Skip to content

Commit 4c2a44e

Browse files
willcl-arkwillcl-ark
committed
Use bitcoin-core verify.py script
See: https://github.com/bitcoin/bitcoin/tree/master/contrib/verify-binaries Currently, we due to the way the bitcoin core verify script parses the version we must download multiple linux builds, then only use the the target arch. Hopefully the verify script can be updated to handle single platform (architecture:os) downloads, and if so in the future this can be updated. Switch to a two-stage build (like alpine), as we now download python which bloats the image size.
1 parent 8a3345a commit 4c2a44e

File tree

8 files changed

+257
-325
lines changed

8 files changed

+257
-325
lines changed

‎22/Dockerfile‎

Lines changed: 36 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,60 @@
1-
FROM debian:bullseye-slim
2-
3-
ARG UID=101
4-
ARG GID=101
1+
FROM debian:bullseye-slim as builder
52

63
LABEL maintainer.0="João Fonseca (@joaopaulofonseca)" \
74
maintainer.1="Pedro Branco (@pedrobranco)" \
85
maintainer.2="Rui Marinho (@ruimarinho)"
96

10-
RUN groupadd --gid ${GID} bitcoin \
11-
&& useradd --create-home --no-log-init -u ${UID} -g ${GID} bitcoin \
12-
&& apt-get update -y \
13-
&& apt-get install -y curl gnupg gosu \
7+
RUN apt-get update -y \
8+
&& apt-get install -y ca-certificates curl git gnupg gosu python3 wget --no-install-recommends \
149
&& apt-get clean \
1510
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
1611

1712
ARG TARGETPLATFORM
18-
ENV BITCOIN_VERSION=22.0
19-
ENV BITCOIN_DATA=/home/bitcoin/.bitcoin
20-
ENV PATH=/opt/bitcoin-${BITCOIN_VERSION}/bin:$PATH
13+
ENV BITCOIN_VERSION=22.1
14+
ENV SIGS_REPO_URL="https://github.com/bitcoin-core/guix.sigs.git"
15+
ENV SIGS_CLONE_DIR="guix.sigs"
16+
ENV VERIFY_SCRIPT_URL="https://raw.githubusercontent.com/bitcoin/bitcoin/master/contrib/verify-binaries/verify.py"
17+
ENV TMPDIR="/tmp/bitcoin_verify_binaries"
2118

2219
RUN set -ex \
2320
&& if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then export TARGETPLATFORM=x86_64-linux-gnu; fi \
2421
&& if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then export TARGETPLATFORM=aarch64-linux-gnu; fi \
2522
&& if [ "${TARGETPLATFORM}" = "linux/arm/v7" ]; then export TARGETPLATFORM=arm-linux-gnueabihf; fi \
26-
&& for key in \
27-
0CCBAAFD76A2ECE2CCD3141DE2FFD5B1D88CA97D \
28-
152812300785C96444D3334D17565732E08E5E41 \
29-
0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8 \
30-
590B7292695AFFA5B672CBB2E13FC145CD3F4304 \
31-
28F5900B1BB5D1A4B6B6D1A9ED357015286A333D \
32-
637DB1E23370F84AFF88CCE03152347D07DA627C \
33-
CFB16E21C950F67FA95E558F2EEB9F5CC09526C1 \
34-
6E01EEC9656903B0542B8F1003DB6322267C373B \
35-
D1DBF2C4B96F2DEBF4C16654410108112E7EA81F \
36-
82921A4B88FD454B7EB8CE3C796C4109063D4EAF \
37-
9DEAE0DC7063249FB05474681E4AED62986CD25D \
38-
9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C \
39-
74E2DEF5D77260B98BC19438099BAD163C70FBFA \
40-
; do \
41-
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" || \
42-
gpg --batch --keyserver keys.openpgp.org --recv-keys "$key" || \
43-
gpg --batch --keyserver pgp.mit.edu --recv-keys "$key" || \
44-
gpg --batch --keyserver keyserver.pgp.com --recv-keys "$key" || \
45-
gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \
46-
gpg --batch --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys "$key" ; \
47-
done \
48-
&& curl -SLO https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/bitcoin-${BITCOIN_VERSION}-${TARGETPLATFORM}.tar.gz \
49-
&& curl -SLO https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS \
50-
&& curl -SLO https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS.asc \
51-
&& gpg --verify SHA256SUMS.asc SHA256SUMS \
52-
&& grep " bitcoin-${BITCOIN_VERSION}-${TARGETPLATFORM}.tar.gz" SHA256SUMS | sha256sum -c - \
53-
&& tar -xzf *.tar.gz -C /opt \
54-
&& rm *.tar.gz *.asc \
23+
&& git clone ${SIGS_REPO_URL} ${SIGS_CLONE_DIR} \
24+
&& gpg --import "${SIGS_CLONE_DIR}"/builder-keys/* \
25+
&& curl -o verify.py ${VERIFY_SCRIPT_URL} \
26+
&& chmod +x verify.py \
27+
&& ./verify.py \
28+
--min-good-sigs 6 pub "${BITCOIN_VERSION}-linux" \
29+
&& tar -xzf "${TMPDIR}.${BITCOIN_VERSION}-linux/bitcoin-${BITCOIN_VERSION}-${TARGETPLATFORM}.tar.gz" -C /opt \
30+
&& rm -rf ${SIGS_CLONE_DIR} \
31+
&& rm -rf ${TMPDIR} \
5532
&& rm -rf /opt/bitcoin-${BITCOIN_VERSION}/bin/bitcoin-qt
5633

