66# and mounted at /cachi2/output/deps/{rpm,pip,generic}/ during the build.
77#
88# Multi-stage layout:
9- # rpm-base -> builds code-server RPM from prefetched source (all arches)
9+ # rpm-base -> builds code-server from prefetched source (release-standalone, all arches)
1010# whl-cache -> installs Python wheels + exports compiled C-extension wheels (ppc64le/s390x)
1111# cpu-base -> installs OS packages + tools (oc client, micropipenv, uv)
1212# codeserver -> final image (code-server + nginx + Python packages)
@@ -23,11 +23,10 @@ ARG BASE_IMAGE
2323ARG LOCAL_BUILD=false
2424
2525############################################################################################
26- # rpm-base: Build code-server from source into an RPM ( all architectures)
26+ # rpm-base: Build code-server from source (release-standalone tree, all architectures)
2727#
28- # [HERMETIC] apply-patch.sh (formerly get_code_server_rpm.sh) would git-clone code-server,
29- # install nvm, download Node.js, and build everything with full network access. Now the
30- # entire build runs offline using prefetched sources:
28+ # [HERMETIC] The build runs offline using prefetched sources (no git clone, no nvm, no
29+ # Node download). apply-patch.sh only applies patches and offline fixes. Sources:
3130# - code-server source: prefetch-input/code-server/ (git submodule)
3231# - Node.js/npm: installed from prefetched RPMs
3332# - npm dependencies: package-lock.json resolved URLs rewritten to file:///cachi2/...
@@ -57,12 +56,11 @@ ARG CODESERVER_VERSION=v4.106.3
5756
5857# [HERMETIC] Import GPG keys for prefetched RPM verification.
5958# CentOS key needed because libX11-devel comes from CentOS Stream repos.
60- RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-EPEL-9
6159RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official
6260RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
6361
6462# [HERMETIC] Configure package repos: local hermeto repos for testing, or enable nodejs:22 module for Konflux.
65- # Hermeto organises RPMs into per-arch sub-repos (baseos, epel, crb, ubi-*, …), each with
63+ # Hermeto organises RPMs into per-arch sub-repos (baseos, crb, ubi-*, …), each with
6664# its own repodata/. The generated hermeto.repo already points at the correct file:// paths.
6765RUN if [ "${LOCAL_BUILD}" = "true" ]; then \
6866 rm -f /etc/yum.repos.d/* && \
@@ -73,18 +71,12 @@ RUN if [ "${LOCAL_BUILD}" = "true" ]; then \
7371 fi;
7472
7573# libxkbfile-devel = util-macros + libxkbfile (Previously built from source)
76- # [HERMETIC] Install nfpm (RPM packager) from prefetched RPM
7774RUN dnf install -y \
7875 nodejs nodejs-devel npm \
7976 jq patch libtool rsync gettext gcc-toolset-14 gcc-toolset-14-libatomic-devel \
80- krb5-devel libX11-devel libxkbfile-devel \
81- /cachi2/output/deps/generic/nfpm-2.44.1-1.$(uname -m).rpm && \
77+ krb5-devel libX11-devel libxkbfile-devel && \
8278 dnf clean all
8379
84- # There was limitation on Hermeto, it can't fetch npm packages using git/ssh protocol.
85- # To work around this, need to fetch some npm packages as generic artifacts and copy to npm directory.
86- RUN cp /cachi2/output/deps/generic/npm/* /cachi2/output/deps/npm/
87-
8880# [HERMETIC] Git metadata needed by code-server's build scripts (version detection, submodules).
8981COPY .git /root/.git
9082# [HERMETIC] Rewrite script: used by setup-offline-binaries.sh to rewrite npm
@@ -103,16 +95,16 @@ COPY ${CODESERVER_CONTEXT}/prefetch-input/patches/codeserver-offline-env.sh ${CO
10395COPY ${CODESERVER_CONTEXT}/prefetch-input/patches/tweak-gha.sh ${CODESERVER_SOURCE_CODE}/patches/
10496COPY ${CODESERVER_CONTEXT}/prefetch-input/patches/apply-patch.sh ${CODESERVER_SOURCE_CODE}/
10597
106- # [HERMETIC] apply-patch.sh (formerly get_code_server_rpm.sh) was simplified: it now only
107- # enables gcc-toolset-14 and applies patches (nfpm is installed above). The actual
108- # npm ci/build/release steps are done below in separate RUN commands for better caching.
