20260710 安装包重建提交标识镜像

2026-07-10 16:00:51 +08:00
parent de4f40eb2c
commit ea6ac27b8d
10 changed files with 182 additions and 103 deletions
--- a/scripts/docker/build_docker_installer_package.sh
+++ b/scripts/docker/build_docker_installer_package.sh
@@ -5,10 +5,10 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

 TARGET_ARCH="${TARGET_ARCH:-}"
-IMAGE_TAG="${IMAGE_TAG:-}"
-IMAGE_TAR="${IMAGE_TAR:-}"
-METRICS_IMAGE="${METRICS_IMAGE:-}"
-METRICS_IMAGE_TAR="${METRICS_IMAGE_TAR:-}"
+IMAGE_TAG=""
+IMAGE_TAR=""
+METRICS_IMAGE=""
+METRICS_IMAGE_TAR=""
 PROMETHEUS_IMAGE="${PROMETHEUS_IMAGE:-prom/prometheus:v2.55.1}"
 PROMETHEUS_IMAGE_TAR="${PROMETHEUS_IMAGE_TAR:-}"
 GRAFANA_IMAGE="${GRAFANA_IMAGE:-grafana/grafana:11.3.1}"
@@ -16,6 +16,7 @@ GRAFANA_IMAGE_TAR="${GRAFANA_IMAGE_TAR:-}"
 OUT_DIR="${OUT_DIR:-}"
 PACKAGE_PREFIX="${PACKAGE_PREFIX:-}"
 TEMPLATE_DIR="${TEMPLATE_DIR:-$REPO_ROOT/deploy/docker-installer}"
+ALLOW_DIRTY=0

 usage() {
  cat <<'USAGE'
@@ -24,12 +25,6 @@ Usage:

 Options:
  --arch <arch>       Target architecture: amd64|arm64
-  --image <tag>       Runtime image tag recorded in package manifest.
-  --image-tar <path>  Existing docker save tar/tar.gz to include.
-  --metrics-image <tag>
-                      Metrics image tag recorded in package manifest.
-  --metrics-image-tar <path>
-                      Existing metrics docker save tar/tar.gz to include.
  --prometheus-image <tag>
                      Prometheus image tag to record and package.
  --prometheus-image-tar <path>
@@ -42,10 +37,13 @@ Options:
  --prefix <name>     Package directory/tar prefix.
  --template-dir <path>
                      Package template directory.
+  --allow-dirty       Allow a development build from a dirty worktree and mark
+                      image tags, package name and manifest as dirty.
  -h, --help          Show help.

-If --image-tar or --metrics-image-tar is omitted, the script uses the
-matching docker-save archive under target/<arch>-docker/.
+Every package rebuilds runtime and metrics images from the current HEAD. Their
+tags are ours-rp-runtime-<arch>:<git8> and ours-rp-metrics-<arch>:<git8>.
+External runtime/metrics image tags and tar archives are intentionally rejected.
 USAGE
 }

@@ -71,16 +69,20 @@ safe_tag_name() {
  printf '%s' "$1" | tr '/:' '--'
 }

-default_runtime_tag() {
-  printf 'ours-rp-runtime-%s:dev\n' "$1"
+runtime_image_tag() {
+  local arch="$1"
+  local revision="$2"
+  printf 'ours-rp-runtime-%s:%s\n' "$arch" "$revision"
 }

-default_metrics_tag() {
-  printf 'ours-rp-metrics-%s:dev\n' "$1"
+metrics_image_tag() {
+  local arch="$1"
+  local revision="$2"
+  printf 'ours-rp-metrics-%s:%s\n' "$arch" "$revision"
 }

 default_package_prefix() {
-  printf 'ours-rp-docker-installer-%s\n' "$1"
+  printf 'ours-rp-installer-%s\n' "$1"
 }

 default_host_data_dir() {
@@ -163,20 +165,10 @@ save_image_if_needed() {
  printf '%s\n' "$tar_path"
 }

