Skip to content

Commit 056f879

Browse files
crazy-maxcrazy-max
committed
release target with checksums
Signed-off-by: CrazyMax <[email protected]>
1 parent da1d534 commit 056f879

File tree

7 files changed

+138
-61
lines changed

7 files changed

+138
-61
lines changed

‎.github/workflows/build.yml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -138,16 +138,11 @@ jobs:
138138
uses: docker/setup-buildx-action@v2
139139
-
140140
name: Build
141-
uses: docker/bake-action@v2
142-
with:
143-
targets: binaries
144-
set: |
145-
*.cache-from=type=gha,scope=build
146-
*.cache-to=type=gha,scope=build,mode=max
147-
-
148-
name: Move artifacts
149141
run: |
150-
mv ${{ env.DESTDIR }}/**/* ${{ env.DESTDIR }}/
142+
make release
143+
env:
144+
CACHE_FROM: type=gha,scope=build
145+
CACHE_TO: type=gha,scope=build,mode=max
151146
-
152147
name: Upload artifacts
153148
uses: actions/upload-artifact@v3

‎Dockerfile‎

Lines changed: 43 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -85,54 +85,76 @@ EOT
8585
FROM scratch AS test-coverage
8686
COPY --from=test /out /
8787

88+
FROM gobase AS version
89+
RUN --mount=target=. \
90+
echo -n "$(./hack/git-meta version)" | tee /tmp/.version ; echo -n "$(./hack/git-meta revision)" | tee /tmp/.revision
91+
8892
FROM base AS build-linux
8993
ARG PACKAGE
90-
ARG TARGETOS
91-
ARG TARGETARCH
92-
ARG TARGETVARIANT
9394
RUN --mount=type=bind,target=. \
9495
--mount=type=cache,target=/root/.cache \
95-
--mount=type=cache,target=/go/pkg/mod <<EOT
96+
--mount=type=cache,target=/go/pkg/mod \
97+
--mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
98+
--mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
9699
set -ex
97100
xx-go --wrap
98-
make build-pass PACKAGE=$PACKAGE DESTDIR=/out BINNAME=docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
99-
xx-verify /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
100-
make build-secretservice PACKAGE=$PACKAGE DESTDIR=/out BINNAME=docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
101-
xx-verify /out/docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
101+
make build-pass build-secretservice PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
102+
xx-verify /out/docker-credential-pass
103+
xx-verify /out/docker-credential-secretservice
102104
EOT
103105

104106
FROM base AS build-darwin
105107
ARG PACKAGE
106-
ARG TARGETOS
107-
ARG TARGETARCH
108-
ARG TARGETVARIANT
109108
RUN --mount=type=bind,target=. \
110109
--mount=type=cache,target=/root/.cache \
111110
--mount=type=cache,target=/go/pkg/mod \
112-
--mount=type=bind,from=osxcross,src=/osxsdk,target=/xx-sdk <<EOT
111+
--mount=type=bind,from=osxcross,src=/osxsdk,target=/xx-sdk \
112+
--mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
113+
--mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
113114
set -ex
114115
xx-go --wrap
115116
go install std
116-
make build-osxkeychain PACKAGE=$PACKAGE DESTDIR=/out BINNAME=docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT}
117-
xx-verify /out/docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT}
118-
make build-pass PACKAGE=$PACKAGE DESTDIR=/out BINNAME=docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
119-
xx-verify /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
117+
make build-osxkeychain build-pass PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
118+
xx-verify /out/docker-credential-osxkeychain
119+
xx-verify /out/docker-credential-pass
120120
EOT
121121

122122
FROM base AS build-windows
123123
ARG PACKAGE
124-
ARG TARGETARCH
125-
ARG TARGETVARIANT
126124
RUN --mount=type=bind,target=. \
127125
--mount=type=cache,target=/root/.cache \
128-
--mount=type=cache,target=/go/pkg/mod <<EOT
126+
--mount=type=cache,target=/go/pkg/mod \
127+
--mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
128+
--mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT
129129
set -ex
130130
xx-go --wrap
131-
make build-wincred PACKAGE=$PACKAGE DESTDIR=/out BINNAME=docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe
132-
xx-verify /out/docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe
131+
make build-wincred PACKAGE=$PACKAGE VERSION=$(cat /tmp/.version) REVISION=$(cat /tmp/.revision) DESTDIR=/out
132+
mv /out/docker-credential-wincred /out/docker-credential-wincred.exe
133+
xx-verify /out/docker-credential-wincred.exe
133134
EOT
134135

