Skip to content

Commit 8b0d966

Browse files
tianontianon
committed
Fixup more GPG usage, update more buildroot version numbers, https, reconsitentize
1 parent 4117f99 commit 8b0d966

File tree

3 files changed

+65
-57
lines changed

3 files changed

+65
-57
lines changed

‎glibc/Dockerfile.builder

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,25 @@ RUN apt-get update && apt-get install -y \
1111
# Key fingerprint = C9E9 416F 76E6 10DB D09D 040F 47B7 0C55 ACC9 965B
1212
# uid Denis Vlasenko <[email protected]>
1313
# sub 1024g/2C766641 2006-12-12
14-
RUN gpg --keyserver pool.sks-keyservers.net --recv-keys C9E9416F76E610DBD09D040F47B70C55ACC9965B
14+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys C9E9416F76E610DBD09D040F47B70C55ACC9965B
1515

1616
ENV BUSYBOX_VERSION 1.26.2
1717

18-
RUN set -x \
19-
&& curl -fsSL "http://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2" -o busybox.tar.bz2 \
20-
&& curl -fsSL "http://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2.sign" -o busybox.tar.bz2.sign \
21-
&& gpg --verify busybox.tar.bz2.sign \
22-
&& tar -xjf busybox.tar.bz2 \
23-
&& mkdir -p /usr/src \
24-
&& mv "busybox-${BUSYBOX_VERSION}" /usr/src/busybox \
25-
&& rm busybox.tar.bz2*
18+
RUN set -ex; \
19+
tarball="busybox-${BUSYBOX_VERSION}.tar.bz2"; \
20+
curl -fL -o busybox.tar.bz2 "https://busybox.net/downloads/$tarball"; \
21+
curl -fL -o busybox.tar.bz2.sign "https://busybox.net/downloads/$tarball.sign"; \
22+
gpg --batch --decrypt --output busybox.tar.bz2.txt busybox.tar.bz2.sign; \
23+
awk '$1 == "SHA1:" && $2 ~ /^[0-9a-f]+$/ && $3 == "'"$tarball"'" { print $2, "*busybox.tar.bz2" }' busybox.tar.bz2.txt > busybox.tar.bz2.sha1; \
24+
test -s busybox.tar.bz2.sha1; \
25+
sha1sum -c busybox.tar.bz2.sha1; \
26+
mkdir -p /usr/src/busybox; \
27+
tar -xf busybox.tar.bz2 -C /usr/src/busybox --strip-components 1; \
28+
rm busybox.tar.bz2*
2629

2730
WORKDIR /usr/src/busybox
2831

29-
# TODO remove CONFIG_FEATURE_SYNC_FANCY from this explicit list after the next release of busybox (since it's disabled by default upstream now)
32+
# TODO remove CONFIG_FEATURE_SYNC_FANCY from this explicit list after the next release of busybox (since it's disabled by default upstream now; 1.27+)
3033
# CONFIG_LAST_SUPPORTED_WCHAR: see https://github.com/docker-library/busybox/issues/13 (UTF-8 input)
3134
# As long as we rely on libnss, we have to have libc.so anyhow, so
3235
# we've removed CONFIG_STATIC here for now... :cry:
@@ -72,8 +75,6 @@ RUN set -ex; \
7275
grep -q "^$confV\$" .config; \
7376
done;
7477

75-
# hack hack hack hack hack
76-
# with glibc, static busybox uses libnss for DNS resolution :(
7778
RUN set -ex \
7879
&& make -j "$(nproc)" \
7980
busybox \
@@ -82,6 +83,9 @@ RUN set -ex \
8283
&& ln -vL busybox rootfs/bin/ \
8384
\
8485
&& ln -vL "$(which getconf)" rootfs/bin/getconf \
86+
\
87+
# hack hack hack hack hack
88+
# with glibc, static busybox uses libnss for DNS resolution :(
8589
&& mkdir -p rootfs/etc \
8690
&& cp /etc/nsswitch.conf rootfs/etc/ \
8791
&& mkdir -p rootfs/lib \
@@ -106,17 +110,16 @@ RUN set -ex \
106110
$2 == "=>" && $3 ~ /^\// { print $3; next } \
107111
'); \
108112
done \
113+
\
109114
&& chroot rootfs /bin/getconf _NPROCESSORS_ONLN \
110115
\
111116
&& chroot rootfs /bin/busybox --install /bin
112117

