|
| 1 | +# syntax=docker/dockerfile:1 |
| 2 | +ARG BASE_IMAGE=docker.io/polymathrobotics/buildpack-deps:noble-scm |
| 3 | +FROM $BASE_IMAGE AS base |
| 4 | + |
| 5 | +FROM base AS build |
| 6 | + |
| 7 | +ENV PATH /usr/local/go/bin:$PATH |
| 8 | + |
| 9 | +ENV GOLANG_VERSION=1.24.4 |
| 10 | + |
| 11 | +SHELL ["/bin/bash", "-o", "pipefail", "-c"] |
| 12 | +# hadolint ignore=DL3003, SC2086 |
| 13 | +RUN set -eux; \ |
| 14 | + now="$(date '+%s')"; \ |
| 15 | + arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \ |
| 16 | + url=; \ |
| 17 | + case "$arch" in \ |
| 18 | + 'amd64') \ |
| 19 | + url='https://dl.google.com/go/go1.24.4.linux-amd64.tar.gz'; \ |
| 20 | + sha256='77e5da33bb72aeaef1ba4418b6fe511bc4d041873cbf82e5aa6318740df98717'; \ |
| 21 | + ;; \ |
| 22 | + 'armhf') \ |
| 23 | + url='https://dl.google.com/go/go1.24.4.linux-armv6l.tar.gz'; \ |
| 24 | + sha256='6a554e32301cecae3162677e66d4264b81b3b1a89592dd1b7b5c552c7a49fe37'; \ |
| 25 | + ;; \ |
| 26 | + 'arm64') \ |
| 27 | + url='https://dl.google.com/go/go1.24.4.linux-arm64.tar.gz'; \ |
| 28 | + sha256='d5501ee5aca0f258d5fe9bfaed401958445014495dc115f202d43d5210b45241'; \ |
| 29 | + ;; \ |
| 30 | + 'i386') \ |
| 31 | + url='https://dl.google.com/go/go1.24.4.linux-386.tar.gz'; \ |
| 32 | + sha256='130c9b061082eca15513e595e9952a2ded32e737e609dd0e49f7dfa74eba026d'; \ |
| 33 | + ;; \ |
| 34 | + 'mips64el') \ |
| 35 | + url='https://dl.google.com/go/go1.24.4.linux-mips64le.tar.gz'; \ |
| 36 | + sha256='fa763d8673f94d6e534bb72c3cf675d4c2b8da4a6da42a89f08c5586106db39c'; \ |
| 37 | + ;; \ |
| 38 | + 'ppc64el') \ |
| 39 | + url='https://dl.google.com/go/go1.24.4.linux-ppc64le.tar.gz'; \ |
| 40 | + sha256='9ca4afef813a2578c23843b640ae0290aa54b2e3c950a6cc4c99e16a57dec2ec'; \ |
| 41 | + ;; \ |
| 42 | + 'riscv64') \ |
| 43 | + url='https://dl.google.com/go/go1.24.4.linux-riscv64.tar.gz'; \ |
| 44 | + sha256='1d7034f98662d8f2c8abd7c700ada4093acb4f9c00e0e51a30344821d0785c77'; \ |
| 45 | + ;; \ |
| 46 | + 's390x') \ |
| 47 | + url='https://dl.google.com/go/go1.24.4.linux-s390x.tar.gz'; \ |
| 48 | + sha256='0449f3203c39703ab27684be763e9bb78ca9a051e0e4176727aead9461b6deb5'; \ |
| 49 | + ;; \ |
| 50 | + *) echo >&2 "error: unsupported architecture '$arch' (likely packaging update needed)"; exit 1 ;; \ |
| 51 | + esac; \ |
| 52 | + \ |
| 53 | + wget -O go.tgz.asc "$url.asc"; \ |
| 54 | + wget -O go.tgz "$url" --progress=dot:giga; \ |
| 55 | + echo "$sha256 *go.tgz" | sha256sum -c -; \ |
| 56 | + \ |
| 57 | +# https://github.com/golang/go/issues/14739#issuecomment-324767697 |
| 58 | + GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \ |
| 59 | +# https://www.google.com/linuxrepositories/ |
| 60 | + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 'EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796'; \ |
| 61 | +# let's also fetch the specific subkey of that key explicitly that we expect "go.tgz.asc" to be signed by, just to make sure we definitely have it |
| 62 | + gpg --batch --keyserver keyserver.ubuntu.com --recv-keys '2F52 8D36 D67B 69ED F998 D857 78BD 6547 3CB3 BD13'; \ |
| 63 | + gpg --batch --verify go.tgz.asc go.tgz; \ |
| 64 | + gpgconf --kill all; \ |