135136
FROM build-$TARGETOS AS build
136137

137138
FROM scratch AS binaries
138139
COPY --from=build /out /
140+
141+
FROM --platform=$BUILDPLATFORM alpine AS releaser
142+
WORKDIR /work
143+
ARG TARGETOS
144+
ARG TARGETARCH
145+
ARG TARGETVARIANT
146+
RUN --mount=from=binaries \
147+
--mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version <<EOT
148+
set -e
149+
mkdir /out
150+
version="$(cat /tmp/.version)"
151+
[ "$TARGETOS" = "windows" ] && ext=".exe"
152+
for f in *; do
153+
cp "$f" "/out/${f%.*}-${version}.${TARGETOS}-${TARGETARCH}${TARGETVARIANT}${ext}"
154+
done
155+
EOT
156+
157+
FROM scratch AS release
158+
COPY --from=releaser /out/ /
159+
160+
FROM binaries

‎Makefile‎

Lines changed: 9 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
PACKAGE ?= github.com/docker/docker-credential-helpers
2-
VERSION ?= $(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
3-
REVISION ?= $(shell git rev-parse HEAD)$(shell if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)
2+
VERSION ?= $(shell ./hack/git-meta version)
3+
REVISION ?= $(shell ./hack/git-meta revision)
44

55
GO_PKG = github.com/docker/docker-credential-helpers
66
GO_LDFLAGS = -s -w -X ${GO_PKG}/credentials.Version=${VERSION} -X ${GO_PKG}/credentials.Revision=${REVISION} -X ${GO_PKG}/credentials.Package=${PACKAGE}
@@ -17,8 +17,7 @@ clean:
1717

1818
.PHONY: build-%
1919
build-%: # build, can be one of build-osxkeychain build-pass build-secretservice build-wincred
20-
$(eval BINNAME := docker-credential-$*)
21-
go build -trimpath -ldflags="$(GO_LDFLAGS) -X ${GO_PKG}/credentials.Name=docker-credential-$*" -o $(DESTDIR)/$(BINNAME) ./$*/cmd/
20+
go build -trimpath -ldflags="$(GO_LDFLAGS) -X ${GO_PKG}/credentials.Name=docker-credential-$*" -o "$(DESTDIR)/docker-credential-$*" ./$*/cmd/
2221

2322
# aliases for build-* targets
2423
.PHONY: osxkeychain secretservice pass wincred
@@ -27,36 +26,16 @@ secretservice: build-secretservice
2726
pass: build-pass
2827
wincred: build-wincred
2928

30-
.PHONY: osxcodesign
31-
osxcodesign: build-osxkeychain
32-
$(eval SIGNINGHASH = $(shell security find-identity -v -p codesigning | grep "Developer ID Application: Docker Inc" | cut -d ' ' -f 4))
33-
xcrun -log codesign -s $(SIGNINGHASH) --force --verbose bin/build/docker-credential-osxkeychain
34-
xcrun codesign --verify --deep --strict --verbose=2 --display bin/build/docker-credential-osxkeychain
35-
36-
.PHONY: linuxrelease
37-
linuxrelease:
38-
mkdir -p release
39-
cd bin && tar cvfz ../release/docker-credential-pass-$(VERSION)-amd64.tar.gz docker-credential-pass
40-
cd bin && tar cvfz ../release/docker-credential-secretservice-$(VERSION)-amd64.tar.gz docker-credential-secretservice
41-
42-
.PHONY: osxrelease
43-
osxrelease:
44-
mkdir -p release
45-
cd bin && tar cvfz ../release/docker-credential-osxkeychain-$(VERSION)-amd64.tar.gz docker-credential-osxkeychain
46-
cd bin && tar cvfz ../release/docker-credential-pass-$(VERSION)-darwin-amd64.tar.gz docker-credential-pass
47-
48-
.PHONY: winrelease
49-
winrelease:
50-
mkdir -p release
51-
cd bin && zip ../release/docker-credential-wincred-$(VERSION)-amd64.zip docker-credential-wincred.exe
52-
5329
.PHONY: cross
5430
cross: # cross build all supported credential helpers
55-
$(BUILDX_CMD) bake cross
31+
$(BUILDX_CMD) bake binaries
32+
33+
.PHONY: release
34+
release: # create release
35+
./hack/release
5636

