docs: provide reproducible multi-platform publisher

2026-08-13 07:34:47 +00:00
parent 0311f6f084
commit cd3a9b3c0d
2 changed files with 100 additions and 14 deletions
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Publish one complete Archive Control client OCI image index.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/publish-image.sh <semver> [--also-latest]
+
+Builds and pushes sodium/archive-clients for linux/amd64 and linux/arm64.
+Docker must already be authenticated to the target registry.
+EOF
+}
+
+if [[ $# -lt 1 || ${1:-} == '-h' || ${1:-} == '--help' ]]; then
+  usage
+  exit 2
+fi
+
+tag=$1
+shift
+also_latest=false
+if [[ ${1:-} == '--also-latest' ]]; then
+  also_latest=true
+  shift
+fi
+if [[ $# -ne 0 ]]; then
+  usage
+  exit 2
+fi
+
+repository=${IMAGE_REPOSITORY:-sodium/archive-clients}
+builder=${BUILDER:-archive-control-release}
+buildkit_image=${BUILDKIT_IMAGE:-moby/buildkit:rootless}
+# Nested Docker hosts can reject default OCI /proc mount masking. Rootless
+# BuildKit confines this compatibility flag to the disposable release builder.
+buildkitd_flags=${BUILDKITD_FLAGS:---oci-worker-no-process-sandbox}
+binfmt_image=${BINFMT_IMAGE:-tonistiigi/binfmt}
+host_arch=$(docker version --format '{{.Server.Arch}}')
+case ${host_arch} in
+  arm64|aarch64) emulated_arch=amd64 ;;
+  amd64|x86_64) emulated_arch=arm64 ;;
+  *) echo "Unsupported Docker server architecture: ${host_arch}" >&2; exit 1 ;;
+esac
+
+builder_created=false
+binfmt_installed=false
+cleanup() {
+  local status=$?
+  trap - EXIT
+  if [[ ${builder_created} == true ]]; then
+    docker buildx rm "${builder}" >/dev/null 2>&1 || true
+  fi
+  if [[ ${binfmt_installed} == true ]]; then
+    docker run --privileged --rm "${binfmt_image}" --uninstall "${emulated_arch}" \
+      >/dev/null 2>&1 || true
+  fi
+  exit "${status}"
+}
+trap cleanup EXIT
+
+docker run --privileged --rm "${binfmt_image}" --install "${emulated_arch}" \
+  >/dev/null
+binfmt_installed=true
+if docker buildx inspect "${builder}" >/dev/null 2>&1; then
+  docker buildx rm "${builder}" >/dev/null
+fi
+docker buildx create --name "${builder}" --driver docker-container \
+  --driver-opt "image=${buildkit_image}" \
+  --buildkitd-flags "${buildkitd_flags}" --use >/dev/null
+builder_created=true
+
+platforms=$(docker buildx inspect "${builder}" --bootstrap 2>&1)
+for platform in linux/amd64 linux/arm64; do
+  if ! grep -Fq "${platform}" <<<"${platforms}"; then
+    echo "Builder ${builder} does not support ${platform}; refusing partial release." >&2
+    exit 1
+  fi
+done
+
+tags=(--tag "${repository}:${tag}")
+if [[ ${also_latest} == true ]]; then
+  tags+=(--tag "${repository}:latest")
+fi
+docker buildx build --pull --platform linux/amd64,linux/arm64 \
+  --push "${tags[@]}" .
+docker buildx imagetools inspect "${repository}:${tag}"