34+
# Second stage
35+
FROM debian:bullseye-slim
36+
37+
ARG UID=101
38+
ARG GID=101
39+
40+
ENV BITCOIN_DATA=/home/bitcoin/.bitcoin
41+
ENV BITCOIN_VERSION=22.1
42+
ENV PATH=/opt/bitcoin-${BITCOIN_VERSION}/bin:$PATH
43+
44+
RUN groupadd --gid ${GID} bitcoin \
45+
&& useradd --create-home --no-log-init -u ${UID} -g ${GID} bitcoin \
46+
&& apt-get update -y \
47+
&& apt-get install -y gosu --no-install-recommends \
48+
&& apt-get clean \
49+
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
50+
51+
COPY --from=builder /opt/bitcoin-${BITCOIN_VERSION} /opt/bitcoin-${BITCOIN_VERSION}
52+
5753
COPY docker-entrypoint.sh /entrypoint.sh
5854

5955
VOLUME ["/home/bitcoin/.bitcoin"]
60-
6156
EXPOSE 8332 8333 18332 18333 18443 18444 38333 38332
6257

6358
ENTRYPOINT ["/entrypoint.sh"]
64-
6559
RUN bitcoind -version | grep "Bitcoin Core version v${BITCOIN_VERSION}"
66-
6760
CMD ["bitcoind"]

‎22/alpine/Dockerfile‎

Lines changed: 36 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ RUN mkdir -p ${BERKELEYDB_PREFIX}
1717