5737
.PHONY: test
58-
test:
59-
# tests all packages except vendor
38+
test: # tests all packages except vendor
6039
go test -v `go list ./... | grep -v /vendor/`
6140

6241
.PHONY: lint

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ $ make osxkeychain
4747
3 - Put that binary in your `$PATH`, so Docker can find it.
4848

4949
```shell
50-
$ cp bin/docker-credential-osxkeychain /usr/local/bin/
50+
$ cp bin/build/docker-credential-osxkeychain /usr/local/bin/
5151
```
5252

5353
## Usage

‎docker-bake.hcl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,9 @@ target "binaries" {
6565
"windows/amd64"
6666
]
6767
}
68+
69+
target "release" {
70+
inherits = ["binaries"]
71+
target = "release"
72+
output = [bindir("release")]
73+
}

‎hack/git-meta‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env sh
2+
3+
set -e
4+
5+
case $1 in
6+
"version")
7+
git describe --match 'v[0-9]*' --dirty='.m' --always --tags
8+
;;
9+
"revision")
10+
echo "$(git rev-parse HEAD)$(if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi)"
11+
;;
12+
*)
13+
echo "usage: ./hack/git-meta <version|revision>"
14+
exit 1
15+
;;
16+
esac

‎hack/release‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
: "${BUILDX_CMD=docker buildx}"
6+
: "${DESTDIR=./bin/release}"
7+
: "${CACHE_FROM=}"
8+
: "${CACHE_TO=}"
9+
10+
: "${SIGN=}"
11+
: "${PFX=}"
12+
: "${PFXPASSWORD=}"
13+
14+
if [ -n "$CACHE_FROM" ]; then
15+
for cfrom in $CACHE_FROM; do
16+
cacheFlags+=(--set "*.cache-from=$cfrom")
17+
done
18+
fi
19+
if [ -n "$CACHE_TO" ]; then
20+
for cto in $CACHE_TO; do
21+
cacheFlags+=(--set "*.cache-to=$cto")
22+
done
23+
fi
24+
25+
dockerpfx=$(mktemp -t dockercredhelper-pfx.XXXXXXXXXX)
26+
function clean {
27+
rm -f "$dockerpfx"
28+
}
29+
trap clean EXIT
30+
31+
# release
32+
(
33+
set -x
34+
${BUILDX_CMD} bake "${cacheFlags[@]}" --set "*.output=$DESTDIR" release
35+
)
36+
37+
# wrap binaries
38+
mv -f ./${DESTDIR}/**/* ./${DESTDIR}/
39+
find ./${DESTDIR} -type d -empty -delete
40+
41+
# sign binaries
42+
if [ -n "$SIGN" ]; then
43+
for f in "${DESTDIR}"/*".darwin-"*; do
44+
SIGNINGHASH=$(security find-identity -v -p codesigning | grep "Developer ID Application: Docker Inc" | cut -d ' ' -f 4)
45+
xcrun -log codesign -s "$SIGNINGHASH" --force --verbose "$f"
46+
xcrun codesign --verify --deep --strict --verbose=2 --display "$f"
47+
done
48+
for f in "${DESTDIR}"/*".windows-"*; do
49+
echo ${PFX} | base64 -d > "$dockerpfx"
50+
signtool sign /fd SHA256 /a /f pfx /p ${PFXPASSWORD} /d Docker /du https://www.docker.com /t http://timestamp.verisign.com/scripts/timestamp.dll "$f"
51+
done
52+
fi
53+
54+
# checksums
55+
(
56+
cd ${DESTDIR}
57+
sha256sum -b docker-credential-* > ./checksums.txt
58+
sha256sum -c --strict checksums.txt
59+
)

0 commit comments

Comments
 (0)