113-
RUN set -ex \
114-
&& buildrootVersion='2015.11.1' \
115-
&& mkdir -p rootfs/etc \
116-
&& for f in passwd shadow group; do \
117-
curl -fSL \
118-
"http://git.busybox.net/buildroot/plain/system/skeleton/etc/$f?id=$buildrootVersion" \
119-
-o "rootfs/etc/$f"; \
118+
RUN set -ex; \
119+
buildrootVersion='2017.02.2'; \
120+
mkdir -p rootfs/etc; \
121+
for f in passwd shadow group; do \
122+
curl -fL -o "rootfs/etc/$f" "https://git.busybox.net/buildroot/plain/system/skeleton/etc/$f?id=$buildrootVersion"; \
120123
done
121124

122125
# create /tmp

‎musl/Dockerfile.builder

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,38 +2,41 @@ FROM alpine:3.5
22

33
RUN apk add --no-cache \
44
bzip2 \
5+
coreutils \
56
curl \
67
gcc \
7-
make \
8-
\
98
gnupg \
109
linux-headers \
10+
make \
1111
musl-dev
1212

1313
# pub 1024D/ACC9965B 2006-12-12
1414
# Key fingerprint = C9E9 416F 76E6 10DB D09D 040F 47B7 0C55 ACC9 965B
1515
# uid Denis Vlasenko <[email protected]>
1616
# sub 1024g/2C766641 2006-12-12
17-
RUN gpg --keyserver pool.sks-keyservers.net --recv-keys C9E9416F76E610DBD09D040F47B70C55ACC9965B
17+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys C9E9416F76E610DBD09D040F47B70C55ACC9965B
1818

1919
ENV BUSYBOX_VERSION 1.26.2
2020

21-
RUN set -x \
22-
&& curl -fsSL "http://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2" -o busybox.tar.bz2 \
23-
&& curl -fsSL "http://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2.sign" -o busybox.tar.bz2.sign \
24-
&& gpg --verify busybox.tar.bz2.sign \
25-
&& tar -xjf busybox.tar.bz2 \
26-
&& mkdir -p /usr/src \
27-
&& mv "busybox-${BUSYBOX_VERSION}" /usr/src/busybox \
28-
&& rm busybox.tar.bz2*
21+
RUN set -ex; \
22+
tarball="busybox-${BUSYBOX_VERSION}.tar.bz2"; \
23+
curl -fL -o busybox.tar.bz2 "https://busybox.net/downloads/$tarball"; \
24+
curl -fL -o busybox.tar.bz2.sign "https://busybox.net/downloads/$tarball.sign"; \
25+
gpg --batch --decrypt --output busybox.tar.bz2.txt busybox.tar.bz2.sign; \
26+
awk '$1 == "SHA1:" && $2 ~ /^[0-9a-f]+$/ && $3 == "'"$tarball"'" { print $2, "*busybox.tar.bz2" }' busybox.tar.bz2.txt > busybox.tar.bz2.sha1; \
27+
test -s busybox.tar.bz2.sha1; \
28+
sha1sum -c busybox.tar.bz2.sha1; \
29+
mkdir -p /usr/src/busybox; \
30+
tar -xf busybox.tar.bz2 -C /usr/src/busybox --strip-components 1; \
31+
rm busybox.tar.bz2*
2932

