8d198696e1c230471 AS build-s390x

FROM registry.redhat.io/ubi9/go-toolset:latest@sha256:9ef42b045aaabcaff14b76c75c086ec1479fbc7502c0587efdcedb2d721c46e5 AS packager
USER root
RUN mkdir -p /binaries

COPY --from=build-amd64 /usr/bin/tuftool /tmp/tuftool
RUN tar -czf /binaries/tuftool_linux_amd64.tar.gz -C /tmp tuftool && \
    rm /tmp/tuftool

COPY --from=build-arm64 /usr/bin/tuftool /tmp/tuftool
RUN tar -czf /binaries/tuftool_linux_arm64.tar.gz -C /tmp tuftool && \
    rm /tmp/tuftool

COPY --from=build-ppc64le /usr/bin/tuftool /tmp/tuftool
RUN tar -czf /binaries/tuftool_linux_ppc64le.tar.gz -C /tmp tuftool && \
    rm /tmp/tuftool

COPY --from=build-s390x /usr/bin/tuftool /tmp/tuftool
RUN tar -czf /binaries/tuftool_linux_s390x.tar.gz -C /tmp tuftool && \
    rm /tmp/tuftool

# Final minimal image with all binaries
FROM registry.redhat.io/ubi9/ubi-minimal@sha256:463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c

LABEL description="Flat image containing tuftool CLI binary for CDN distribution"
LABEL io.k8s.description="Flat image containing tuftool CLI binary for CDN distribution"
LABEL io.opencontainers.image.description="Flat image containing tuftool CLI binary for CDN distribution"
LABEL io.k8s.display-name="Tuftool CLI stack image for Red Hat Trusted Artifact Signer"
LABEL io.openshift.tags="tuftool trusted-artifact-signer cli-stack"
LABEL summary="Provides tuftool CLI binary as tar.gz archive for CDN distribution."
LABEL com.redhat.component="tuftool-cli-stack"

COPY --from=packager /binaries/ /binaries/
COPY licenses/LICENSE-APACHE /licenses/license.txt

RUN chown -R root:0 /binaries && chmod -R g+r /binaries

USER 65532:65532