106 lines
3.0 KiB
Bash
Executable File
106 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Publish one complete Archive Control client OCI image index.
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: scripts/publish-image.sh <semver> [--also-latest]
|
|
|
|
Builds and pushes sodium/archive-clients for linux/amd64 and linux/arm64.
|
|
Docker must already be authenticated to the target registry.
|
|
EOF
|
|
}
|
|
|
|
if [[ $# -lt 1 || ${1:-} == '-h' || ${1:-} == '--help' ]]; then
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
tag=$1
|
|
shift
|
|
also_latest=false
|
|
if [[ ${1:-} == '--also-latest' ]]; then
|
|
also_latest=true
|
|
shift
|
|
fi
|
|
if [[ $# -ne 0 ]]; then
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
repository=${IMAGE_REPOSITORY:-sodium/archive-clients}
|
|
builder=${BUILDER:-archive-control-release}
|
|
buildkit_image=${BUILDKIT_IMAGE:-moby/buildkit:rootless}
|
|
# Nested Docker hosts can reject default OCI /proc mount masking. Rootless
|
|
# BuildKit confines this compatibility flag to the disposable release builder.
|
|
buildkitd_flags=${BUILDKITD_FLAGS:---oci-worker-no-process-sandbox}
|
|
binfmt_image=${BINFMT_IMAGE:-tonistiigi/binfmt}
|
|
host_arch=$(docker version --format '{{.Server.Arch}}')
|
|
case ${host_arch} in
|
|
arm64|aarch64) emulated_arch=amd64 ;;
|
|
amd64|x86_64) emulated_arch=arm64 ;;
|
|
*) echo "Unsupported Docker server architecture: ${host_arch}" >&2; exit 1 ;;
|
|
esac
|
|
|
|
builder_created=false
|
|
binfmt_installed=false
|
|
cleanup() {
|
|
local status=$?
|
|
trap - EXIT
|
|
if [[ ${builder_created} == true ]]; then
|
|
docker buildx rm "${builder}" >/dev/null 2>&1 || true
|
|
fi
|
|
if [[ ${binfmt_installed} == true ]]; then
|
|
docker run --privileged --rm "${binfmt_image}" --uninstall "${emulated_arch}" \
|
|
>/dev/null 2>&1 || true
|
|
fi
|
|
exit "${status}"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
docker run --privileged --rm "${binfmt_image}" --install "${emulated_arch}" \
|
|
>/dev/null
|
|
binfmt_installed=true
|
|
if docker buildx inspect "${builder}" >/dev/null 2>&1; then
|
|
docker buildx rm "${builder}" >/dev/null
|
|
fi
|
|
docker buildx create --name "${builder}" --driver docker-container \
|
|
--driver-opt "image=${buildkit_image}" \
|
|
--buildkitd-flags "${buildkitd_flags}" --use >/dev/null
|
|
builder_created=true
|
|
|
|
# A newly-created rootless worker can publish its native platform before it has
|
|
# observed the just-registered binfmt handler. Do not mistake that brief
|
|
# startup state for a partial-release-capable builder.
|
|
platforms=''
|
|
supports_all=false
|
|
for attempt in {1..10}; do
|
|
platforms=$(docker buildx inspect "${builder}" --bootstrap 2>&1)
|
|
supports_all=true
|
|
for platform in linux/amd64 linux/arm64; do
|
|
if ! grep -Fq "${platform}" <<<"${platforms}"; then
|
|
supports_all=false
|
|
break
|
|
fi
|
|
done
|
|
if [[ ${supports_all} == true ]]; then
|
|
break
|
|
fi
|
|
if [[ ${attempt} -lt 10 ]]; then
|
|
sleep 1
|
|
fi
|
|
done
|
|
if [[ ${supports_all} != true ]]; then
|
|
echo "Builder ${builder} does not support both required platforms; refusing partial release." >&2
|
|
printf '%s\n' "${platforms}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
tags=(--tag "${repository}:${tag}")
|
|
if [[ ${also_latest} == true ]]; then
|
|
tags+=(--tag "${repository}:latest")
|
|
fi
|
|
docker buildx build --pull --platform linux/amd64,linux/arm64 \
|
|
--push "${tags[@]}" .
|
|
docker buildx imagetools inspect "${repository}:${tag}"
|