1818
WORKDIR /${BERKELEYDB_VERSION}/build_unix
1919

20-
RUN ../dist/configure --enable-cxx --disable-shared --with-pic --prefix=${BERKELEYDB_PREFIX}
20+
RUN ../dist/configure --enable-cxx --disable-shared --with-pic --prefix=${BERKELEYDB_PREFIX} --build=aarch64-unknown-linux-gnu
2121
RUN make -j4
2222
RUN make install
2323
RUN rm -rf ${BERKELEYDB_PREFIX}/docs
@@ -35,62 +35,53 @@ RUN apk --no-cache add build-base
3535
RUN apk --no-cache add chrpath
3636
RUN apk --no-cache add file
3737
RUN apk --no-cache add gnupg
38+
RUN apk --no-cache add git
3839
RUN apk --no-cache add libevent-dev
3940
RUN apk --no-cache add libressl
4041
RUN apk --no-cache add libtool
4142
RUN apk --no-cache add linux-headers
4243
RUN apk --no-cache add sqlite-dev
4344
RUN apk --no-cache add zeromq-dev
44-
RUN set -ex \
45-
&& for key in \
46-
0CCBAAFD76A2ECE2CCD3141DE2FFD5B1D88CA97D \
47-
152812300785C96444D3334D17565732E08E5E41 \
48-
0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8 \
49-
590B7292695AFFA5B672CBB2E13FC145CD3F4304 \
50-
28F5900B1BB5D1A4B6B6D1A9ED357015286A333D \
51-
637DB1E23370F84AFF88CCE03152347D07DA627C \
52-
CFB16E21C950F67FA95E558F2EEB9F5CC09526C1 \
53-
6E01EEC9656903B0542B8F1003DB6322267C373B \
54-
D1DBF2C4B96F2DEBF4C16654410108112E7EA81F \
55-
82921A4B88FD454B7EB8CE3C796C4109063D4EAF \
56-
9DEAE0DC7063249FB05474681E4AED62986CD25D \
57-
9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C \
58-
74E2DEF5D77260B98BC19438099BAD163C70FBFA \
59-
; do \
60-
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" || \
61-
gpg --batch --keyserver keys.openpgp.org --recv-keys "$key" || \
62-
gpg --batch --keyserver keyserver.pgp.com --recv-keys "$key" || \
63-
gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \
64-
gpg --batch --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys "$key" ; \
65-
done
66-
67-
ENV BITCOIN_VERSION=22.0
68-
ENV BITCOIN_PREFIX=/opt/bitcoin-${BITCOIN_VERSION}
6945

70-
RUN wget https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS
71-
RUN wget https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS.asc
72-
RUN wget https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/bitcoin-${BITCOIN_VERSION}.tar.gz
73-
RUN gpg --verify SHA256SUMS.asc SHA256SUMS
74-
RUN grep " bitcoin-${BITCOIN_VERSION}.tar.gz\$" SHA256SUMS | sha256sum -c -
75-
RUN tar -xzf *.tar.gz
46+
ENV BITCOIN_VERSION=22.1
47+
ENV BITCOIN_PREFIX=/opt/bitcoin-${BITCOIN_VERSION}
48+
ENV BITCOIN_SOURCE_DIR=/bitcoin/src
49+
ENV SIGS_REPO_URL="https://github.com/bitcoin-core/guix.sigs.git"
50+
ENV SIGS_CLONE_DIR="guix.sigs"
51+
ENV VERIFY_SCRIPT_URL="https://github.com/bitcoin/bitcoin/raw/master/contrib/verify-binaries/verify.py"
7652

77-
WORKDIR /bitcoin-${BITCOIN_VERSION}
53+
WORKDIR /bitcoin
54+
RUN set -ex \
55+
&& wget https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/bitcoin-${BITCOIN_VERSION}.tar.gz \
56+
&& wget https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS \
57+
&& wget https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS.asc \
58+
&& git clone ${SIGS_REPO_URL} ${SIGS_CLONE_DIR} \
59+
&& gpg --import "${SIGS_CLONE_DIR}"/builder-keys/* \
60+
&& wget -O verify.py ${VERIFY_SCRIPT_URL} \
61+
&& chmod +x verify.py \
62+
&& ./verify.py bin SHA256SUMS \
63+
"bitcoin-${BITCOIN_VERSION}.tar.gz" \
64+
&& mkdir -p ${BITCOIN_SOURCE_DIR} \
65+
&& tar -xzf "bitcoin-${BITCOIN_VERSION}.tar.gz" -C ${BITCOIN_SOURCE_DIR} \
66+
&& rm -rf ${SIGS_CLONE_DIR}
67+
68+
WORKDIR "${BITCOIN_SOURCE_DIR}/bitcoin-${BITCOIN_VERSION}"
7869

