ci: Build container image

In addition to building an RPM package for regular Fedora machines, we now build a container image containing a statically-linked `sshca-cli` executable.
Add rustls feature
2024-01-17 21:24:58 -06:00 · 2024-01-17 21:24:21 -06:00
9 changed files with 195 additions and 3 deletions
--- a/.containerignore
+++ b/.containerignore
@ -0,0 +1,4 @@
+*
+!src
+!Cargo.lock
+!Cargo.toml
--- a/Cargo.lock
+++ b/Cargo.lock
@ -419,6 +419,20 @@ dependencies = [
 "want",
 ]

+[[package]]
+name = "hyper-rustls"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+dependencies = [
+ "futures-util",
+ "http",
+ "hyper",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+]
+
 [[package]]
 name = "hyper-tls"
 version = "0.5.0"
@ -780,6 +794,7 @@ dependencies = [
 "http",
 "http-body",
 "hyper",
+ "hyper-rustls",
 "hyper-tls",
 "ipnet",
 "js-sys",
@ -790,17 +805,21 @@ dependencies = [
 "once_cell",
 "percent-encoding",
 "pin-project-lite",
+ "rustls",
+ "rustls-pemfile",
 "serde",
 "serde_json",
 "serde_urlencoded",
 "system-configuration",
 "tokio",
 "tokio-native-tls",
+ "tokio-rustls",
 "tower-service",
 "url",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
+ "webpki-roots",
 "winreg",
 ]

@ -837,6 +856,37 @@ dependencies = [
 "windows-sys",
 ]

+[[package]]
+name = "rustls"
+version = "0.21.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki",
+ "sct",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.15"
@ -852,6 +902,16 @@ dependencies = [
 "windows-sys",
 ]

+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.9.2"
@ -970,7 +1030,7 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"

 [[package]]
 name = "sshca-cli"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
 "argh",
 "argon2",
@ -1097,6 +1157,16 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.10"
@ -1352,6 +1422,12 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "webpki-roots"
+version = "0.25.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
--- a/Cargo.toml
+++ b/Cargo.toml
@ -12,9 +12,18 @@ argh = "0.1.12"
 argon2 = { version = "0.5.2", default-features = false, features = ["alloc"] }
 gethostname = "0.4.3"
 jsonwebtoken = { version = "9.1.0", default-features = false }
-reqwest = { version = "0.11.22", features = ["multipart"] }
+reqwest = { version = "0.11.22", default-features = false, features = ["multipart"] }
 serde = { version = "1.0.190", features = ["derive"] }
 tokio = { version = "1.33.0", features = ["rt", "macros"] }
 tracing = "0.1.40"
 tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
 uuid = "1.5.0"
+
+[features]
+default = ["native-tls"]
+native-tls = [
+    "reqwest/default-tls",
+]
+rustls = [
+    "reqwest/rustls-tls",
+]
--- a/18
+++ b/18
@ -0,0 +1,18 @@
+FROM docker.io/library/rust:1.73-alpine AS build
+
+COPY . /build
+
+WORKDIR /build
+
+RUN --mount=type=cache,target=/var/cache \
+	apk add --no-cache g++ \
+	&& :
+
+RUN cargo build --release --no-default-features --features rustls \
+	&& strip target/release/sshca-cli
+
+FROM scratch
+
+COPY --from=build /build/target/release/sshca-cli /
+
+ENTRYPOINT ["/sshca-cli"]
--- a/ci/Jenkinsfile
+++ b/ci/Jenkinsfile
@ -16,7 +16,7 @@ pipeline {
                }

                stages {
-                    stage('CLI') {
+                    stage('RPM') {
                        agent {
                            kubernetes {
                                yamlFile 'ci/podTemplate.yaml'
@ -78,6 +78,52 @@ pipeline {
                            }
                        }
                    }
+
+                    stage('Container') {
+                        agent {
+                            kubernetes {
+                                yamlFile 'ci/podTemplate.yaml'
+                                yamlMergeStrategy merge()
+                                defaultContainer 'buildah'
+                                nodeSelector "kubernetes.io/arch=${ARCH}"
+                            }
+                        }
+
+                        stages {
+                            stage('Build') {
+                                steps {
+                                    sh '. ci/build-container.sh'
+                                }
+                                post {
+                                    success {
+                                        archiveArtifacts "${ARCH}/*"
+                                    }
+                                }
+                            }
+
+                            stage('Publish') {
+                                environment {
+                                    REGISTRY_AUTH_FILE = "${env.WORKSPACE_TMP}/auth.json"
+                                }
+                                steps {
+                                    withCredentials([usernamePassword(
+                                        credentialsId: 'jenkins-packages',
+                                        usernameVariable: 'BUILDAH_USERNAME',
+                                        passwordVariable: 'BUILDAH_PASSWORD',
+                                    )]) {
+                                        sh """
+                                            buildah login \
+                                            --username \${BUILDAH_USERNAME} \
+                                            --password \${BUILDAH_PASSWORD} \
+                                            git.pyrocufflink.net
+                                        """
+                                    }
+                                    sh '. ci/publish-container.sh'
+                                }
+                            }
+                        }
+                    }
+
                }

            }
--- a/ci/build-container.sh
+++ b/ci/build-container.sh
@ -0,0 +1,3 @@
+. ci/common.sh
+
+buildah build -t "${IMAGE_NAME}:${TAG}" .
--- a/ci/common.sh
+++ b/ci/common.sh
@ -0,0 +1,13 @@
+escape_name() {
+    echo "$1" \
+        | tr A-Z a-z \
+        | sed -e 's/[^a-zA-Z0-9._-]/-/g' -e 's/^[.-]/_/'
+}
+
+REGISTRY_URL=git.pyrocufflink.net
+NAMESPACE=containerimages
+NAME="${JOB_NAME#*/}"
+NAME=$(escape_name "${NAME%/*}")
+TAG=$(escape_name "${BRANCH_NAME}")
+
+IMAGE_NAME="${REGISTRY_URL}/${NAMESPACE}/${NAME}"
--- a/ci/podTemplate.yaml
+++ b/ci/podTemplate.yaml
@ -12,6 +12,22 @@ spec:
    - mountPath: /etc/ssh/ssh_known_hosts
      name: ssh-known-hosts
      subPath: ssh_known_hosts
+  - name: buildah
+    image: quay.io/containers/buildah:v1
+    command:
+    - cat
+    stdin: true
+    tty: true
+    securityContext:
+      capabilities:
+        add:
+        - SYS_ADMIN
+        - MKNOD
+        - SYS_CHROOT
+        - SETFCAP
+    resources:
+      limits:
+        github.com/fuse: 1
  hostUsers: false
  volumes:
  - name: ssh-known-hosts
--- a/ci/publish-container.sh
+++ b/ci/publish-container.sh
@ -0,0 +1,7 @@
+. ci/common.sh
+
+buildah push "${IMAGE_NAME}:${TAG}"
+buildah push "${IMAGE_NAME}:${TAG}" "${IMAGE_NAME}:${TAG}-${BUILD_NUMBER}"
+if [ ${BRANCH_NAME} = master ]; then
+    buildah push "${IMAGE_NAME}:${TAG}" "${IMAGE_NAME}:latest"
+fi