diff --git a/.woodpecker/build-matrix.yaml b/.woodpecker/build-matrix.yaml new file mode 100644 index 0000000..69fbc9e --- /dev/null +++ b/.woodpecker/build-matrix.yaml @@ -0,0 +1,44 @@ +when: + - event: pull_request + +matrix: + include: + # One entry per distro. Adding a distro: add distros// and one entry here. + # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it. + - DISTRO: alma9 + IMAGE: almalinux9 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" + - DISTRO: fedora42 + IMAGE: fedora42 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" + - DISTRO: fedora43 + IMAGE: fedora43 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" + - DISTRO: fedora44 + IMAGE: fedora44 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" + +steps: + - name: build + image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" + settings: + # registry is what gets the internal CA into the buildkit container: the plugin + # writes a buildkit.toml pointing at /etc/docker/certs.d//ca.crt only + # when it is set. The plugin has no buildkit_config setting. + registry: artifactapi.k8s.syd1.au.unkin.net + repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}" + target: image + dry_run: true + build_args: + BASE_IMAGE: "${BASE_IMAGE}" + DISTRO: "${DISTRO}" + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 1Gi + cpu: 1 + limits: + memory: 4Gi + cpu: 2 diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml index 6293f10..f027c7b 100644 --- a/.woodpecker/build.yaml +++ b/.woodpecker/build.yaml @@ -1,35 +1,22 @@ +# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/. when: - event: pull_request -matrix: - include: - # One entry per distro. Adding a distro: add distros// and one entry here. - # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it. - - DISTRO: alma9 - IMAGE: almalinux9 - BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" +depends_on: + - build-matrix steps: - name: build image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" - settings: - # registry is what gets the internal CA into the buildkit container: the plugin - # writes a buildkit.toml pointing at /etc/docker/certs.d//ca.crt only - # when it is set. The plugin has no buildkit_config setting. - registry: artifactapi.k8s.syd1.au.unkin.net - repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}" - target: image - dry_run: true - build_args: - BASE_IMAGE: "${BASE_IMAGE}" - DISTRO: "${DISTRO}" + commands: + - echo "all build-matrix entries passed" backend_options: kubernetes: serviceAccountName: default resources: requests: - memory: 1Gi - cpu: 1 + memory: 64Mi + cpu: 100m limits: - memory: 4Gi - cpu: 2 + memory: 128Mi + cpu: 250m diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml index fa6f51f..f58416d 100644 --- a/.woodpecker/docker.yaml +++ b/.woodpecker/docker.yaml @@ -9,6 +9,15 @@ matrix: - DISTRO: alma9 IMAGE: almalinux9 BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" + - DISTRO: fedora42 + IMAGE: fedora42 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" + - DISTRO: fedora43 + IMAGE: fedora43 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" + - DISTRO: fedora44 + IMAGE: fedora44 + BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" steps: - name: docker diff --git a/Dockerfile b/Dockerfile index 65bf7de..5df4434 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,7 @@ ARG DISTRO=alma9 COPY distros/${DISTRO}/ /tmp/distro/ # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the -# pipeline's, and set -e catches it. +# pipeline's, and set -e catches it. zchunk is off because artifactapi ignores Range requests. # hadolint ignore=DL3041,DL4006,SC2086 RUN set -eux; \ . /tmp/distro/distro.env; \ @@ -14,6 +14,7 @@ RUN set -eux; \ echo "$CA_RPM_SHA256 /tmp/ca.rpm" | sha256sum -c -; \ rpm -i /tmp/ca.rpm; \ cp /tmp/distro/yum.repos.d/*.repo /etc/yum.repos.d/; \ + sed -i '/^\[main\]/a zchunk=False' /etc/dnf/dnf.conf; \ dnf makecache; \ dnf update -y; \ dnf install -y $PACKAGES; \ diff --git a/README.md b/README.md index 1ba8650..a7fc05e 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,9 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/:< | distro | image | from | | --- | --- | --- | | `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` | +| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` | +| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` | +| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` | Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set. @@ -15,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set. 1. `distros//distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`. 2. `distros//yum.repos.d/*.repo` — repository configuration for that distro. -3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`. +3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`. The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete. diff --git a/ci/check-distros.sh b/ci/check-distros.sh index 838475b..4af7078 100755 --- a/ci/check-distros.sh +++ b/ci/check-distros.sh @@ -4,7 +4,7 @@ set -uo pipefail KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES" -WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml) +WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml) fail=0 for d in distros/*/; do diff --git a/distros/fedora42/distro.env b/distros/fedora42/distro.env new file mode 100644 index 0000000..5fbab43 --- /dev/null +++ b/distros/fedora42/distro.env @@ -0,0 +1,13 @@ +# fedora42 — Fedora 42 +# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42" +IMAGE="fedora42" + +# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f42 repodata