Skip to content

Commit 640f5ad

Browse files
EgorPopelyaevchevdor
EgorPopelyaev
and
chevdor
authored
exclude polkadot-parachain.asc and .sha256 from .dockerignore (#3013) (#3017)
* exclude polkadot-parachain .asc and .sha256 from .dockerignore * refactor docker image creation GHA * add debug * try without quotes * test action * add quotes * fix quotes atumated image publishing GHA * delete old unused part --------- Co-authored-by: Chevdor <[email protected]>
1 parent 7577d06 commit 640f5ad

File tree

5 files changed

+102
-71
lines changed

5 files changed

+102
-71
lines changed

‎cumulus/.dockerignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
**/*.txt
44
**/*.md
55
/docker/
6-
!/target/release/polkadot-parachain
6+
!/target/release-artifacts/**/*
77

88
# dotfiles in the repo root
99
/.*

‎cumulus/.github/workflows/release-50_docker-manual.yml‎

Lines changed: 49 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ jobs:
2020
docker_build_publish:
2121
env:
2222
BINARY: polkadot-parachain
23-
TMP: tmp
2423
runs-on: ubuntu-latest
2524

2625
steps:
@@ -31,8 +30,11 @@ jobs:
3130

3231
- name: Prepare temp folder
3332
run: |
34-
mkdir ${TMP}
35-
ls -al
33+
TMP=$(mktemp -d)
34+
echo "TMP folder: $TMP"
35+
echo "TMP=$TMP" >> $GITHUB_ENV
36+
pwd
37+
ls -al "$TMP"
3638
3739
- name: Fetch files from release
3840
working-directory: ${{ env.TMP }}
@@ -49,45 +51,65 @@ jobs:
4951
chmod a+x $BINARY
5052
ls -al
5153
52-
- name: Check files
54+
- name: Check SHA256
5355
working-directory: ${{ env.TMP }}
5456
run: |
5557
ls -al *$BINARY*
5658
shasum -a 256 -c $BINARY.sha256
5759
sha_result=$?
5860
59-
KEY_PARITY_SEC=9D4B2B6EB8F97156D19669A9FF0812D491B96798
60-
KEY_CHEVDOR=2835EAF92072BC01D188AF2C4A092B93E97CE1E2
61-
KEYSERVER=keyserver.ubuntu.com
62-
63-
gpg --keyserver $KEYSERVER --receive-keys $KEY_PARITY_SEC
64-
if [[ ${{ github.event.inputs.prerelease }} == "true" ]]; then
65-
gpg --keyserver $KEYSERVER --receive-keys $KEY_CHEVDOR
66-
fi
67-
68-
gpg --verify $BINARY.asc
69-
gpg_result=$?
70-
7161
echo sha_result: $sha_result
72-
echo gpg_result: $gpg_result
7362
74-
# If it fails, it would fail earlier but a second check
75-
# does not hurt in case of refactoring...
76-
if [[ $sha_result -ne 0 || $gpg_result -ne 0 ]]; then
77-
echo "Check failed, exiting with error"
63+
if [[ $sha_result -ne 0 ]]; then
64+
echo "SHA256 check failed, exiting with error"
7865
exit 1
7966
else
80-
echo "Checks passed"
67+
echo "SHA256 check passed"
8168
fi
8269
70+
- name: Check GPG
71+
working-directory: ${{ env.TMP }}
72+
run: |
73+
KEY_PARITY_SEC=9D4B2B6EB8F97156D19669A9FF0812D491B96798
74+
KEY_CHEVDOR=2835EAF92072BC01D188AF2C4A092B93E97CE1E2
75+
KEY_EGOR=E6FC4D4782EB0FA64A4903CCDB7D3555DD3932D3
76+
KEYSERVER=keyserver.ubuntu.com
77+
78+
gpg --keyserver $KEYSERVER --receive-keys $KEY_PARITY_SEC
79+
echo -e "5\ny\n" | gpg --no-tty --command-fd 0 --expert --edit-key $KEY_PARITY_SEC trust;
80+
81+
if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
82+
for key in $KEY_CHEVDOR $KEY_EGOR; do
83+
(
84+
echo "Importing GPG key $key"
85+
gpg --no-tty --quiet --keyserver $GPG_KEYSERVER --recv-keys $key
86+
echo -e "4\ny\n" | gpg --no-tty --command-fd 0 --expert --edit-key $key trust;
87+
) &
88+
done
89+
wait
90+
fi
91+
92+
gpg --no-tty --verify $BINARY.asc
93+
gpg_result=$?
94+
95+
echo gpg_result: $gpg_result
96+
97+
if [[ $gpg_result -ne 0 ]]; then
98+
echo "GPG check failed, exiting with error"
99+
exit 1
100+
else
101+
echo "GPG check passed"
102+
fi
103+
83104
- name: Build injected image
84105
env:
85-
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
86106
DOCKERHUB_ORG: parity
107+
OWNER: ${{ env.DOCKERHUB_ORG }}
108+
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
109+
IMAGE_NAME: polkadot-parachain
87110
run: |
88-
export OWNER=$DOCKERHUB_ORG
89-
mkdir -p target/release
90-
cp -f ${TMP}/$BINARY* target/release/
111+
mkdir -p target/release-artifacts
112+
cp -f ${TMP}/$BINARY* target/release-artifacts/
91113
./docker/scripts/build-injected-image.sh
92114
93115
- name: Login to Dockerhub
@@ -131,4 +153,4 @@ jobs:
131153
docker push $DOCKERHUB_ORG/$BINARY:$SEMVER
132154
fi
133155
134-
docker images | grep $DOCKERHUB_ORG/$BINARY
156+
docker images

