xxx

In addition to building an RPM package for regular Fedora machines, we
now build a container image containing a statically-linked `sshca-cli`
executable.

.containerignore

@@ -0,0 +1,4 @@
+*
+!src
+!Cargo.lock
+!Cargo.toml

Containerfile

@@ -0,0 +1,18 @@
+FROM docker.io/library/rust:1.73-alpine AS build
+
+COPY . /build
+
+WORKDIR /build
+
+RUN --mount=type=cache,target=/var/cache \
+	apk add --no-cache g++ \
+	&& :
+
+RUN cargo build --release --no-default-features --features rustls \
+	&& strip target/release/sshca-cli
+
+FROM scratch
+
+COPY --from=build /build/target/release/sshca-cli /
+
+ENTRYPOINT ["/sshca-cli"]

ci/Jenkinsfile

@@ -2,85 +2,59 @@ pipeline {
     agent none
 
     stages {
-        stage('SSHCA CLI') {
+
+        stage('Container') {
             matrix {
                 axes {
                     axis {
                         name 'ARCH'
                         values 'amd64', 'arm64'
                     }
-                    axis {
-                        name 'FEDORA'
-                        values '38', '39'
                 }
-                }
-
                 stages {
-                    stage('CLI') {
+                    stage('Build Container') {
                         agent {
                             kubernetes {
-                                yamlFile 'ci/podTemplate.yaml'
+                                yamlFile 'ci/podTemplate-container.yaml'
                                 yamlMergeStrategy merge()
-                                defaultContainer 'fedora'
+                                defaultContainer 'buildah'
                                 nodeSelector "kubernetes.io/arch=${ARCH}"
-                                containerTemplate {
-                                    name 'fedora'
-                                    image "registry.fedoraproject.org/fedora:${FEDORA}"
-                                }
-                            }
-                        }
-                        environment {
-                            GNUPGHOME = "${env.WORKSPACE_TMP}/gnupg"
-                        }
-                        stages {
-                            stage('Prepare') {
-                                steps {
-                                    sh '. ci/prepare.sh'
                             }
                         }
 
+                        stages {
                             stage('Build') {
                                 steps {
-                                    sh '. ci/build.sh'
+                                    sh '. ci/build-container.sh'
-                                    script {
-                                        if (env.BRANCH_NAME == 'master') {
-                                            withCredentials([
-                                                file(
-                                                    credentialsId: 'rpm-gpg-key',
-                                                    variable: 'RPM_GPG_PRIVATE_KEY',
-                                                ),
-                                                file(
-                                                    credentialsId: 'rpm-gpg-key-passphrase',
-                                                    variable: 'RPM_GPG_KEY_PASSPHRASE',
-                                                ),
-                                            ]) {
-                                                sh '. ci/sign-rpms.sh'
-                                            }
-                                        }
-                                    }
-                                }
-                                post {
-                                    success {
-                                        archiveArtifacts '*.rpm'
-                                    }
                                 }
                             }
 
                             stage('Publish') {
-                                when {
+                                environment {
-                                    branch 'master'
+                                    REGISTRY_AUTH_FILE = "${env.WORKSPACE_TMP}/auth.json"
                                 }
                                 steps {
-                                    sshagent(['jenkins-repohost']) {
+                                    withCredentials([usernamePassword(
-                                        sh '. ci/publish.sh'
+                                        credentialsId: 'jenkins-packages',
-                                    }
+                                        usernameVariable: 'BUILDAH_USERNAME',
+                                        passwordVariable: 'BUILDAH_PASSWORD',
+                                    )]) {
+                                        sh """
+                                            buildah login \
+                                            --username \${BUILDAH_USERNAME} \
+                                            --password \${BUILDAH_PASSWORD} \
+                                            git.pyrocufflink.net
+                                        """
                                     }
+                                    sh '. ci/publish-container.sh'
                                 }
                             }
                         }
                     }
 
                 }
+
+            }
         }
     }
 }

ci/build-container.sh

@@ -0,0 +1,3 @@
+. ci/common.sh
+
+buildah build -t "${IMAGE_NAME}:${TAG}" .

ci/common.sh

@@ -0,0 +1,13 @@
+escape_name() {
+    echo "$1" \
+        | tr A-Z a-z \
+        | sed -e 's/[^a-zA-Z0-9._-]/-/g' -e 's/^[.-]/_/'
+}
+
+REGISTRY_URL=git.pyrocufflink.net
+NAMESPACE=containerimages
+NAME="${JOB_NAME#*/}"
+NAME=$(escape_name "${NAME%/*}")
+TAG=$(escape_name "${BRANCH_NAME}")
+
+IMAGE_NAME="${REGISTRY_URL}/${NAMESPACE}/${NAME}"

ci/podTemplate-container.yaml

@@ -0,0 +1,19 @@
+spec:
+  containers:
+  - name: buildah
+    image: quay.io/containers/buildah:v1
+    command:
+    - cat
+    stdin: true
+    tty: true
+    securityContext:
+      capabilities:
+        add:
+        - SYS_ADMIN
+        - MKNOD
+        - SYS_CHROOT
+        - SETFCAP
+    resources:
+      limits:
+        github.com/fuse: 1
+  hostUsers: false

ci/publish-container.sh

@@ -0,0 +1,7 @@
+. ci/common.sh
+
+buildah push "${IMAGE_NAME}:${TAG}"
+buildah push "${IMAGE_NAME}:${TAG}" "${IMAGE_NAME}:${TAG}-${BUILD_NUMBER}"
+if [ ${BRANCH_NAME} = master ]; then
+    buildah push "${IMAGE_NAME}:${TAG}" "${IMAGE_NAME}:latest"
+fi