7970
RUN sed -i '/AC_PREREQ/a\AR_FLAGS=cr' src/univalue/configure.ac
8071
RUN sed -i '/AX_PROG_CC_FOR_BUILD/a\AR_FLAGS=cr' src/secp256k1/configure.ac
8172
RUN sed -i s:sys/fcntl.h:fcntl.h: src/compat.h
8273
RUN ./autogen.sh
8374
RUN ./configure LDFLAGS=-L`ls -d /opt/db*`/lib/ CPPFLAGS=-I`ls -d /opt/db*`/include/ \
84-
--prefix=${BITCOIN_PREFIX} \
85-
--mandir=/usr/share/man \
86-
--disable-tests \
87-
--disable-bench \
88-
--disable-ccache \
89-
--with-gui=no \
90-
--with-utils \
91-
--with-libs \
92-
--with-sqlite=yes \
93-
--with-daemon
75+
--prefix=${BITCOIN_PREFIX} \
76+
--mandir=/usr/share/man \
77+
--disable-tests \
78+
--disable-bench \
79+
--disable-ccache \
80+
--with-gui=no \
81+
--with-utils \
82+
--with-libs \
83+
--with-sqlite=yes \
84+
--with-daemon
9485
RUN make -j4
9586
RUN make install
9687
RUN strip ${BITCOIN_PREFIX}/bin/bitcoin-cli
@@ -99,6 +90,7 @@ RUN strip ${BITCOIN_PREFIX}/bin/bitcoind
9990
RUN strip ${BITCOIN_PREFIX}/lib/libbitcoinconsensus.a
10091
RUN strip ${BITCOIN_PREFIX}/lib/libbitcoinconsensus.so.0.0.0
10192

93+
# Build stage for compiled artifacts
10294
FROM alpine
10395

10496
ARG UID=100
@@ -122,7 +114,7 @@ RUN apk --no-cache add \
122114
su-exec
123115

124116
ENV BITCOIN_DATA=/home/bitcoin/.bitcoin
125-
ENV BITCOIN_VERSION=22.0
117+
ENV BITCOIN_VERSION=22.1
126118
ENV BITCOIN_PREFIX=/opt/bitcoin-${BITCOIN_VERSION}
127119
ENV PATH=${BITCOIN_PREFIX}/bin:$PATH
128120

‎23/Dockerfile‎

Lines changed: 36 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,60 @@
1-
FROM debian:bullseye-slim
2-
3-
ARG UID=101
4-
ARG GID=101
1+
FROM debian:bullseye-slim as builder
52

63
LABEL maintainer.0="João Fonseca (@joaopaulofonseca)" \
74
maintainer.1="Pedro Branco (@pedrobranco)" \
85
maintainer.2="Rui Marinho (@ruimarinho)"
96

10-
RUN groupadd --gid ${GID} bitcoin \
11-
&& useradd --create-home --no-log-init -u ${UID} -g ${GID} bitcoin \
12-
&& apt-get update -y \
13-
&& apt-get install -y curl gnupg gosu \
7+
RUN apt-get update -y \
8+
&& apt-get install -y ca-certificates curl git gnupg gosu python3 wget --no-install-recommends \
149
&& apt-get clean \
1510
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
1611

1712
ARG TARGETPLATFORM
18-
ENV BITCOIN_VERSION=23.0
19-
ENV BITCOIN_DATA=/home/bitcoin/.bitcoin
20-
ENV PATH=/opt/bitcoin-${BITCOIN_VERSION}/bin:$PATH
13+
ENV BITCOIN_VERSION=23.2
14+
ENV SIGS_REPO_URL="https://github.com/bitcoin-core/guix.sigs.git"
15+
ENV SIGS_CLONE_DIR="guix.sigs"
16+
ENV VERIFY_SCRIPT_URL="https://raw.githubusercontent.com/bitcoin/bitcoin/master/contrib/verify-binaries/verify.py"
17+
ENV TMPDIR="/tmp/bitcoin_verify_binaries"
2118