-default_saved_image_tar() {
+image_label() {
  local image="$1"
-  local out_dir="$REPO_ROOT/target/${TARGET_ARCH}-docker"
-  local safe_name
-  safe_name="$(safe_tag_name "$image")"
-  if [[ -f "$out_dir/${safe_name}.tar.gz" ]]; then
-    printf '%s\n' "$out_dir/${safe_name}.tar.gz"
-    return 0
-  fi
-  if [[ -f "$out_dir/${safe_name}.tar" ]]; then
-    printf '%s\n' "$out_dir/${safe_name}.tar"
-    return 0
-  fi
-  printf '\n'
+  local key="$2"
+  docker image inspect --format "{{ index .Config.Labels \"$key\" }}" "$image"
 }

 while [[ $# -gt 0 ]]; do
@@ -188,21 +180,9 @@ while [[ $# -gt 0 ]]; do
      }
      shift 2
      ;;
-    --image)
-      IMAGE_TAG="$2"
-      shift 2
-      ;;
-    --image-tar)
-      IMAGE_TAR="$2"
-      shift 2
-      ;;
-    --metrics-image)
-      METRICS_IMAGE="$2"
-      shift 2
-      ;;
-    --metrics-image-tar)
-      METRICS_IMAGE_TAR="$2"
-      shift 2
+    --image|--image-tar|--metrics-image|--metrics-image-tar)
+      echo "$1 is no longer supported: installer packages always rebuild runtime and metrics images from current HEAD" >&2
+      exit 2
      ;;
    --prometheus-image)
      PROMETHEUS_IMAGE="$2"
@@ -232,6 +212,10 @@ while [[ $# -gt 0 ]]; do
      TEMPLATE_DIR="$2"
      shift 2
      ;;
+    --allow-dirty)
+      ALLOW_DIRTY=1
+      shift
+      ;;
    -h|--help)
      usage
      exit 0
@@ -255,12 +239,28 @@ done
  exit 2
 }

-if [[ -z "$IMAGE_TAG" ]]; then
-  IMAGE_TAG="$(default_runtime_tag "$TARGET_ARCH")"
+SOURCE_COMMIT_FULL="$(git -C "$REPO_ROOT" rev-parse HEAD)"
+SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 HEAD)"
+SOURCE_DIRTY="false"
+if [[ -n "$(git -C "$REPO_ROOT" status --short)" ]]; then
+  SOURCE_DIRTY="true"
 fi
-if [[ -z "$METRICS_IMAGE" ]]; then
-  METRICS_IMAGE="$(default_metrics_tag "$TARGET_ARCH")"
+if [[ "$SOURCE_DIRTY" == "true" && "$ALLOW_DIRTY" != "1" ]]; then
+  cat >&2 <<EOF
+refusing to build a release installer from a dirty worktree.
+  source_commit: $SOURCE_COMMIT_FULL
+Use --allow-dirty only for development verification; the package and image tags
+will be explicitly marked dirty.
+EOF
+  exit 2
 fi
+TIMESTAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+REVISION_TOKEN="$SOURCE_COMMIT_SHORT"
+if [[ "$SOURCE_DIRTY" == "true" ]]; then
+  REVISION_TOKEN="${REVISION_TOKEN}-dirty"
+fi
+IMAGE_TAG="$(runtime_image_tag "$TARGET_ARCH" "$REVISION_TOKEN")"
+METRICS_IMAGE="$(metrics_image_tag "$TARGET_ARCH" "$REVISION_TOKEN")"
 if [[ -z "$OUT_DIR" ]]; then
  OUT_DIR="$REPO_ROOT/target/${TARGET_ARCH}-installer"
 fi
@@ -272,37 +272,35 @@ TARGET_PLATFORM="$(platform_for_arch "$TARGET_ARCH")"
 HOST_DATA_DIR_DEFAULT="$(default_host_data_dir "$TARGET_ARCH")"
 COMPOSE_PROJECT_DEFAULT="$(default_compose_project "$TARGET_ARCH")"
 METRICS_INSTANCE_DEFAULT="$(default_metrics_instance "$TARGET_ARCH")"
-
-if [[ -z "$IMAGE_TAR" ]]; then
-  IMAGE_TAR="$(default_saved_image_tar "$IMAGE_TAG")"
-fi
-if [[ -z "$METRICS_IMAGE_TAR" ]]; then
-  METRICS_IMAGE_TAR="$(default_saved_image_tar "$METRICS_IMAGE")"
-fi
-
-[[ -n "$IMAGE_TAR" && -f "$IMAGE_TAR" ]] || {
-  cat >&2 <<EOF
-missing runtime image tar for $TARGET_ARCH.
-
-Build one first, for example:
-  scripts/docker/build_docker_runtime_image.sh --arch $TARGET_ARCH --image $IMAGE_TAG
-EOF
-  exit 2
-}
-[[ -n "$METRICS_IMAGE_TAR" && -f "$METRICS_IMAGE_TAR" ]] || {
-  cat >&2 <<EOF
-missing metrics image tar for $TARGET_ARCH.
-
-Build one first, for example:
-  scripts/docker/build_docker_metrics_image.sh --arch $TARGET_ARCH --image $METRICS_IMAGE
-EOF
-  exit 2
-}
+IMAGE_OUT_DIR="$REPO_ROOT/target/${TARGET_ARCH}-docker"