98+ # [HERMETIC] apply-patch.sh enables gcc-toolset-14 and applies patches (ripgrep, vsce-sign,
99+ # patches/series). npm ci, build, and release run in separate RUN steps below for caching.
109100RUN cd ${CODESERVER_SOURCE_CODE} && GHA_BUILD="${GHA_BUILD}" ./apply-patch.sh
110101
111102# [HERMETIC] Step 1: npm ci --offline (install all npm dependencies from local cache).
112103# setup-offline-binaries.sh does all offline preparation in one shot:
113104# - sources codeserver-offline-env.sh (ELECTRON_SKIP_BINARY_DOWNLOAD, NPM_CONFIG_NODEDIR, etc.)
114- # - populates node-gyp header cache (22.20.0 for VS Code remote), ripgrep, VSCode extensions
115- # - pre-populates .build/node/ and .build/builtInExtensions/ so gulp skips network downloads
105+ # - node-gyp uses system headers (NPM_CONFIG_NODEDIR=/usr from nodejs-devel RPM)
106+ # - ripgrep, .vsix extensions from cachi2 generic; .build/node/ = system /usr/bin/node (per-arch)
107+ # - pre-populates .build/builtInExtensions/ so gulp skips network downloads
116108# - rewrites package-lock.json "resolved" URLs to file:///cachi2/...
117109# CI=1 makes ci/dev/postinstall.sh run "npm ci" (not "npm install") in subdirs,
118110# so resolved URLs stay absolute (file:///cachi2/...) and lockfiles are never modified.
@@ -138,12 +130,6 @@ RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && \
138130 export KEEP_MODULES=1 && cd ${CODESERVER_SOURCE_PREFETCH} && \
139131 npm run release:standalone
140132
141- # [HERMETIC] Step 5: Package into RPM using nfpm (installed from prefetched RPM).
142- RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && cd ${CODESERVER_SOURCE_PREFETCH} && \
143- VERSION=${CODESERVER_VERSION/v/} npm run package && \
144- ls -alh release-packages/ && \
145- mv release-packages/code-server-${CODESERVER_VERSION/v/}-*.rpm /tmp/
146-
147133# Sentinel file: downstream stages use COPY --from=rpm-base /tmp/control to wait for this stage.
148134RUN echo "done" > /tmp/control
149135
@@ -170,11 +156,10 @@ ARG LOCAL_BUILD
170156ARG CODESERVER_SOURCE_CODE=codeserver/ubi9-python-3.12
171157ARG PYLOCK_FLAVOR
172158
173- # [HERMETIC] Import GPG keys for EPEL, Red Hat, and CentOS repos (needed for dnf to verify prefetched RPMs).
174- # EPEL + CentOS keys are prefetched as generic artifacts (see artifacts.in.yaml).
159+ # [HERMETIC] Import GPG keys for Red Hat and CentOS repos (needed for dnf to verify prefetched RPMs).
160+ # CentOS key is prefetched as a generic artifact (see artifacts.in.yaml).
175161# UBI9 images only ship the Red Hat key; CentOS key is needed for ppc64le/s390x packages
176162# from CentOS Stream repos (mesa-libGL, etc.).
177- RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-EPEL-9
178163RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official
179164RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
180165
@@ -254,12 +239,11 @@ USER 0
254239
255240# [HERMETIC] Import GPG keys for prefetched RPM verification.
256241# CentOS key needed because mesa-libGL comes from CentOS Stream repos.
257- RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-EPEL-9
258242RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official
259243RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
260244
261245# [HERMETIC] Configure package repos: local hermeto repos for testing, or enable nodejs:22 module for Konflux.
