xxx

In addition to building an RPM package for regular Fedora machines, we
now build a container image containing a statically-linked `sshca-cli`
executable.

ci/Jenkinsfile

@@ -3,7 +3,7 @@ pipeline {
 
     stages {
 
-        stage('Container') {
+        stage('Build Container') {
             matrix {
                 axes {
                     axis {
@@ -12,7 +12,7 @@ pipeline {
                     }
                 }
                 stages {
-                    stage('Build Container') {
+                    stage('Container') {
                         agent {
                             kubernetes {
                                 yamlFile 'ci/podTemplate-container.yaml'
@@ -26,35 +26,47 @@ pipeline {
                             stage('Build') {
                                 steps {
                                     sh '. ci/build-container.sh'
-                                }
-                            }
-
-                            stage('Publish') {
-                                environment {
-                                    REGISTRY_AUTH_FILE = "${env.WORKSPACE_TMP}/auth.json"
-                                }
-                                steps {
-                                    withCredentials([usernamePassword(
-                                        credentialsId: 'jenkins-packages',
-                                        usernameVariable: 'BUILDAH_USERNAME',
-                                        passwordVariable: 'BUILDAH_PASSWORD',
-                                    )]) {
-                                        sh """
-                                            buildah login \
-                                            --username \${BUILDAH_USERNAME} \
-                                            --password \${BUILDAH_PASSWORD} \
-                                            git.pyrocufflink.net
-                                        """
-                                    }
-                                    sh '. ci/publish-container.sh'
+                                    stash name: env.ARCH, includes: "*.oci.tar"
                                 }
                             }
                         }
                     }
-
                 }
-
             }
         }
+
+        stage('Publish Container') {
+            agent {
+                kubernetes {
+                    yamlFile 'ci/podTemplate-container.yaml'
+                    yamlMergeStrategy merge()
+                    defaultContainer 'buildah'
+                }
+            }
+
+            environment {
+                REGISTRY_AUTH_FILE = "${env.WORKSPACE_TMP}/auth.json"
+            }
+
+            steps {
+                unstash 'amd64'
+                unstash 'arm64'
+                withCredentials([usernamePassword(
+                    credentialsId: 'jenkins-packages',
+                    usernameVariable: 'BUILDAH_USERNAME',
+                    passwordVariable: 'BUILDAH_PASSWORD',
+                )]) {
+                    sh """
+                        buildah login \
+                        --username \${BUILDAH_USERNAME} \
+                        --password \${BUILDAH_PASSWORD} \
+                        git.pyrocufflink.net
+                    """
+                }
+                sh '. ci/publish.sh'
+            }
+        }
+
+
     }
 }

ci/build-container.sh

@@ -1,3 +1,6 @@
 . ci/common.sh
 
 buildah build -t "${IMAGE_NAME}:${TAG}" .
+buildah push \
+    "${IMAGE_NAME}:${TAG}" \
+    oci-archive:"${PWD}/${NAME}-${ARCH}.oci.tar:${IMAGE_NAME}:${TAG}"

ci/publish-container.sh

@@ -1,7 +1,15 @@
 . ci/common.sh
 
-buildah push "${IMAGE_NAME}:${TAG}"
-buildah push "${IMAGE_NAME}:${TAG}" "${IMAGE_NAME}:${TAG}-${BUILD_NUMBER}"
+buildah manifest create "${IMAGE_NAME}:${TAG}"
+for arch in amd64 arm64; do
+    buildah manifest add "${IMAGE_NAME}:${TAG}" \
+        oci-archive:"${PWD}/${NAME}-${arch}.oci.tar:${IMAGE_NAME}:${TAG}"
+done
+
+buildah manifest push --all "${IMAGE_NAME}:${TAG}" \
+    "docker://${IMAGE_NAME}:${TAG}-${BUILD_NUMBER}"
+buildah manifest push "${IMAGE_NAME}:${TAG}" "docker://${IMAGE_NAME}:${TAG}"
 if [ ${BRANCH_NAME} = master ]; then
-    buildah push "${IMAGE_NAME}:${TAG}" "${IMAGE_NAME}:latest"
+    buildah manifest push "${IMAGE_NAME}:${TAG}" \
+        "docker://${IMAGE_NAME}:latest"
 fi