3033
WORKDIR /usr/src/busybox
3134

3235
# https://www.mail-archive.com/[email protected]/msg02528.html
3336
# https://www.mail-archive.com/[email protected]/msg02526.html
3437
RUN sed -i 's/^struct kconf_id \*$/static &/g' scripts/kconfig/zconf.hash.c_shipped
3538

36-
# TODO remove CONFIG_FEATURE_SYNC_FANCY from this explicit list after the next release of busybox (since it's disabled by default upstream now)
39+
# TODO remove CONFIG_FEATURE_SYNC_FANCY from this explicit list after the next release of busybox (since it's disabled by default upstream now; 1.27+)
3740
# CONFIG_LAST_SUPPORTED_WCHAR: see https://github.com/docker-library/busybox/issues/13 (UTF-8 input)
3841
# see http://wiki.musl-libc.org/wiki/Building_Busybox
3942
RUN set -ex; \
@@ -85,11 +88,11 @@ RUN set -ex; \
8588
done;
8689

8790
RUN set -ex \
88-
&& make -j "$(getconf _NPROCESSORS_ONLN)" \
91+
&& make -j "$(nproc)" \
8992
busybox \
9093
&& ./busybox --help \
9194
&& mkdir -p rootfs/bin \
92-
&& ln -v busybox rootfs/bin/ \
95+
&& ln -vL busybox rootfs/bin/ \
9396
&& chroot rootfs /bin/busybox --install /bin
9497

9598
# grab a simplified getconf port from Alpine we can statically compile
@@ -99,15 +102,13 @@ RUN set -x \
99102
"http://git.alpinelinux.org/cgit/aports/plain/main/musl/getconf.c?h=${aportsVersion}" \
100103
-o /usr/src/getconf.c \
101104
&& gcc -o rootfs/bin/getconf -static -Os /usr/src/getconf.c \
102-
&& chroot rootfs /bin/sh -xec 'getconf _NPROCESSORS_ONLN'
105+
&& chroot rootfs /bin/getconf _NPROCESSORS_ONLN
103106

104-
RUN set -ex \
105-
&& buildrootVersion='2015.11.1' \
106-
&& mkdir -p rootfs/etc \
107-
&& for f in passwd shadow group; do \
108-
curl -fSL \
109-
"http://git.busybox.net/buildroot/plain/system/skeleton/etc/$f?id=$buildrootVersion" \
110-
-o "rootfs/etc/$f"; \
107+
RUN set -ex; \
108+
buildrootVersion='2017.02.2'; \
109+
mkdir -p rootfs/etc; \
110+
for f in passwd shadow group; do \
111+
curl -fL -o "rootfs/etc/$f" "https://git.busybox.net/buildroot/plain/system/skeleton/etc/$f?id=$buildrootVersion"; \
111112
done
112113

113114
# create /tmp

‎uclibc/Dockerfile.builder

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,9 @@ ENV BUILDROOT_VERSION 2017.02.2
3333

3434
RUN set -ex; \
3535
tarball="buildroot-${BUILDROOT_VERSION}.tar.bz2"; \
36-
curl -fsSL -o buildroot.tar.bz2 "http://buildroot.uclibc.org/downloads/$tarball"; \
37-
curl -fsSL -o buildroot.tar.bz2.sign "http://buildroot.uclibc.org/downloads/$tarball.sign"; \
36+
curl -fL -o buildroot.tar.bz2 "https://buildroot.uclibc.org/downloads/$tarball"; \
37+
curl -fL -o buildroot.tar.bz2.sign "https://buildroot.uclibc.org/downloads/$tarball.sign"; \
3838
gpg --batch --decrypt --output buildroot.tar.bz2.txt buildroot.tar.bz2.sign; \
39-
cat buildroot.tar.bz2.txt; \
4039
awk '$1 == "SHA1:" && $2 ~ /^[0-9a-f]+$/ && $3 == "'"$tarball"'" { print $2, "*buildroot.tar.bz2" }' buildroot.tar.bz2.txt > buildroot.tar.bz2.sha1; \
4140
test -s buildroot.tar.bz2.sha1; \
4241
sha1sum -c buildroot.tar.bz2.sha1; \
@@ -126,22 +125,25 @@ ENV PATH /usr/src/buildroot/output/host/usr/bin:$PATH
126125
# Key fingerprint = C9E9 416F 76E6 10DB D09D 040F 47B7 0C55 ACC9 965B
127126
# uid Denis Vlasenko <[email protected]>
128127
# sub 1024g/2C766641 2006-12-12
129-
RUN gpg --keyserver pool.sks-keyservers.net --recv-keys C9E9416F76E610DBD09D040F47B70C55ACC9965B
128+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys C9E9416F76E610DBD09D040F47B70C55ACC9965B
130129