pkgid. +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/Packages/unkin-ca-certificates-2026.10.2-1.fc42.x86_64.rpm" +CA_RPM_SHA256="4c93bc95e0365565ee708247b9593997131d647d40a69e6f8bf9482f21026f9a" + +# Estate local repo used to prove HTTPS trust and dnf reachability. +ESTATE_REPO="rpm-vendor-f42" + +PACKAGES="git jq make python3 python3-pip wget" diff --git a/distros/fedora42/yum.repos.d/fedora.repo b/distros/fedora42/yum.repos.d/fedora.repo new file mode 100644 index 0000000..529d3cb --- /dev/null +++ b/distros/fedora42/yum.repos.d/fedora.repo @@ -0,0 +1,13 @@ +[fedora] +name=Fedora 42 - x86_64 +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/releases/42/Everything/x86_64/os +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary +enabled=1 +gpgcheck=1 + +[updates] +name=Fedora 42 - x86_64 - Updates +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/updates/42/Everything/x86_64 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary +enabled=1 +gpgcheck=1 diff --git a/distros/fedora42/yum.repos.d/unkin.repo b/distros/fedora42/yum.repos.d/unkin.repo new file mode 100644 index 0000000..0690831 --- /dev/null +++ b/distros/fedora42/yum.repos.d/unkin.repo @@ -0,0 +1,27 @@ +[rpm-internal-f42] +name=rpm-internal-f42 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f42/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor-f42] +name=rpm-vendor-f42 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-internal] +name=rpm-internal repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor] +name=rpm-vendor repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/ +enabled=1 +gpgcheck=0 +metadata_expire=60 diff --git a/distros/fedora43/distro.env b/distros/fedora43/distro.env new file mode 100644 index 0000000..b69f8a0 --- /dev/null +++ b/distros/fedora43/distro.env @@ -0,0 +1,13 @@ +# fedora43 — Fedora 43 +# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43" +IMAGE="fedora43" + +# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f43 repodata pkgid. +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/Packages/unkin-ca-certificates-2026.10.2-1.fc43.x86_64.rpm" +CA_RPM_SHA256="5c80725659a0cd4228cf834dced0025ceac34f042a1715faff72a68363f61404" + +# Estate local repo used to prove HTTPS trust and dnf reachability. +ESTATE_REPO="rpm-vendor-f43" + +PACKAGES="git jq make python3 python3-pip wget" diff --git a/distros/fedora43/yum.repos.d/fedora.repo b/distros/fedora43/yum.repos.d/fedora.repo new file mode 100644 index 0000000..264c7aa --- /dev/null +++ b/distros/fedora43/yum.repos.d/fedora.repo @@ -0,0 +1,13 @@ +[fedora] +name=Fedora 43 - x86_64 +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/43/Everything/x86_64/os +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary +enabled=1 +gpgcheck=1 + +[updates] +name=Fedora 43 - x86_64 - Updates +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/43/Everything/x86_64 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary +enabled=1 +gpgcheck=1 diff --git a/distros/fedora43/yum.repos.d/unkin.repo b/distros/fedora43/yum.repos.d/unkin.repo new file mode 100644 index 0000000..9c916af --- /dev/null +++ b/distros/fedora43/yum.repos.d/unkin.repo @@ -0,0 +1,27 @@ +[rpm-internal-f43] +name=rpm-internal-f43 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f43/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor-f43] +name=rpm-vendor-f43 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-internal] +name=rpm-internal repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor] +name=rpm-vendor repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/ +enabled=1 +gpgcheck=0 +metadata_expire=60 diff --git a/distros/fedora44/distro.env b/distros/fedora44/distro.env new file mode 100644 index 0000000..841cb77 --- /dev/null +++ b/distros/fedora44/distro.env @@ -0,0 +1,13 @@ +# fedora44 — Fedora 44 +# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44" +IMAGE="fedora44" + +# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f44 repodata pkgid. +CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm" +CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd" + +# Estate local repo used to prove HTTPS trust and dnf reachability. +ESTATE_REPO="rpm-vendor-f44" + +PACKAGES="git jq make python3 python3-pip wget" diff --git a/distros/fedora44/yum.repos.d/fedora.repo b/distros/fedora44/yum.repos.d/fedora.repo new file mode 100644 index 0000000..0c5c171 --- /dev/null +++ b/distros/fedora44/yum.repos.d/fedora.repo @@ -0,0 +1,13 @@ +[fedora] +name=Fedora 44 - x86_64 +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/44/Everything/x86_64/os +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary +enabled=1 +gpgcheck=1 + +[updates] +name=Fedora 44 - x86_64 - Updates +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/44/Everything/x86_64 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary +enabled=1 +gpgcheck=1 diff --git a/distros/fedora44/yum.repos.d/unkin.repo b/distros/fedora44/yum.repos.d/unkin.repo new file mode 100644 index 0000000..f51a6fc --- /dev/null +++ b/distros/fedora44/yum.repos.d/unkin.repo @@ -0,0 +1,27 @@ +[rpm-internal-f44] +name=rpm-internal-f44 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f44/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor-f44] +name=rpm-vendor-f44 repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-internal] +name=rpm-internal repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/ +enabled=1 +gpgcheck=0 +metadata_expire=60 + +[rpm-vendor] +name=rpm-vendor repository +baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/ +enabled=1 +gpgcheck=0 +metadata_expire=60