unkin-agent
970cfad2ee
Replace the packer-images almalinux base with a Dockerfile matrix over distros/, publishing one image per distro to docker-internal on a single repo semver. - bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP - install the estate dnf repo configuration pointed at artifactapi - run in-image assertions as a --target test build stage - add pull_request build/test/pre-commit and tag-triggered docker workflows
1.4 KiB
container-base
The estate's base container images, one per distro, replacing what packer-images
built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>
— the image name is the distro (almalinux9), the repo's single semver is the tag.
| distro | image | from |
|---|---|---|
alma9 |
almalinux9 |
docker.io/almalinux:9 |
Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.
Adding a distro
distros/<name>/distro.env—BASE_IMAGE,IMAGE,CA_RPM_URL,CA_RPM_SHA256,PACKAGES.distros/<name>/yum.repos.d/*.repo— repository configuration for that distro.- One
includeentry in each of.woodpecker/{build,test,docker}.yaml.
pre-commit.sh fails if step 3 is forgotten.
CA bootstrap
unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The
pinned hash is the pkgid checksum recorded for the file in the repo's own repodata
(repodata/repomd.xml → *-primary.xml.gz).
Make
make build # build every distro
make test # build the test stage of every distro (assertions run in-image)
make build-alma9 # one distro
make patch|minor|major