Merge pull request #1818 from freedomofpress/rust-packaging

Make Rust toolchain available during package building

scripts/Dockerfile

@@ -0,0 +1,28 @@
+ARG DISTRO=bullseye
+FROM debian:$DISTRO
+
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1
+ENV PIP_PROGRESS_BAR=off
+ENV CARGO_TERM_COLOR=never
+ENV CARGO_TERM_PROGRESS_WHEN=never
+
+RUN apt-get update && apt-get --yes upgrade && apt-get install --yes build-essential curl
+
+# Keep in sync with rust-toolchain.toml
+ENV RUST_VERSION 1.74.1
+ENV RUSTUP_VERSION 1.24.3
+ENV RUSTUP_INIT_SHA256 3dc5ef50861ee18657f9db2eeb7392f9c2a6c95c90ab41e45ab4ca71476b4338
+ENV RUSTUP_HOME /opt/rustup
+ENV CARGO_HOME /opt/cargo
+
+# Install Rust using the same steps as <https://github.com/rust-lang/docker-rust>
+# 1) Download rustup-init and verify it matches hardcoded checksum
+# 2) Run it to install rustup and the rustc/cargo "minimal" toolchain
+# 3) Add `/opt/cargo/bin` to $PATH, which is where cargo & rustc are installed
+RUN TMPDIR=`mktemp -d` && cd ${TMPDIR} \
+ && curl --proto '=https' --tlsv1.2 -OO -sSf https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x86_64-unknown-linux-gnu/rustup-init \
+ && echo "${RUSTUP_INIT_SHA256} *rustup-init" | sha256sum -c - \
+ && chmod +x rustup-init \
+ && ./rustup-init --default-toolchain=${RUST_VERSION} --profile minimal -y \
+ && cd && rm -rf ${TMPDIR}
+ENV PATH "$PATH:/opt/cargo/bin/"

scripts/build-debs.sh

@@ -39,11 +39,12 @@ fi
 export DEBIAN_VERSION="${DEBIAN_VERSION:-bullseye}"
 export OCI_RUN_ARGUMENTS
 export OCI_BIN
+export CONTAINER="fpf.local/sd-client-builder-${DEBIAN_VERSION}"
 
-$OCI_BIN pull debian:${DEBIAN_VERSION}
+. ./scripts/image_prep.sh
 
 $OCI_BIN run --rm $OCI_RUN_ARGUMENTS \
  -v "${BUILDER}:/builder:Z" \
  --env NIGHTLY="${NIGHTLY:-}" \
  --entrypoint "/src/scripts/build-debs-real.sh" \
- debian:${DEBIAN_VERSION}
+ $CONTAINER

scripts/dep-check.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Check if there are outstanding updates. This runs *inside* the container.
+
+apt-get update
+if apt-get upgrade -s | grep Inst; then
+ # We will catch status=42 in the outer wrapper and trigger
+ # a rebuild of the image to pull in the updates
+ exit 42
+fi
+
+exit 0

scripts/image_prep.sh

@@ -0,0 +1,39 @@
+set -euxo pipefail
+# Build the container if necessary. This runs *outside* the container.
+
+cd "$(git rev-parse --show-toplevel)"
+
+# First see if the image exists or not
+missing=false
+$OCI_BIN inspect $CONTAINER > /dev/null 2>&1 || missing=true
+
+if $missing; then
+ # Build it if it doesn't
+ $OCI_BIN build -t $CONTAINER scripts/ --no-cache \
+ --build-arg DISTRO=$DEBIAN_VERSION
+fi
+
+# Uncomment the following for fast development on adjusting builder logic
+# $OCI_BIN build -t $CONTAINER scripts/
+
+# Run the dependency check
+status=0
+$OCI_BIN run --rm $OCI_RUN_ARGUMENTS \
+ --entrypoint "/src/scripts/dep-check.sh" $CONTAINER || status=$?
+
+if [[ $status == 42 ]]; then
+ # There are some pending updates, so force rebuilding the image from scratch
+ # and try again!
+ echo "Rebuilding container to update dependencies"
+ $OCI_BIN rmi $CONTAINER
+ $OCI_BIN build -t $CONTAINER scripts/ --no-cache
+ # Reset $status and re-run the dependency check
+ status=0
+ $OCI_BIN run --rm $OCI_RUN_ARGUMENTS \
+ --entrypoint "/src/scripts/dep-check.sh" $CONTAINER || status=$?
+fi
+
+if [[ $status != 0 ]]; then
+ # If there's some other error, exit now
+ exit $status
+fi