diff --git a/.devcontainer/cpp/Dockerfile b/.devcontainer/cpp/Dockerfile index 95884f54f..29517bf61 100644 --- a/.devcontainer/cpp/Dockerfile +++ b/.devcontainer/cpp/Dockerfile @@ -6,6 +6,8 @@ ARG BASE_IMAGE=ghcr.io/philips-software/amp-devcontainer-base:edge # taken from https://ccache.dev/minisign.pub ARG CCACHE_MINISIGN_PUBKEY=RWQX7yXbBedVfI4PNx6FLdFXu9GHUFsr28s4BVGxm4BeybtnX3P06saF ARG CCACHE_VERSION=4.13.1 +ARG CPM_VERSION=0.43.1 +ARG INCLUDE_WHAT_YOU_USE_VERSION=0.26 ARG XWIN_VERSION=0.8.0 # Whether or not to build the embedded flavor of this container ARG BUILD_EMBEDDED_FLAVOR=false @@ -42,10 +44,17 @@ ADD --checksum=sha256:fe106caefbb316664d73fd03166c28c09e580bb2a3ad65b4d50c51c673 # trivy:ignore:AVD-DS-0001 FROM downloader-${TARGETARCH} AS downloader +ARG CPM_VERSION +ARG INCLUDE_WHAT_YOU_USE_VERSION + ADD --checksum=sha256:8b2a587ffd672c4687e7581dad4b2f6c1bb2ad6b480cd9771ba2ff48e0b8c75d \ https://apt.llvm.org/llvm-snapshot.gpg.key /llvm.gpg.key ADD --checksum=sha256:db2938ce5fd422f2db7a07508452772c945135d99274004c462190c323fefcf1 \ https://dl.cloudsmith.io/public/mull-project/mull-stable/gpg.41DB35380DE6BD6F.key /mull.gpg.key +ADD --checksum=sha256:1c40fc102ce9625d7de7eb14f541cab30cc3138dca627f0b0ec40293ce6c2934 \ + https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake /CPM.cmake +ADD --checksum=sha256:ca3f157a5e6bf293cfb2fea585b103ec87245d02eaee0b6ab832665e740016eb \ + https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz /iwyu.tar.gz # Extractor stage using target architecture specific downloader FROM ${BASE_IMAGE} AS extractor @@ -86,6 +95,8 @@ RUN --mount=from=downloader,target=/dl \ tar xJf /dl/ccache.tar.xz --strip-components=1 "ccache-${CCACHE_VERSION}-linux-$(uname -m)-glibc/ccache" tar xzf /dl/xwin.tar.gz --strip-components=1 "xwin-${XWIN_VERSION}-$(uname -m)-unknown-linux-musl/xwin" + tar xzf /dl/iwyu.tar.gz + cp /dl/CPM.cmake /CPM.cmake cp /dl/llvm.gpg.key /llvm.gpg.key cp /dl/mull.gpg.key /mull.gpg.key EOF @@ -94,10 +105,9 @@ EOF FROM ${BASE_IMAGE} ARG CLANG_VERSION=22 -ARG CPM_VERSION=0.42.1 -ARG INCLUDE_WHAT_YOU_USE_VERSION=0.26 ARG BUILD_EMBEDDED_FLAVOR ARG CCACHE_VERSION +ARG INCLUDE_WHAT_YOU_USE_VERSION ARG XWIN_VERSION ARG ARM_GNU_TOOLCHAIN_VERSION @@ -136,8 +146,8 @@ RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target rm -rf "$(pip cache dir)" # Install ccache and xwin - cp /src/ccache /usr/local/bin/ccache - cp /src/xwin /usr/local/bin/xwin + install -m 0755 /src/ccache /usr/local/bin/ccache + install -m 0755 /src/xwin /usr/local/bin/xwin # Install clang toolchain and mull mutation testing framework cat /src/llvm.gpg.key | gpg --dearmor -o /usr/share/keyrings/llvm-snapshot-keyring.gpg @@ -156,12 +166,11 @@ RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target fi # Install include-what-you-use (iwyu) from source - apt-get update && apt-get install -y --no-install-recommends libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev - wget --no-hsts -qO - https://github.com/include-what-you-use/include-what-you-use/archive/refs/tags/${INCLUDE_WHAT_YOU_USE_VERSION}.tar.gz | tar xz -C /tmp - CC=clang CXX=clang++ cmake -S /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} -B /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build - cmake --build /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}/build --target install - rm -rf /tmp/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION} - apt-get purge -y libclang-${CLANG_VERSION}-dev llvm-${CLANG_VERSION}-dev + apt-get update && apt-get install -y --no-install-recommends "libclang-${CLANG_VERSION}-dev" "llvm-${CLANG_VERSION}-dev" + CC=clang CXX=clang++ cmake -S "/src/include-what-you-use-${INCLUDE_WHAT_YOU_USE_VERSION}" -B "/tmp/include-what-you-use/build" + cmake --build "/tmp/include-what-you-use/build" --target install + rm -rf "/tmp/include-what-you-use" + apt-get purge -y "libclang-${CLANG_VERSION}-dev" "llvm-${CLANG_VERSION}-dev" apt-get autoremove -y apt-get clean @@ -172,9 +181,9 @@ RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 10 \ --slave /usr/bin/c++ c++ /usr/bin/g++-15 update-alternatives --install /usr/bin/iwyu iwyu /usr/local/bin/include-what-you-use 10 - update-alternatives --install /usr/bin/mull-runner mull-runner /usr/bin/mull-runner-${CLANG_VERSION} 10 \ - --slave /usr/bin/mull-reporter mull-reporter /usr/bin/mull-reporter-${CLANG_VERSION} \ - --slave /usr/lib/mull-ir-frontend mull-ir-frontend /usr/lib/mull-ir-frontend-${CLANG_VERSION} + update-alternatives --install /usr/bin/mull-runner mull-runner "/usr/bin/mull-runner-${CLANG_VERSION}" 10 \ + --slave /usr/bin/mull-reporter mull-reporter "/usr/bin/mull-reporter-${CLANG_VERSION}" \ + --slave /usr/lib/mull-ir-frontend mull-ir-frontend "/usr/lib/mull-ir-frontend-${CLANG_VERSION}" update-alternatives --install /usr/bin/python python /usr/bin/python3 10 # Add a dummy compile_commands.json file to the default location so that tools like SonarLint and Clangd can find it. @@ -189,7 +198,7 @@ RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target # CMake module (not an ELF binary), so it cannot carry a `.note.package` ELF # section and Syft has no cataloger for standalone `.cmake` files. Its version is # pinned and tracked via the CPM_VERSION build argument above. - wget --no-hsts -qP /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_VERSION}/CPM.cmake + cp /src/CPM.cmake /usr/local/lib/python*/dist-packages/cmake/data/share/cmake-*/Modules/ conan profile detect echo -e "\n[conf]\ntools.cmake.cmaketoolchain:generator=Ninja" >> "$(conan profile path default)" diff --git a/.devcontainer/rust/Dockerfile b/.devcontainer/rust/Dockerfile index 4e578fe54..6702d9c33 100644 --- a/.devcontainer/rust/Dockerfile +++ b/.devcontainer/rust/Dockerfile @@ -1,9 +1,62 @@ # syntax=docker/dockerfile:1 +# hadolint global ignore=DL3006 ARG BASE_IMAGE=ghcr.io/philips-software/amp-devcontainer-base:edge +# Public minisign key for verifying ccache releases, +# taken from https://ccache.dev/minisign.pub +ARG CARGO_BINSTALL_MINISIGN_PUBKEY=RWRk4OqCLGFd42uTAec/I+038vQLmeZzCBOS40LLDVC6qW3SVuDsdcW0 +ARG CARGO_BINSTALL_VERSION=1.21.0 + +# Downloader stage for AMD64 architecture +FROM scratch AS downloader-amd64 + +ARG CARGO_BINSTALL_VERSION + +ADD --checksum=sha256:a753a83ea4c79a629790e003822d4e82bec5bf839120f1826969c2401bd9f559 \ + https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-gnu.tgz /cargo-binstall.tgz +ADD --checksum=sha256:131d12bc7dd4d7c431b8f36447ce630c71e61975af1da6215c317bfde60e8a53 \ + https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-gnu.tgz.sig /cargo-binstall.tgz.minisig + +# Downloader stage for ARM64 architecture +FROM scratch AS downloader-arm64 + +ARG CARGO_BINSTALL_VERSION + +ADD --checksum=sha256:f70991d597655bc928444c0ac0dedcbd1d16a9e64d0b1ea544dde2cc710e25f6 \ + https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-aarch64-unknown-linux-gnu.tgz /cargo-binstall.tgz +ADD --checksum=sha256:3d4ed28844baeeafa5e7df2112e623ae6098cf70b61983054d7ecd5cdbce35bb \ + https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-aarch64-unknown-linux-gnu.tgz.sig /cargo-binstall.tgz.minisig + +# Select downloader stage based on target architecture. +# Linters don't recognize the TARGETARCH variable, so we ignore warnings here. +# trivy:ignore:AVD-DS-0001 +FROM downloader-${TARGETARCH} AS downloader + +# Extractor stage using target architecture specific downloader +FROM ${BASE_IMAGE} AS extractor + +ARG CARGO_BINSTALL_VERSION +ARG CARGO_BINSTALL_MINISIGN_PUBKEY + +SHELL ["/bin/bash", "-Eeuo", "pipefail", "-c"] + +WORKDIR / + +# hadolint ignore=DL3008 +RUN --mount=from=downloader,target=/dl \ + --mount=type=cache,target=/var/cache/apt,sharing=locked \ + --mount=type=cache,target=/var/lib/apt,sharing=locked <