2219
RUN set -ex \
2320
&& if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then export TARGETPLATFORM=x86_64-linux-gnu; fi \
2421
&& if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then export TARGETPLATFORM=aarch64-linux-gnu; fi \
2522
&& if [ "${TARGETPLATFORM}" = "linux/arm/v7" ]; then export TARGETPLATFORM=arm-linux-gnueabihf; fi \
26-
&& for key in \
27-
152812300785C96444D3334D17565732E08E5E41 \
28-
0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8 \
29-
590B7292695AFFA5B672CBB2E13FC145CD3F4304 \
30-
28F5900B1BB5D1A4B6B6D1A9ED357015286A333D \
31-
637DB1E23370F84AFF88CCE03152347D07DA627C \
32-
CFB16E21C950F67FA95E558F2EEB9F5CC09526C1 \
33-
F4FC70F07310028424EFC20A8E4256593F177720 \
34-
D1DBF2C4B96F2DEBF4C16654410108112E7EA81F \
35-
287AE4CA1187C68C08B49CB2D11BD4F33F1DB499 \
36-
F9A8737BF4FF5C89C903DF31DD78544CF91B1514 \
37-
9DEAE0DC7063249FB05474681E4AED62986CD25D \
38-
E463A93F5F3117EEDE6C7316BD02942421F4889F \
39-
9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C \
40-
4DAF18FE948E7A965B30F9457E296D555E7F63A7 \
41-
28E72909F1717FE9607754F8A7BEB2621678D37D \
42-
74E2DEF5D77260B98BC19438099BAD163C70FBFA \
43-
; do \
44-
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" || \
45-
gpg --batch --keyserver keys.openpgp.org --recv-keys "$key" || \
46-
gpg --batch --keyserver pgp.mit.edu --recv-keys "$key" || \
47-
gpg --batch --keyserver keyserver.pgp.com --recv-keys "$key" || \
48-
gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \
49-
gpg --batch --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys "$key" ; \
50-
done \
51-
&& curl -SL https://raw.githubusercontent.com/Kvaciral/kvaciral/main/kvaciral.asc | gpg --import \
52-
&& curl -SLO https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/bitcoin-${BITCOIN_VERSION}-${TARGETPLATFORM}.tar.gz \
53-
&& curl -SLO https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS \
54-
&& curl -SLO https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS.asc \
55-
&& gpg --verify SHA256SUMS.asc SHA256SUMS \
56-
&& grep " bitcoin-${BITCOIN_VERSION}-${TARGETPLATFORM}.tar.gz" SHA256SUMS | sha256sum -c - \
57-
&& tar -xzf *.tar.gz -C /opt \
58-
&& rm *.tar.gz *.asc \
23+
&& git clone ${SIGS_REPO_URL} ${SIGS_CLONE_DIR} \
24+
&& gpg --import "${SIGS_CLONE_DIR}"/builder-keys/* \
25+
&& curl -o verify.py ${VERIFY_SCRIPT_URL} \
26+
&& chmod +x verify.py \
27+
&& ./verify.py \
28+
--min-good-sigs 6 pub "${BITCOIN_VERSION}-linux" \
29+
&& tar -xzf "${TMPDIR}.${BITCOIN_VERSION}-linux/bitcoin-${BITCOIN_VERSION}-${TARGETPLATFORM}.tar.gz" -C /opt \
30+
&& rm -rf ${SIGS_CLONE_DIR} \
31+
&& rm -rf ${TMPDIR} \
5932
&& rm -rf /opt/bitcoin-${BITCOIN_VERSION}/bin/bitcoin-qt
6033

34+
# Second stage
35+
FROM debian:bullseye-slim
36+
37+
ARG UID=101
38+
ARG GID=101
39+
40+
ENV BITCOIN_DATA=/home/bitcoin/.bitcoin
41+
ENV BITCOIN_VERSION=23.2
42+
ENV PATH=/opt/bitcoin-${BITCOIN_VERSION}/bin:$PATH
43+
44+
RUN groupadd --gid ${GID} bitcoin \
45+
&& useradd --create-home --no-log-init -u ${UID} -g ${GID} bitcoin \
46+
&& apt-get update -y \
47+
&& apt-get install -y gosu --no-install-recommends \
48+
&& apt-get clean \
49+
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
50+
51+
COPY --from=builder /opt/bitcoin-${BITCOIN_VERSION} /opt/bitcoin-${BITCOIN_VERSION}
52+
6153
COPY docker-entrypoint.sh /entrypoint.sh
6254

6355
VOLUME ["/home/bitcoin/.bitcoin"]
64-
6556
EXPOSE 8332 8333 18332 18333 18443 18444 38333 38332
6657

6758
ENTRYPOINT ["/entrypoint.sh"]
68-
6959
RUN bitcoind -version | grep "Bitcoin Core version v${BITCOIN_VERSION}"
70-
7160
CMD ["bitcoind"]

0 commit comments

Comments
 (0)