131130
ENV BUSYBOX_VERSION 1.26.2
132131

133-
RUN set -x \
134-
&& curl -fsSL "http://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2" -o busybox.tar.bz2 \
135-
&& curl -fsSL "http://busybox.net/downloads/busybox-${BUSYBOX_VERSION}.tar.bz2.sign" -o busybox.tar.bz2.sign \
136-
&& gpg --verify busybox.tar.bz2.sign \
137-
&& tar -xjf busybox.tar.bz2 \
138-
&& mkdir -p /usr/src \
139-
&& mv "busybox-${BUSYBOX_VERSION}" /usr/src/busybox \
140-
&& rm busybox.tar.bz2*
132+
RUN set -ex; \
133+
tarball="busybox-${BUSYBOX_VERSION}.tar.bz2"; \
134+
curl -fL -o busybox.tar.bz2 "https://busybox.net/downloads/$tarball"; \
135+
curl -fL -o busybox.tar.bz2.sign "https://busybox.net/downloads/$tarball.sign"; \
136+
gpg --batch --decrypt --output busybox.tar.bz2.txt busybox.tar.bz2.sign; \
137+
awk '$1 == "SHA1:" && $2 ~ /^[0-9a-f]+$/ && $3 == "'"$tarball"'" { print $2, "*busybox.tar.bz2" }' busybox.tar.bz2.txt > busybox.tar.bz2.sha1; \
138+
test -s busybox.tar.bz2.sha1; \
139+
sha1sum -c busybox.tar.bz2.sha1; \
140+
mkdir -p /usr/src/busybox; \
141+
tar -xf busybox.tar.bz2 -C /usr/src/busybox --strip-components 1; \
142+
rm busybox.tar.bz2*
141143

142144
WORKDIR /usr/src/busybox
143145

144-
# TODO remove CONFIG_FEATURE_SYNC_FANCY from this explicit list after the next release of busybox (since it's disabled by default upstream now)
146+
# TODO remove CONFIG_FEATURE_SYNC_FANCY from this explicit list after the next release of busybox (since it's disabled by default upstream now; 1.27+)
145147
# CONFIG_LAST_SUPPORTED_WCHAR: see https://github.com/docker-library/busybox/issues/13 (UTF-8 input)
146148
RUN set -ex; \
147149
\
@@ -196,11 +198,13 @@ RUN set -ex \
196198
\
197199
&& ln -vL ../buildroot/output/target/usr/bin/getconf rootfs/bin/ \
198200
\
201+
&& chroot rootfs /bin/getconf _NPROCESSORS_ONLN \
202+
\
199203
&& chroot rootfs /bin/busybox --install /bin
200204

201-
RUN set -ex \
202-
&& mkdir -p rootfs/etc \
203-
&& for f in passwd shadow group; do \
205+
RUN set -ex; \
206+
mkdir -p rootfs/etc; \
207+
for f in passwd shadow group; do \
204208
ln -vL \
205209
"../buildroot/system/skeleton/etc/$f" \
206210
"rootfs/etc/$f"; \

0 commit comments

Comments
 (0)