| 65 | + rm -rf "$GNUPGHOME" go.tgz.asc; \ |
| 66 | + \ |
| 67 | + tar -C /usr/local -xzf go.tgz; \ |
| 68 | + rm go.tgz; \ |
| 69 | + \ |
| 70 | +# save the timestamp from the tarball so we can restore it for reproducibility, if necessary (see below) |
| 71 | + SOURCE_DATE_EPOCH="$(stat -c '%Y' /usr/local/go)"; \ |
| 72 | + export SOURCE_DATE_EPOCH; \ |
| 73 | + touchy="$(date -d "@$SOURCE_DATE_EPOCH" '+%Y%m%d%H%M.%S')"; \ |
| 74 | +# for logging validation/edification |
| 75 | + date --date "@$SOURCE_DATE_EPOCH" --rfc-2822; \ |
| 76 | +# sanity check (detected value should be older than our wall clock) |
| 77 | + [ "$SOURCE_DATE_EPOCH" -lt "$now" ]; \ |
| 78 | + \ |
| 79 | + if [ "$arch" = 'armhf' ]; then \ |
| 80 | + [ -s /usr/local/go/go.env ]; \ |
| 81 | + before="$(go env GOARM)"; [ "$before" != '7' ]; \ |
| 82 | + { \ |
| 83 | + echo; \ |
| 84 | + echo '# https://github.com/docker-library/golang/issues/494'; \ |
| 85 | + echo 'GOARM=7'; \ |
| 86 | + } >> /usr/local/go/go.env; \ |
| 87 | + after="$(go env GOARM)"; [ "$after" = '7' ]; \ |
| 88 | +# (re-)clamp timestamp for reproducibility (allows "COPY --link" to be more clever/useful) |
| 89 | + touch -t "$touchy" /usr/local/go/go.env /usr/local/go; \ |
| 90 | + fi; \ |
| 91 | + \ |
| 92 | +# ideally at this point, we would just "COPY --link ... /usr/local/go/ /usr/local/go/" but BuildKit insists on creating the parent directories (perhaps related to https://github.com/opencontainers/image-spec/pull/970), and does so with unreproducible timestamps, so we instead create a whole new "directory tree" that we can "COPY --link" to accomplish what we want |
| 93 | + mkdir /target /target/usr /target/usr/local; \ |
| 94 | + mv -vT /usr/local/go /target/usr/local/go; \ |
| 95 | + ln -svfT /target/usr/local/go /usr/local/go; \ |
| 96 | + touch -t "$touchy" /target/usr/local /target/usr /target; \ |
| 97 | + \ |
| 98 | +# smoke test |
| 99 | + go version; \ |
| 100 | +# make sure our reproducibile timestamp is probably still correct (best-effort inline reproducibility test) |
| 101 | + epoch="$(stat -c '%Y' /target/usr/local/go)"; \ |
| 102 | + [ "$SOURCE_DATE_EPOCH" = "$epoch" ]; \ |
| 103 | + find /target -newer /target/usr/local/go -exec sh -c 'ls -ld "$@" && exit "$#"' -- '{}' + |
| 104 | + |
| 105 | +FROM base |
| 106 | + |
| 107 | +# install cgo-related dependencies |
| 108 | +RUN set -eux; \ |
| 109 | + apt-get update; \ |
| 110 | + apt-get install -y --no-install-recommends \ |
| 111 | + g++ \ |
| 112 | + gcc \ |
| 113 | + libc6-dev \ |
| 114 | + make \ |
| 115 | + pkg-config \ |
| 116 | + ; \ |
| 117 | + rm -rf /var/lib/apt/lists/* |
| 118 | + |
| 119 | +ENV GOLANG_VERSION=1.24.4 |
| 120 | + |
| 121 | +# don't auto-upgrade the gotoolchain |
| 122 | +# https://github.com/docker-library/golang/issues/472 |
| 123 | +ENV GOTOOLCHAIN=local |
| 124 | + |
| 125 | +ENV GOPATH /go |
| 126 | +ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH |
| 127 | +# (see notes above about "COPY --link") |
| 128 | +COPY --from=build --link /target/ / |
| 129 | +RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH" |
| 130 | +WORKDIR $GOPATH |
0 commit comments