freeze initial panda-rpki staging

docker/base-images.toml

@@ -0,0 +1,8 @@
+# M4 staging build inputs. Replace tags with immutable digest references before M7.
+# The digest and verification date are intentionally empty until the release
+# registry/base-image policy is approved.
+builder_image = "rust:1-bookworm"
+runtime_image = "debian:bookworm-slim"
+builder_digest = ""
+runtime_digest = ""
+status = "pending-release-pinning"

docker/validator-runtime.Dockerfile

@@ -0,0 +1,147 @@
+# syntax=docker/dockerfile:1.7
+
+# Staging defaults. M7 release builds must replace these tags with pinned
+# immutable references recorded in docker/base-images.toml.
+ARG BUILDER_IMAGE=rust:1-bookworm
+ARG RUNTIME_IMAGE=debian:bookworm-slim
+
+FROM --platform=$BUILDPLATFORM ${BUILDER_IMAGE} AS builder
+
+ARG BUILDARCH
+ARG TARGETARCH
+ARG TARGETPLATFORM
+
+WORKDIR /src
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      clang \
+      cmake \
+      git \
+      libclang-dev \
+      make \
+      perl \
+      pkg-config \
+      python3 \
+    && if [ "$TARGETARCH" != "$BUILDARCH" ]; then \
+         case "$TARGETARCH" in \
+           arm64) \
+             apt-get install -y --no-install-recommends \
+               g++-aarch64-linux-gnu \
+               gcc-aarch64-linux-gnu \
+               libc6-dev-arm64-cross \
+             ;; \
+           amd64) \
+             apt-get install -y --no-install-recommends \
+               g++-x86-64-linux-gnu \
+               gcc-x86-64-linux-gnu \
+               libc6-dev-amd64-cross \
+             ;; \
+           *) \
+             echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 \
+             ;; \
+         esac; \
+       fi \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+COPY crates/panda-rpki-validator/Cargo.toml crates/panda-rpki-validator/Cargo.toml
+COPY crates/panda-rpki-validator/src crates/panda-rpki-validator/src
+
+RUN set -eux; \
+    case "$TARGETARCH" in \
+      amd64) target_triple=x86_64-unknown-linux-gnu ;; \
+      arm64) target_triple=aarch64-unknown-linux-gnu ;; \
+      *) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 ;; \
+    esac; \
+    rustup target add "$target_triple"; \
+    if [ "$TARGETARCH" != "$BUILDARCH" ]; then \
+      case "$TARGETARCH" in \
+        arm64) \
+          export \
+            CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
+            CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc \
+            CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++ \
+            AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar \
+            PKG_CONFIG_ALLOW_CROSS=1 \
+          ;; \
+        amd64) \
+          export \
+            CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc \
+            CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc \
+            CXX_x86_64_unknown_linux_gnu=x86_64-linux-gnu-g++ \
+            AR_x86_64_unknown_linux_gnu=x86_64-linux-gnu-ar \
+            PKG_CONFIG_ALLOW_CROSS=1 \
+          ;; \
+        *) \
+          echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 2 \
+          ;; \
+      esac; \
+    fi; \
+    export CARGO_NET_RETRY=10 CARGO_HTTP_TIMEOUT=120 CARGO_HTTP_MULTIPLEXING=false; \
+    cargo build --locked --release --target "$target_triple" \
+      -p panda-rpki-validator --bins; \
+    mkdir -p /build-out/bin; \
+    cp \
+      "target/$target_triple/release/panda-rpki-validator" \
+      "target/$target_triple/release/panda-rpki-validator-daemon" \
+      /build-out/bin/
+
+FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS runtime
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+      bash \
+      ca-certificates \
+      coreutils \
+      curl \
+      findutils \
+      jq \
+      python3 \
+      procps \
+      rsync \
+      time \
+      util-linux \
+      tzdata \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /opt/panda-rpki-validator
+
+COPY --from=builder /build-out/bin/panda-rpki-validator /opt/panda-rpki-validator/bin/panda-rpki-validator
+COPY --from=builder /build-out/bin/panda-rpki-validator-daemon /opt/panda-rpki-validator/bin/panda-rpki-validator-daemon
+COPY scripts/runtime/entrypoint.sh /opt/panda-rpki-validator/entrypoint.sh
+COPY scripts/runtime/run_validator.sh /opt/panda-rpki-validator/run_validator.sh
+COPY fixtures/ /opt/panda-rpki-validator/fixtures/
+
+ARG SOURCE_COMMIT=unknown
+ARG SOURCE_DIRTY=unknown
+ARG BUILD_TIMESTAMP_UTC=unknown
+
+LABEL org.opencontainers.image.title="panda-rpki-validator" \
+      org.opencontainers.image.description="Panda RPKI synchronization and validation runtime" \
+      org.opencontainers.image.revision="${SOURCE_COMMIT}" \
+      org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
+      org.opencontainers.image.source-dirty="${SOURCE_DIRTY}" \
+      org.opencontainers.image.vendor="panda-rpki"
+
+RUN chmod +x /opt/panda-rpki-validator/bin/panda-rpki-validator \
+      /opt/panda-rpki-validator/bin/panda-rpki-validator-daemon \
+      /opt/panda-rpki-validator/run_validator.sh \
+      /opt/panda-rpki-validator/entrypoint.sh \
+    && mkdir -p /var/lib/panda-rpki-validator/state \
+      /var/lib/panda-rpki-validator/runs \
+      /var/lib/panda-rpki-validator/logs \
+      /var/lib/panda-rpki-validator/tmp
+
+ENV PACKAGE_ROOT=/opt/panda-rpki-validator \
+    RUN_ROOT=/var/lib/panda-rpki-validator \
+    BIN_DIR=/opt/panda-rpki-validator/bin \
+    FIXTURE_DIR=/opt/panda-rpki-validator/fixtures \
+    RUST_BACKTRACE=1
+
+VOLUME ["/var/lib/panda-rpki-validator"]
+
+ENTRYPOINT ["/opt/panda-rpki-validator/entrypoint.sh"]
+CMD ["--help"]