freeze initial panda-rpki staging

scripts/docker/build_image.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+DOCKERFILE="${DOCKERFILE:-$REPO_ROOT/docker/validator-runtime.Dockerfile}"
+TARGET_ARCH=""
+IMAGE_TAG=""
+OUT_DIR="${OUT_DIR:-$REPO_ROOT/docker-out}"
+ALLOW_DIRTY=0
+SAVE_IMAGE=1
+LOAD_IMAGE=1
+INSTALL_BINFMT=1
+BUILDER_IMAGE="${BUILDER_IMAGE:-rust:1-bookworm}"
+RUNTIME_IMAGE="${RUNTIME_IMAGE:-debian:bookworm-slim}"
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  scripts/docker/build_image.sh --arch amd64|arm64 [options]
+
+Options:
+  --arch <arch>          Target architecture (required)
+  --image <tag>          Image tag (default: panda-rpki-validator:<version>-<arch>)
+  --out-dir <path>       Image archive/metadata directory (default: docker-out)
+  --dockerfile <path>    Dockerfile path
+  --builder-image <tag>  Builder base image (M4 staging tag; pin before release)
+  --runtime-image <tag>  Runtime base image (M4 staging tag; pin before release)
+  --allow-dirty          Permit staging build and mark tag/metadata dirty
+  --no-binfmt            Do not install binfmt/qemu for a cross-architecture build
+  --no-save              Do not write docker save archive
+  --no-load              Build without loading the image into the local daemon
+  -h, --help             Show this help
+USAGE
+}
+
+normalize_arch() {
+  case "$1" in
+    amd64|x86_64) printf '%s\n' amd64 ;;
+    arm64|aarch64) printf '%s\n' arm64 ;;
+    *) return 1 ;;
+  esac
+}
+
+safe_name() {
+  printf '%s' "$1" | tr '/:' '--'
+}
+
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --arch)
+      TARGET_ARCH="$(normalize_arch "$2")" || { echo "unsupported architecture: $2" >&2; exit 2; }
+      shift 2
+      ;;
+    --image)
+      IMAGE_TAG="$2"
+      shift 2
+      ;;
+    --out-dir)
+      OUT_DIR="$2"
+      shift 2
+      ;;
+    --dockerfile)
+      DOCKERFILE="$2"
+      shift 2
+      ;;
+    --builder-image)
+      BUILDER_IMAGE="$2"
+      shift 2
+      ;;
+    --runtime-image)
+      RUNTIME_IMAGE="$2"
+      shift 2
+      ;;
+    --allow-dirty)
+      ALLOW_DIRTY=1
+      shift
+      ;;
+    --no-binfmt)
+      INSTALL_BINFMT=0
+      shift
+      ;;
+    --no-save)
+      SAVE_IMAGE=0
+      shift
+      ;;
+    --no-load)
+      LOAD_IMAGE=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown option: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+[[ -n "$TARGET_ARCH" ]] || { echo "--arch is required" >&2; usage >&2; exit 2; }
+[[ -f "$DOCKERFILE" ]] || { echo "missing Dockerfile: $DOCKERFILE" >&2; exit 2; }
+command -v docker >/dev/null 2>&1 || { echo "missing required command: docker" >&2; exit 2; }
+
+if SOURCE_COMMIT_FULL="$(git -C "$REPO_ROOT" rev-parse --verify HEAD 2>/dev/null)"; then
+  :
+else
+  SOURCE_COMMIT_FULL=unknown
+fi
+if SOURCE_COMMIT_SHORT="$(git -C "$REPO_ROOT" rev-parse --short=8 --verify HEAD 2>/dev/null)"; then
+  :
+else
+  SOURCE_COMMIT_SHORT=unknown
+fi
+SOURCE_DIRTY=false
+if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" || "$SOURCE_COMMIT_FULL" == unknown ]]; then
+  SOURCE_DIRTY=true
+fi
+if [[ "$SOURCE_DIRTY" == true && "$ALLOW_DIRTY" != 1 ]]; then
+  echo "refusing dirty staging tree; pass --allow-dirty for M4 development" >&2
+  exit 2
+fi
+
+VERSION="$(awk -F'"' '$1 == "version = " { print $2; exit }' "$REPO_ROOT/crates/panda-rpki-validator/Cargo.toml")"
+REVISION="$VERSION"
+if [[ "$SOURCE_DIRTY" == true ]]; then