 mkdir -p "$OUT_DIR"
-commit="$(git -C "$REPO_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
-timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
-package_name="${PACKAGE_PREFIX}-${timestamp}-${commit}"
+echo "rebuilding runtime image: $IMAGE_TAG"
+"$SCRIPT_DIR/build_docker_runtime_image.sh" \
+  --arch "$TARGET_ARCH" \
+  --image "$IMAGE_TAG" \
+  --out-dir "$IMAGE_OUT_DIR"
+echo "rebuilding metrics image: $METRICS_IMAGE"
+"$SCRIPT_DIR/build_docker_metrics_image.sh" \
+  --arch "$TARGET_ARCH" \
+  --image "$METRICS_IMAGE" \
+  --out-dir "$IMAGE_OUT_DIR"
+
+IMAGE_TAR="$IMAGE_OUT_DIR/$(safe_tag_name "$IMAGE_TAG").tar.gz"
+METRICS_IMAGE_TAR="$IMAGE_OUT_DIR/$(safe_tag_name "$METRICS_IMAGE").tar.gz"
+[[ -f "$IMAGE_TAR" ]] || { echo "runtime image build did not produce $IMAGE_TAR" >&2; exit 2; }
+[[ -f "$METRICS_IMAGE_TAR" ]] || { echo "metrics image build did not produce $METRICS_IMAGE_TAR" >&2; exit 2; }
+
+runtime_image_revision="$(image_label "$IMAGE_TAG" "org.opencontainers.image.revision")"
+metrics_image_revision="$(image_label "$METRICS_IMAGE" "org.opencontainers.image.revision")"
+runtime_image_dirty="$(image_label "$IMAGE_TAG" "org.opencontainers.image.source-dirty")"
+metrics_image_dirty="$(image_label "$METRICS_IMAGE" "org.opencontainers.image.source-dirty")"
+[[ "$runtime_image_revision" == "$SOURCE_COMMIT_FULL" ]] || { echo "runtime image revision mismatch: $runtime_image_revision != $SOURCE_COMMIT_FULL" >&2; exit 2; }
+[[ "$metrics_image_revision" == "$SOURCE_COMMIT_FULL" ]] || { echo "metrics image revision mismatch: $metrics_image_revision != $SOURCE_COMMIT_FULL" >&2; exit 2; }
+[[ "$runtime_image_dirty" == "$SOURCE_DIRTY" ]] || { echo "runtime image dirty flag mismatch" >&2; exit 2; }
+[[ "$metrics_image_dirty" == "$SOURCE_DIRTY" ]] || { echo "metrics image dirty flag mismatch" >&2; exit 2; }
+
+package_name="${PACKAGE_PREFIX}-${REVISION_TOKEN}-${TIMESTAMP}"
 stage="$OUT_DIR/$package_name"
 tar_path="$OUT_DIR/$package_name.tar.gz"