262- # Hermeto organises RPMs into per-arch sub-repos (baseos, epel, crb, ubi-*, …), each with
246+ # Hermeto organises RPMs into per-arch sub-repos (baseos, crb, ubi-*, …), each with
263247# its own repodata/. The generated hermeto.repo already points at the correct file:// paths.
264248RUN if [ "${LOCAL_BUILD}" = "true" ]; then \
265249 rm -f /etc/yum.repos.d/* && \
@@ -330,7 +314,7 @@ USER 0
330314WORKDIR /opt/app-root/bin
331315
332316# [HERMETIC] Configure package repos: local hermeto repos for testing, or enable nodejs:22 module for Konflux.
333- # Hermeto organises RPMs into per-arch sub-repos (baseos, epel, crb, ubi-*, …), each with
317+ # Hermeto organises RPMs into per-arch sub-repos (baseos, crb, ubi-*, …), each with
334318# its own repodata/. The generated hermeto.repo already points at the correct file:// paths.
335319RUN if [ "${LOCAL_BUILD}" = "true" ]; then \
336320 rm -f /etc/yum.repos.d/* && \
@@ -341,9 +325,7 @@ RUN if [ "${LOCAL_BUILD}" = "true" ]; then \
341325 fi;
342326
343327# [HERMETIC] Install useful OS packages from prefetched RPMs.
344- # nodejs: provides libnode.so needed at runtime by code-server's bundled node binary
345- # (installed via rpm2cpio which skips dependency resolution).
346- # cpio: required for rpm2cpio | cpio -idmv below (install here to avoid a second dnf call).
328+ # nodejs: provides libnode.so needed at runtime by code-server's bundled node binary.
347329RUN /bin/bash <<'EOF'
348330set -Eeuxo pipefail
349331PACKAGES=(
@@ -353,26 +335,21 @@ PACKAGES=(
353335 gettext
354336 # nss_wrapper: required by generate_container_user (LD_PRELOAD=libnss_wrapper.so)
355337 nss_wrapper
356- cpio
357338)
358339dnf install -y "${PACKAGES[@]}"
359340dnf clean all
360341rm -rf /var/cache/dnf
361342EOF
362343
363- # Wait for rpm-base stage (builds code-server RPM from source ).
344+ # Wait for rpm-base stage (builds code-server release-standalone ).
364345COPY --from=rpm-base /tmp/control /dev/null
365346
366- # Copy the built RPM from rpm-base stage (COPY instead of bind mounts — bind mounts fail on Konflux).
367- # https://redhat-internal.slack.com/archives/C04PZ7H0VA8/p1755628065772589?thread_ts=1755597929.335999&cid=C04PZ7H0VA8
368- COPY --from=rpm-base /tmp/code-server-*.rpm /tmp/
369-
370- # Install code-server via rpm2cpio (dnf rejects unsigned RPMs built from source on Konflux/Conforma)
371- RUN /bin/bash <<'EOF'
372- set -Eeuxo pipefail
373- cd /
374- rpm2cpio /tmp/code-server-${CODESERVER_VERSION/v/}-*.rpm | cpio -idmv
375- EOF
347+ # Install code-server from built tree (no RPM: avoids unsigned-package issues on Konflux/Conforma).
348+ # Path in rpm-base: /root/codeserver/ubi9-python-3.12/prefetch-input/code-server/release-standalone
349+ COPY --from=rpm-base /root/codeserver/ubi9-python-3.12/prefetch-input/code-server/release-standalone/. /usr/lib/code-server/
350+ # Wrapper script (from code-server ci/build) that execs /usr/lib/code-server/bin/code-server
351+ COPY ${CODESERVER_SOURCE_CODE}/prefetch-input/code-server/ci/build/code-server-nfpm.sh /usr/bin/code-server
352+ RUN chmod 755 /usr/bin/code-server
376353
377354COPY --chown=1001:0 ${CODESERVER_SOURCE_CODE}/utils utils/
378355
0 commit comments