Use packaging sources to build packages on non-mainstream architectures

nginxinc · Sep 11, 2024 · 5a950cc · 5a950cc
1 parent f76ccc0
commit 5a950cc
Show file tree

Hide file tree

Showing 4 changed files with 68 additions and 24 deletions.
diff --git a/.github/workflows/debian-mainline.yml b/.github/workflows/debian-mainline.yml
@@ -110,8 +110,8 @@ jobs:
  id: build
  uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
  with:
- platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
- # platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ # platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
  context: "{{ defaultContext }}:mainline/debian"
  labels: ${{ steps.meta.outputs.labels }}
  annotations: ${{ steps.meta.outputs.annotations }}
@@ -229,8 +229,8 @@ jobs:
  id: build
  uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
  with:
- platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
- # platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ # platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
  context: "{{ defaultContext }}:mainline/debian-perl"
  labels: ${{ steps.meta.outputs.labels }}
  annotations: ${{ steps.meta.outputs.annotations }}

diff --git a/.github/workflows/debian-stable.yml b/.github/workflows/debian-stable.yml
@@ -106,8 +106,8 @@ jobs:
  id: build
  uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
  with:
- platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
- # platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ # platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
  context: "{{ defaultContext }}:stable/debian"
  labels: ${{ steps.meta.outputs.labels }}
  annotations: ${{ steps.meta.outputs.annotations }}
@@ -217,8 +217,8 @@ jobs:
  id: build
  uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
  with:
- platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
- # platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ # platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
+ platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
  context: "{{ defaultContext }}:stable/debian-perl"
  labels: ${{ steps.meta.outputs.labels }}
  annotations: ${{ steps.meta.outputs.annotations }}

diff --git a/Dockerfile-debian-perl.template b/Dockerfile-debian-perl.template
@@ -19,24 +19,46 @@ RUN set -x; \
  ;; \
  *) \
 # we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
- echo "deb-src [signed-by=$NGINX_GPGKEY_PATH] %%PACKAGEREPO%% %%DEBIAN_VERSION%% nginx" >> /etc/apt/sources.list.d/nginx.list \
- \
+# let's build binaries from the published packaging sources
 # new directory for storing sources and .deb files
- && tempDir="$(mktemp -d)" \
+ tempDir="$(mktemp -d)" \
  && chmod 777 "$tempDir" \
 # (777 to ensure APT's "_apt" user can access it too)
  \
 # save list of currently-installed packages so build dependencies can be cleanly removed later
  && savedAptMark="$(apt-mark showmanual)" \
  \
-# build .deb files from upstream's source packages (which are verified by apt-get)
+# build .deb files from upstream's packaging sources
  && apt-get update \
- && apt-get build-dep -y %%BUILDTARGET%% \
+ && apt-get install --no-install-recommends --no-install-suggests -y \
+ curl \
+ devscripts \
+ equivs \
+ git \
+ libxml2-utils \
+ lsb-release \
+ xsltproc \
  && ( \
  cd "$tempDir" \
- && DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
- apt-get source --compile %%BUILDTARGET%% \
+ && REVISION="%%REVISION%%" \
+ && REVISION=${REVISION%~*} \
+ && curl -f -O https://hg.nginx.org/pkg-oss/archive/${REVISION}.tar.gz \
+ && PKGOSSCHECKSUM="%%PKGOSSCHECKSUM%% *${REVISION}.tar.gz" \
+ && if [ "$(openssl sha512 -r ${REVISION}.tar.gz)" = "$PKGOSSCHECKSUM" ]; then \
+ echo "pkg-oss tarball checksum verification succeeded!"; \
+ else \
+ echo "pkg-oss tarball checksum verification failed!"; \
+ exit 1; \
+ fi \
+ && tar xzvf ${REVISION}.tar.gz \
+ && cd pkg-oss-${REVISION} \
+ && cd debian \
+ && for target in %%BUILDTARGET%%; do \
+ make rules-$target; \
+ mk-build-deps --install --tool="apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes" \
+ debuild-$target/nginx-$NGINX_VERSION/debian/control; \
+ done \
+ && make %%BUILDTARGET%% \
  ) \
 # we don't remove APT lists here because they get re-downloaded and removed later
  \

diff --git a/Dockerfile-debian.template b/Dockerfile-debian.template
@@ -47,24 +47,46 @@ RUN set -x \
  ;; \
  *) \
 # we're on an architecture upstream doesn't officially build for
-# let's build binaries from the published source packages
- echo "deb-src [signed-by=$NGINX_GPGKEY_PATH] %%PACKAGEREPO%% %%DEBIAN_VERSION%% nginx" >> /etc/apt/sources.list.d/nginx.list \
- \
+# let's build binaries from the published packaging sources
 # new directory for storing sources and .deb files
- && tempDir="$(mktemp -d)" \
+ tempDir="$(mktemp -d)" \
  && chmod 777 "$tempDir" \
 # (777 to ensure APT's "_apt" user can access it too)
  \
 # save list of currently-installed packages so build dependencies can be cleanly removed later
  && savedAptMark="$(apt-mark showmanual)" \
  \
-# build .deb files from upstream's source packages (which are verified by apt-get)
+# build .deb files from upstream's packaging sources
  && apt-get update \
- && apt-get build-dep -y %%BUILDTARGET%% \
+ && apt-get install --no-install-recommends --no-install-suggests -y \
+ curl \
+ devscripts \
+ equivs \
+ git \
+ libxml2-utils \
+ lsb-release \
+ xsltproc \
  && ( \
  cd "$tempDir" \
- && DEB_BUILD_OPTIONS="nocheck parallel=$(nproc)" \
- apt-get source --compile %%BUILDTARGET%% \
+ && REVISION="%%REVISION%%" \
+ && REVISION=${REVISION%~*} \
+ && curl -f -O https://hg.nginx.org/pkg-oss/archive/${REVISION}.tar.gz \
+ && PKGOSSCHECKSUM="%%PKGOSSCHECKSUM%% *${REVISION}.tar.gz" \
+ && if [ "$(openssl sha512 -r ${REVISION}.tar.gz)" = "$PKGOSSCHECKSUM" ]; then \
+ echo "pkg-oss tarball checksum verification succeeded!"; \
+ else \
+ echo "pkg-oss tarball checksum verification failed!"; \
+ exit 1; \
+ fi \
+ && tar xzvf ${REVISION}.tar.gz \
+ && cd pkg-oss-${REVISION} \
+ && cd debian \
+ && for target in %%BUILDTARGET%%; do \
+ make rules-$target; \
+ mk-build-deps --install --tool="apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes" \
+ debuild-$target/nginx-$NGINX_VERSION/debian/control; \
+ done \
+ && make %%BUILDTARGET%% \
  ) \
 # we don't remove APT lists here because they get re-downloaded and removed later
  \