+  REVISION="${REVISION}-dirty"
+fi
+if [[ -z "$IMAGE_TAG" ]]; then
+  IMAGE_TAG="panda-rpki-validator:${REVISION}-${TARGET_ARCH}"
+fi
+
+mkdir -p "$OUT_DIR"
+TARGET_PLATFORM="linux/$TARGET_ARCH"
+HOST_ARCH=""
+case "$(uname -m)" in
+  x86_64|amd64) HOST_ARCH=amd64 ;;
+  aarch64|arm64) HOST_ARCH=arm64 ;;
+  *) echo "unsupported host architecture: $(uname -m)" >&2; exit 2 ;;
+esac
+if [[ "$HOST_ARCH" != "$TARGET_ARCH" && "$INSTALL_BINFMT" == 1 ]]; then
+  echo "installing binfmt/qemu for $TARGET_ARCH"
+  docker run --rm --privileged tonistiigi/binfmt --install "$TARGET_ARCH"
+fi
+METADATA_PATH="$OUT_DIR/$(safe_name "$IMAGE_TAG").build.env"
+IMAGE_TAR="$OUT_DIR/$(safe_name "$IMAGE_TAG").tar.gz"
+
+build_args=(
+  --platform "$TARGET_PLATFORM"
+  --file "$DOCKERFILE"
+  --build-arg "BUILDER_IMAGE=$BUILDER_IMAGE"
+  --build-arg "RUNTIME_IMAGE=$RUNTIME_IMAGE"
+  --build-arg "SOURCE_COMMIT=$SOURCE_COMMIT_FULL"
+  --build-arg "SOURCE_DIRTY=$SOURCE_DIRTY"
+  --build-arg "BUILD_TIMESTAMP_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  --tag "$IMAGE_TAG"
+)
+if [[ "$LOAD_IMAGE" == 1 ]]; then
+  docker buildx build --load "${build_args[@]}" "$REPO_ROOT"
+else
+  docker buildx build "${build_args[@]}" --output "type=oci,dest=$OUT_DIR/$(safe_name "$IMAGE_TAG").oci.tar" "$REPO_ROOT"
+fi
+
+if [[ "$SAVE_IMAGE" == 1 && "$LOAD_IMAGE" == 1 ]]; then
+  docker save "$IMAGE_TAG" | gzip -c > "$IMAGE_TAR"
+fi
+
+IMAGE_DIGEST=""
+IMAGE_ID=""
+if [[ "$LOAD_IMAGE" == 1 ]]; then
+  IMAGE_DIGEST="$(docker image inspect --format '{{index .RepoDigests 0}}' "$IMAGE_TAG" 2>/dev/null || true)"
+  IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$IMAGE_TAG")"
+fi
+BUILD_TIMESTAMP_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+{
+  printf 'image=%s\n' "$IMAGE_TAG"
+  printf 'platform=%s\n' "$TARGET_PLATFORM"
+  printf 'arch=%s\n' "$TARGET_ARCH"
+  printf 'host_arch=%s\n' "$HOST_ARCH"
+  printf 'binfmt_installed=%s\n' "$([[ "$HOST_ARCH" != "$TARGET_ARCH" && "$INSTALL_BINFMT" == 1 ]] && printf true || printf false)"
+  printf 'source_commit=%s\n' "$SOURCE_COMMIT_FULL"
+  printf 'source_commit_short=%s\n' "$SOURCE_COMMIT_SHORT"
+  printf 'source_dirty=%s\n' "$SOURCE_DIRTY"
+  printf 'builder_image=%s\n' "$BUILDER_IMAGE"
+  printf 'runtime_image=%s\n' "$RUNTIME_IMAGE"
+  printf 'image_digest=%s\n' "$IMAGE_DIGEST"
+  printf 'image_id=%s\n' "$IMAGE_ID"
+  printf 'archive=%s\n' "$IMAGE_TAR"
+  printf 'archive_sha256=%s\n' "$(sha256sum "$IMAGE_TAR" 2>/dev/null | awk '{print $1}' || true)"
+  printf 'built_at_utc=%s\n' "$BUILD_TIMESTAMP_UTC"
+} > "$METADATA_PATH"
+
+echo "built image=$IMAGE_TAG platform=$TARGET_PLATFORM archive=$IMAGE_TAR"

scripts/docker/verify_image.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE=""
+ARCHIVE=""
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  scripts/docker/verify_image.sh --image <tag> [--archive <tar.gz>]
+USAGE
+}
+
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --image)
+      IMAGE="$2"
+      shift 2
+      ;;
+    --archive)
+      ARCHIVE="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown option: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+[[ -n "$IMAGE" ]] || { echo "--image is required" >&2; usage >&2; exit 2; }
+command -v docker >/dev/null 2>&1 || { echo "missing required command: docker" >&2; exit 2; }
+
+expect_status() {
+  local expected="$1"
+  shift
+  local actual=0
+  "$@" >/dev/null 2>&1 || actual=$?