‎cumulus/.github/workflows/release-50_docker.yml‎

Lines changed: 39 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ jobs:
1515
docker_build_publish:
1616
env:
1717
BINARY: polkadot-parachain
18-
TMP: tmp
1918
runs-on: ubuntu-latest
2019

2120
steps:
@@ -26,8 +25,10 @@ jobs:
2625

2726
- name: Prepare temp folder
2827
run: |
29-
mkdir ${TMP}
30-
ls -al
28+
TMP=$(mktemp -d)
29+
echo "TMP=$TMP" >> "$GITHUB_ENV"
30+
pwd
31+
ls -al "$TMP"
3132
3233
- name: Fetch files from release
3334
working-directory: ${{ env.TMP }}
@@ -48,45 +49,65 @@ jobs:
4849
chmod a+x $BINARY
4950
ls -al
5051
51-
- name: Check files
52+
- name: Check SHA256
5253
working-directory: ${{ env.TMP }}
5354
run: |
5455
ls -al *$BINARY*
5556
shasum -a 256 -c $BINARY.sha256
5657
sha_result=$?
5758
59+
echo sha_result: $sha_result
60+
61+
if [[ $sha_result -ne 0 ]]; then
62+
echo "SHA256 check failed, exiting with error"
63+
exit 1
64+
else
65+
echo "SHA256 check passed"
66+
fi
67+
68+
- name: Check GPG
69+
working-directory: ${{ env.TMP }}
70+
run: |
5871
KEY_PARITY_SEC=9D4B2B6EB8F97156D19669A9FF0812D491B96798
5972
KEY_CHEVDOR=2835EAF92072BC01D188AF2C4A092B93E97CE1E2
73+
KEY_EGOR=E6FC4D4782EB0FA64A4903CCDB7D3555DD3932D3
6074
KEYSERVER=keyserver.ubuntu.com
6175
6276
gpg --keyserver $KEYSERVER --receive-keys $KEY_PARITY_SEC
63-
if [[ ${{ github.event.release.prerelease }} == "true" ]]; then
64-
gpg --keyserver $KEYSERVER --receive-keys $KEY_CHEVDOR
77+
echo -e "5\ny\n" | gpg --no-tty --command-fd 0 --expert --edit-key $KEY_PARITY_SEC trust;
78+
79+
if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
80+
for key in $KEY_CHEVDOR $KEY_EGOR; do
81+
(
82+
echo "Importing GPG key $key"
83+
gpg --no-tty --quiet --keyserver $GPG_KEYSERVER --recv-keys $key
84+
echo -e "4\ny\n" | gpg --no-tty --command-fd 0 --expert --edit-key $key trust;
85+
) &
86+
done
87+
wait
6588
fi
6689
67-
gpg --verify $BINARY.asc
90+
gpg --no-tty --verify $BINARY.asc
6891
gpg_result=$?
6992
70-
echo sha_result: $sha_result
7193
echo gpg_result: $gpg_result
7294
73-
# If it fails, it would fail earlier but a second check
74-
# does not hurt in case of refactoring...
75-
if [[ $sha_result -ne 0 || $gpg_result -ne 0 ]]; then
76-
echo "Check failed, exiting with error"
95+
if [[ $gpg_result -ne 0 ]]; then
96+
echo "GPG check failed, exiting with error"
7797
exit 1
7898
else
79-
echo "Checks passed"
99+
echo "GPG check passed"
80100
fi
81101
82102
- name: Build injected image
83103
env:
84-
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
85104
DOCKERHUB_ORG: parity
105+
OWNER: ${{ env.DOCKERHUB_ORG }}
106+
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
107+
IMAGE_NAME: polkadot-parachain
86108
run: |
87-
export OWNER=$DOCKERHUB_ORG
88-
mkdir -p target/release
89-
cp -f ${TMP}/$BINARY* target/release/
109+
mkdir -p target/release-artifacts
110+
cp -f ${TMP}/$BINARY* target/release-artifacts/
90111
./docker/scripts/build-injected-image.sh
91112
92113
- name: Login to Dockerhub
@@ -130,4 +151,4 @@ jobs:
130151
docker push $DOCKERHUB_ORG/$BINARY:$SEMVER
131152
fi
132153
133-
docker images | grep $DOCKERHUB_ORG/$BINARY
154+
docker images