@@ -312,7 +310,7 @@ mkdir -p "$stage/images"
 cp "$IMAGE_TAR" "$stage/images/"
 cp "$METRICS_IMAGE_TAR" "$stage/images/"

-monitor_image_stage="$OUT_DIR/.monitor-images-$TARGET_ARCH-$timestamp"
+monitor_image_stage="$OUT_DIR/.monitor-images-$TARGET_ARCH-$TIMESTAMP"
 rm -rf "$monitor_image_stage"
 mkdir -p "$monitor_image_stage"
 prometheus_tar="$(save_image_if_needed "$PROMETHEUS_IMAGE" "$PROMETHEUS_IMAGE_TAR" "$monitor_image_stage" "prometheus" "$TARGET_PLATFORM")"
@@ -354,6 +352,10 @@ replace_text_in_file "$stage/docs/operations.zh-CN.md" "__HOST_DATA_DIR__" "$HOS
 replace_text_in_file "$stage/docs/operations.en.md" "__HOST_DATA_DIR__" "$HOST_DATA_DIR_DEFAULT"
 replace_text_in_file "$stage/docs/troubleshooting.zh-CN.md" "__HOST_DATA_DIR__" "$HOST_DATA_DIR_DEFAULT"
 replace_text_in_file "$stage/docs/troubleshooting.en.md" "__HOST_DATA_DIR__" "$HOST_DATA_DIR_DEFAULT"
+replace_text_in_file "$stage/docs/README.zh-CN.md" "__RUNTIME_IMAGE__" "$IMAGE_TAG"
+replace_text_in_file "$stage/docs/README.en.md" "__RUNTIME_IMAGE__" "$IMAGE_TAG"
+replace_text_in_file "$stage/docs/README.zh-CN.md" "__METRICS_IMAGE__" "$METRICS_IMAGE"
+replace_text_in_file "$stage/docs/README.en.md" "__METRICS_IMAGE__" "$METRICS_IMAGE"

 runtime_tar_sha256="$(sha256sum "$IMAGE_TAR" | awk '{print $1}')"
 metrics_tar_sha256="$(sha256sum "$METRICS_IMAGE_TAR" | awk '{print $1}')"
@@ -361,9 +363,14 @@ prometheus_tar_sha256="$(sha256sum "$prometheus_tar" | awk '{print $1}')"
 grafana_tar_sha256="$(sha256sum "$grafana_tar" | awk '{print $1}')"

 cat > "$stage/PACKAGE-MANIFEST.env" <<EOF
+package_schema_version=2
 package_name=$package_name
-created_at_utc=$timestamp
-git_commit=$commit
+created_at_utc=$TIMESTAMP
+build_timestamp_utc=$TIMESTAMP
+source_commit=$SOURCE_COMMIT_FULL
+source_commit_short=$SOURCE_COMMIT_SHORT
+source_dirty=$SOURCE_DIRTY
+git_commit=$SOURCE_COMMIT_FULL
 git_status_count=$(git -C "$REPO_ROOT" status --short 2>/dev/null | wc -l | tr -d ' ')
 PACKAGE_ARCH=$TARGET_ARCH
 PACKAGE_PLATFORM=$TARGET_PLATFORM
@@ -377,6 +384,8 @@ image_tag=$IMAGE_TAG
 image_tar=$(basename "$IMAGE_TAR")
 image_tar_size_bytes=$(wc -c < "$IMAGE_TAR")
 image_tar_sha256=$runtime_tar_sha256
+runtime_image_revision=$runtime_image_revision
+runtime_image_dirty=$runtime_image_dirty
 rpki_image=$IMAGE_TAG
 rpki_platform=$TARGET_PLATFORM
 METRICS_IMAGE=$METRICS_IMAGE
@@ -385,6 +394,8 @@ metrics_image=$METRICS_IMAGE
 metrics_image_tar=$(basename "$METRICS_IMAGE_TAR")
 metrics_image_tar_size_bytes=$(wc -c < "$METRICS_IMAGE_TAR")
 metrics_image_tar_sha256=$metrics_tar_sha256
+metrics_image_revision=$metrics_image_revision
+metrics_image_dirty=$metrics_image_dirty
 PROMETHEUS_IMAGE=$PROMETHEUS_IMAGE
 prometheus_image=$PROMETHEUS_IMAGE
 prometheus_image_tar=$(basename "$prometheus_tar")
@@ -407,10 +418,16 @@ EOF