+  if [[ "$actual" -ne "$expected" ]]; then
+    echo "unexpected exit status: expected=$expected actual=$actual command=$*" >&2
+    return 1
+  fi
+}
+
+docker image inspect "$IMAGE" >/dev/null
+IMAGE_ARCH="$(docker image inspect --format '{{.Architecture}}' "$IMAGE")"
+case "$IMAGE_ARCH" in
+  amd64|arm64) IMAGE_PLATFORM="linux/$IMAGE_ARCH" ;;
+  *) echo "unsupported image architecture: $IMAGE_ARCH" >&2; exit 2 ;;
+esac
+expect_status 2 docker run --rm --platform "$IMAGE_PLATFORM" --entrypoint /opt/panda-rpki-validator/bin/panda-rpki-validator "$IMAGE" --help
+expect_status 0 docker run --rm --platform "$IMAGE_PLATFORM" --entrypoint /opt/panda-rpki-validator/bin/panda-rpki-validator-daemon "$IMAGE" --help
+expect_status 2 docker run --rm --platform "$IMAGE_PLATFORM" --entrypoint /opt/panda-rpki-validator/entrypoint.sh "$IMAGE" --help
+expect_status 0 docker run --rm --platform "$IMAGE_PLATFORM" "$IMAGE" run --help
+docker run --rm --platform "$IMAGE_PLATFORM" --entrypoint /bin/bash "$IMAGE" -ceu \
+  'test -x /opt/panda-rpki-validator/run_validator.sh; \
+   test -s /opt/panda-rpki-validator/fixtures/manifest.toml; \
+   test -s /opt/panda-rpki-validator/fixtures/tal/afrinic.tal; \
+   test -s /opt/panda-rpki-validator/fixtures/ta/afrinic-ta.cer'
+
+if [[ -n "$ARCHIVE" ]]; then
+  [[ -f "$ARCHIVE" ]] || { echo "missing image archive: $ARCHIVE" >&2; exit 2; }
+  gzip -t "$ARCHIVE"
+  gunzip -c "$ARCHIVE" | docker load >/dev/null
+fi
+
+echo "image smoke passed: $IMAGE"

scripts/runtime/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BIN_DIR="${BIN_DIR:-/opt/panda-rpki-validator/bin}"
+VALIDATOR_BIN="$BIN_DIR/panda-rpki-validator"
+
+if [[ ! -x "$VALIDATOR_BIN" ]]; then
+  echo "panda-rpki-validator: missing executable: $VALIDATOR_BIN" >&2
+  exit 127
+fi
+
+if [[ "${1:-}" == "run" || "${1:-}" == "run-validator" ]]; then
+  shift
+  exec "/opt/panda-rpki-validator/run_validator.sh" "$@"
+fi
+
+if [[ "${1:-}" == "daemon" ]]; then
+  shift
+  exec "$BIN_DIR/panda-rpki-validator-daemon" "$@"
+fi
+
+if [[ "$#" -eq 0 ]]; then
+  set -- --help
+fi
+
+exec "$VALIDATOR_BIN" "$@"