‎cumulus/docker/injected.Dockerfile‎

Lines changed: 8 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM docker.io/library/ubuntu:20.04
1+
FROM docker.io/parity/base-bin
22

33
# metadata
44
ARG VCS_REF
@@ -17,35 +17,20 @@ LABEL io.parity.image.authors="[email protected]" \
1717
# show backtraces
1818
ENV RUST_BACKTRACE 1
1919

20-
# install tools and dependencies
21-
RUN apt-get update && \
22-
DEBIAN_FRONTEND=noninteractive apt-get install -y \
23-
libssl1.1 \
24-
ca-certificates \
25-
curl && \
26-
# apt cleanup
27-
apt-get autoremove -y && \
28-
apt-get clean && \
29-
find /var/lib/apt/lists/ -type f -not -name lock -delete; \
30-
# add user and link ~/.local/share/polkadot to /data
31-
useradd -m -u 1000 -U -s /bin/sh -d /polkadot polkadot && \
32-
mkdir -p /data /polkadot/.local/share && \
33-
chown -R polkadot:polkadot /data && \
34-
ln -s /data /polkadot/.local/share/polkadot && \
35-
mkdir -p /specs
20+
USER root
21+
22+
RUN mkdir -p /specs
3623

3724
# add polkadot-parachain binary to the docker image
38-
COPY ./target/release/polkadot-parachain /usr/local/bin
39-
COPY ./target/release/polkadot-parachain.asc /usr/local/bin
40-
COPY ./target/release/polkadot-parachain.sha256 /usr/local/bin
25+
COPY ./target/release-artifacts/* /usr/local/bin
4126
COPY ./parachains/chain-specs/*.json /specs/
4227

43-
USER polkadot
28+
USER parity
4429

4530
# check if executable works in this container
4631
RUN /usr/local/bin/polkadot-parachain --version
4732

48-
EXPOSE 30333 9933 9944
49-
VOLUME ["/polkadot"]
33+
EXPOSE 30333 9933 9944 9615
34+
VOLUME ["/polkadot", "/specs"]
5035

5136
ENTRYPOINT ["/usr/local/bin/polkadot-parachain"]

‎cumulus/docker/scripts/build-injected-image.sh‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,8 @@
22

33
OWNER=${OWNER:-parity}
44
IMAGE_NAME=${IMAGE_NAME:-polkadot-parachain}
5-
docker build --no-cache --build-arg IMAGE_NAME=$IMAGE_NAME -t $OWNER/$IMAGE_NAME -f ./docker/injected.Dockerfile .
6-
docker images | grep $IMAGE_NAME
5+
docker build --no-cache \
6+
--build-arg IMAGE_NAME=$IMAGE_NAME \
7+
-t $OWNER/$IMAGE_NAME \
8+
-f ./docker/injected.Dockerfile \
9+
. && docker images

0 commit comments

Comments
 (0)