 cat > "$stage/PACKAGE-SUMMARY.txt" <<EOF
 package_name: $package_name
+source_commit: $SOURCE_COMMIT_FULL
+source_commit_short: $SOURCE_COMMIT_SHORT
+source_dirty: $SOURCE_DIRTY
+build_timestamp_utc: $TIMESTAMP
 package_arch: $TARGET_ARCH
 package_platform: $TARGET_PLATFORM
 runtime_image: $IMAGE_TAG
+runtime_image_revision: $runtime_image_revision
 metrics_image: $METRICS_IMAGE
+metrics_image_revision: $metrics_image_revision
 prometheus_image: $PROMETHEUS_IMAGE
 grafana_image: $GRAFANA_IMAGE
 default_host_data_dir: $HOST_DATA_DIR_DEFAULT
@@ -429,6 +446,10 @@ rm -rf "$monitor_image_stage"
  echo "package_dir=$stage"
  echo "package_size_bytes=$(wc -c < "$tar_path")"
  echo "package_sha256=$package_sha256"
+  echo "source_commit=$SOURCE_COMMIT_FULL"
+  echo "source_commit_short=$SOURCE_COMMIT_SHORT"
+  echo "source_dirty=$SOURCE_DIRTY"
+  echo "build_timestamp_utc=$TIMESTAMP"
  echo "package_arch=$TARGET_ARCH"
  echo "package_platform=$TARGET_PLATFORM"
  echo "manifest=$stage/PACKAGE-MANIFEST.env"
--- a/scripts/docker/build_docker_metrics_image.sh
+++ b/scripts/docker/build_docker_metrics_image.sh
@@ -65,7 +65,11 @@ EOF
 fi

 if [[ -z "$IMAGE_TAG" ]]; then
-  IMAGE_TAG="ours-rp-metrics-${TARGET_ARCH}:dev"
+  SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 HEAD 2>/dev/null || echo unknown)"
+  if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" ]]; then
+    SOURCE_COMMIT_SHORT="${SOURCE_COMMIT_SHORT}-dirty"
+  fi
+  IMAGE_TAG="ours-rp-metrics-${TARGET_ARCH}:${SOURCE_COMMIT_SHORT}"
 fi

 if [[ "$dockerfile_explicit" != "1" ]]; then
--- a/scripts/docker/build_docker_runtime_image.sh
+++ b/scripts/docker/build_docker_runtime_image.sh
@@ -22,7 +22,7 @@ Usage:

 Options:
  --arch <arch>       Target architecture: amd64|arm64
-  --image <tag>       Docker image tag (default: ours-rp-runtime-<arch>:dev)
+  --image <tag>       Docker image tag (default: ours-rp-runtime-<arch>:<git8>)
  --out-dir <path>    Directory for docker save tar.gz (default: target/<arch>-docker)
  --dockerfile <path> Dockerfile path
  --builder <name>    buildx builder name
@@ -60,7 +60,9 @@ platform_for_arch() {
 }

 default_image_tag() {
-  printf 'ours-rp-runtime-%s:dev\n' "$1"
+  local arch="$1"
+  local commit_short="$2"
+  printf 'ours-rp-runtime-%s:%s\n' "$arch" "$commit_short"
 }

