Enhance platform support in Docker build scripts for Boulder

- Added TARGETPLATFORM argument to Containerfile for architecture-specific builds.
- Updated container-build.sh to detect architecture and set appropriate platform.
- Modified make-deb.sh to dynamically set the architecture in the .deb package.

Author: sheurich

Containerfile

@@ -6,13 +6,19 @@ FROM docker.io/ubuntu:24.04 AS builder
 ARG COMMIT_ID
 ARG GO_VERSION
 ARG VERSION
+ARG TARGETPLATFORM
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get --assume-yes --no-install-recommends --update install \
     ca-certificates curl gcc git gnupg2 libc6-dev
 
 COPY tools/fetch-and-verify-go.sh /tmp
-RUN /tmp/fetch-and-verify-go.sh ${GO_VERSION}
+RUN case "${TARGETPLATFORM}" in \
+        "linux/amd64") PLATFORM="linux-amd64" ;; \
+        "linux/arm64") PLATFORM="linux-arm64" ;; \
+        *) echo "Unsupported platform: ${TARGETPLATFORM}" && exit 1 ;; \
+    esac && \
+    /tmp/fetch-and-verify-go.sh ${GO_VERSION} ${PLATFORM}
 RUN tar -C /opt -xzf go.tar.gz
 ENV PATH="/opt/go/bin:${PATH}"
 

tools/container-build.sh

@@ -7,36 +7,53 @@
 
 set -ex
 
-# Without this, `go install` produces:
-# # runtime/cgo
-# gcc: error: unrecognized command-line option '-m64'
-if [ "$(uname -m)" = "arm64" ]; then
-  export DOCKER_DEFAULT_PLATFORM=linux/amd64
-fi
-
 if [ -z "${GO_VERSION}" ] ; then
   echo "GO_VERSION not set"
   exit 1
 fi
 
-ARCH="$(uname -m)"
 COMMIT_ID="$(git rev-parse --short=8 HEAD)"
 VERSION="${GO_VERSION}.$(date +%s)"
 
+# Detect architecture to build for (allow override via DOCKER_DEFAULT_PLATFORM)
+if [ -n "${DOCKER_DEFAULT_PLATFORM}" ]; then
+    PLATFORM="${DOCKER_DEFAULT_PLATFORM}"
+else
+    case "$(uname -m)" in
+        "x86_64") PLATFORM="linux/amd64" ;;
+        "aarch64"|"arm64") PLATFORM="linux/arm64" ;;
+        *) echo "Unsupported architecture: $(uname -m)" && exit 1 ;;
+    esac
+fi
+
+# Extract architecture from platform
+case "$PLATFORM" in
+    "linux/amd64") ARCH="amd64" ;;
+    "linux/arm64") ARCH="arm64" ;;
+    *) echo "Unsupported platform: ${PLATFORM}" && exit 1 ;;
+esac
+
+# Create platform-specific image
 docker buildx build \
     --file Containerfile \
+    --platform "$PLATFORM" \
     --build-arg "COMMIT_ID=${COMMIT_ID}" \
     --build-arg "GO_VERSION=${GO_VERSION}" \
     --build-arg "VERSION=${VERSION}" \
+    --tag "boulder:${VERSION}-${ARCH}" \
     --tag "boulder:${VERSION}" \
     --tag "boulder:${COMMIT_ID}" \
     --tag boulder \
+    --load \
     .
 
-docker run boulder tar -C /opt/boulder -cpz . > "./boulder-${VERSION}-${COMMIT_ID}.${ARCH}.tar.gz" .
-# Produces e.g. boulder-1.25.0.1754519595-591c0545.x86_64.deb
+# Create tarball
+docker run "boulder:${VERSION}-${ARCH}" tar -C /opt/boulder -cpz . > "./boulder-${VERSION}-${COMMIT_ID}.${ARCH}.tar.gz"
+
+# Create .deb package
 docker run -v .:/boulderrepo \
-  -e "COMMIT_ID=$(git rev-parse --short=8 HEAD)" \
-  -e "VERSION=${VERSION}" \
-  boulder \
-  /boulderrepo/tools/make-deb.sh
+    -e "COMMIT_ID=${COMMIT_ID}" \
+    -e "VERSION=${VERSION}" \
+    -e "ARCH=${ARCH}" \
+    "boulder:${VERSION}-${ARCH}" \
+    /boulderrepo/tools/make-deb.sh

tools/make-deb.sh

@@ -15,18 +15,29 @@ BUILD="$(mktemp -d)"
 mkdir -p "${BUILD}/opt"
 cp -a /opt/boulder "${BUILD}/opt/boulder"
 
+# Determine architecture - use ARCH env var if set, otherwise detect from uname
+if [ -n "${ARCH:-}" ]; then
+    DEB_ARCH="${ARCH}"
+else
+    case "$(uname -m)" in
+        "x86_64") DEB_ARCH="amd64" ;;
+        "aarch64"|"arm64") DEB_ARCH="arm64" ;;
+        *) echo "Unsupported architecture: $(uname -m)" && exit 1 ;;
+    esac
+fi
+
 mkdir -p "${BUILD}/DEBIAN"
 cat > "${BUILD}/DEBIAN/control" <<-EOF
 Package: boulder
 Version: 1:${VERSION}
 License: Mozilla Public License v2.0
 Vendor: ISRG
-Architecture: amd64
+Architecture: ${DEB_ARCH}
 Maintainer: Community
 Section: default
 Priority: extra
 Homepage: https://github.com/letsencrypt/boulder
 Description: Boulder is an ACME-compatible X.509 Certificate Authority
 EOF
 
-dpkg-deb -Zgzip -b "${BUILD}" "boulder-${VERSION}-${COMMIT_ID}.x86_64.deb"
+dpkg-deb -Zgzip -b "${BUILD}" "boulder-${VERSION}-${COMMIT_ID}.${DEB_ARCH}.deb"