matrix-rtc: separate standalone publication from room creation

services/matrix-rtc-jwt/build.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+work=${RTC_BUILD_DIR:-"$HOME/.cache/pi-work/matrix-rtc-policy/build"}
+mkdir -p "$work"
+revision=0e176b1eca44e67b11484d0bdf56999807bf2b8e
+source_sha=32f4d1b31c39689c7b8100c1567eacc646763c96c1054513115ae59cd9efabb9
+patch_sha=6e21c58c02d68e45c12f053a70001954022b88551a8e3afa620c61c1e0a94791
+image=iscg/lk-jwt-service:0.9.0-policy1-${patch_sha:0:12}
+if [ ! -f "$work/upstream.tar.gz" ]; then
+  curl -fL --retry 3 "https://codeload.github.com/element-hq/lk-jwt-service/tar.gz/$revision" -o "$work/upstream.tar.gz"
+fi
+printf '%s  %s\n' "$source_sha" "$work/upstream.tar.gz" "$patch_sha" "$here/standalone-publication.patch" | sha256sum -c -
+# Fresh context, never build against an unreviewed/dirty upstream checkout.
+context=$(mktemp -d "$work/context.XXXXXX")
+mkdir "$context/source"
+tar -xzf "$work/upstream.tar.gz" --strip-components=1 -C "$context/source"
+(cd "$context/source" && patch --batch --fuzz=0 -p1 < "$here/standalone-publication.patch")
+cp "$here/Dockerfile" "$context/Dockerfile"
+# BuildKit may require separate routing on this host. The legacy builder uses
+# Docker's configured bridge egress; build/test containers never mount secrets.
+DOCKER_BUILDKIT=0 docker build --network host --memory=3g --memory-swap=4g --cpu-shares=256 -t "$image" "$context"
+printf 'Built and test-gated: %s\n' "$image"
+docker image inspect "$image" --format '{{.Id}}'
+# Context is deliberately kept for audit/retries. Remove only this task's cache
+# manually after preserving the release image/source receipt.