 require_command() {
@@ -142,8 +144,20 @@ done
  exit 2
 }

+SOURCE_COMMIT_FULL="$(git -C "$REPO_ROOT" rev-parse HEAD 2>/dev/null || echo unknown)"
+SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 HEAD 2>/dev/null || echo unknown)"
+SOURCE_DIRTY="false"
+if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" ]]; then
+  SOURCE_DIRTY="true"
+fi
+BUILD_TIMESTAMP_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
 if [[ -z "$IMAGE_TAG" ]]; then
-  IMAGE_TAG="$(default_image_tag "$TARGET_ARCH")"
+  default_revision="$SOURCE_COMMIT_SHORT"
+  if [[ "$SOURCE_DIRTY" == "true" ]]; then
+    default_revision="${default_revision}-dirty"
+  fi
+  IMAGE_TAG="$(default_image_tag "$TARGET_ARCH" "$default_revision")"
 fi
 if [[ -z "$OUT_DIR" ]]; then
  OUT_DIR="$REPO_ROOT/target/${TARGET_ARCH}-docker"
@@ -176,6 +190,9 @@ echo "repo: $REPO_ROOT"
 echo "dockerfile: $DOCKERFILE"
 echo "builder_image: $BUILDER_IMAGE"
 echo "runtime_image: $RUNTIME_IMAGE"
+echo "source_commit: $SOURCE_COMMIT_FULL"
+echo "source_dirty: $SOURCE_DIRTY"
+echo "build_timestamp_utc: $BUILD_TIMESTAMP_UTC"
 start_epoch="$(date +%s)"

 if [[ "$LOAD_IMAGE" == "1" ]]; then
@@ -186,6 +203,9 @@ if [[ "$LOAD_IMAGE" == "1" ]]; then
    --build-arg BUILDKIT_INLINE_CACHE=1 \
    --build-arg "BUILDER_IMAGE=$BUILDER_IMAGE" \
    --build-arg "RUNTIME_IMAGE=$RUNTIME_IMAGE" \
+    --build-arg "SOURCE_COMMIT=$SOURCE_COMMIT_FULL" \
+    --build-arg "SOURCE_DIRTY=$SOURCE_DIRTY" \
+    --build-arg "BUILD_TIMESTAMP_UTC=$BUILD_TIMESTAMP_UTC" \
    --metadata-file "$metadata_path" \
    -t "$IMAGE_TAG" \
    -f "$DOCKERFILE" \
@@ -199,6 +219,9 @@ else
    --build-arg BUILDKIT_INLINE_CACHE=1 \
    --build-arg "BUILDER_IMAGE=$BUILDER_IMAGE" \
    --build-arg "RUNTIME_IMAGE=$RUNTIME_IMAGE" \
+    --build-arg "SOURCE_COMMIT=$SOURCE_COMMIT_FULL" \
+    --build-arg "SOURCE_DIRTY=$SOURCE_DIRTY" \
+    --build-arg "BUILD_TIMESTAMP_UTC=$BUILD_TIMESTAMP_UTC" \
    --metadata-file "$metadata_path" \
    -t "$IMAGE_TAG" \
    -f "$DOCKERFILE" \
@@ -230,9 +253,13 @@ fi
  echo "tar=$tar_path"
  echo "tar_size_bytes=$(wc -c < "$tar_path" 2>/dev/null || echo 0)"
  echo "tar_sha256=$tar_sha256"
-  echo "git_commit=$(git -C "$REPO_ROOT" rev-parse --short HEAD 2>/dev/null || echo unknown)"
+  echo "source_commit=$SOURCE_COMMIT_FULL"
+  echo "source_commit_short=$SOURCE_COMMIT_SHORT"
+  echo "source_dirty=$SOURCE_DIRTY"
+  echo "build_timestamp_utc=$BUILD_TIMESTAMP_UTC"
+  echo "git_commit=$SOURCE_COMMIT_FULL"
  echo "git_status_count=$(git -C "$REPO_ROOT" status --short 2>/dev/null | wc -l | tr -d ' ')"
-  echo "built_at_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  echo "built_at_utc=$BUILD_TIMESTAMP_UTC"
 } > "$OUT_DIR/$(safe_tag_name "$IMAGE_TAG").build-summary.env"

 echo "build complete: elapsed=${elapsed_secs}s tar=$tar_path"