26 lines
1.6 KiB
Bash
26 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
work=${RTC_BUILD_DIR:-"$HOME/.cache/pi-work/matrix-rtc-policy/build"}
|
|
mkdir -p "$work"
|
|
revision=0e176b1eca44e67b11484d0bdf56999807bf2b8e
|
|
source_sha=32f4d1b31c39689c7b8100c1567eacc646763c96c1054513115ae59cd9efabb9
|
|
patch_sha=6e21c58c02d68e45c12f053a70001954022b88551a8e3afa620c61c1e0a94791
|
|
image=iscg/lk-jwt-service:0.9.0-policy1-${patch_sha:0:12}
|
|
if [ ! -f "$work/upstream.tar.gz" ]; then
|
|
curl -fL --retry 3 "https://codeload.github.com/element-hq/lk-jwt-service/tar.gz/$revision" -o "$work/upstream.tar.gz"
|
|
fi
|
|
printf '%s %s\n' "$source_sha" "$work/upstream.tar.gz" "$patch_sha" "$here/standalone-publication.patch" | sha256sum -c -
|
|
# Fresh context, never build against an unreviewed/dirty upstream checkout.
|
|
context=$(mktemp -d "$work/context.XXXXXX")
|
|
mkdir "$context/source"
|
|
tar -xzf "$work/upstream.tar.gz" --strip-components=1 -C "$context/source"
|
|
(cd "$context/source" && patch --batch --fuzz=0 -p1 < "$here/standalone-publication.patch")
|
|
cp "$here/Dockerfile" "$context/Dockerfile"
|
|
# BuildKit may require separate routing on this host. The legacy builder uses
|
|
# Docker's configured bridge egress; build/test containers never mount secrets.
|
|
DOCKER_BUILDKIT=0 docker build --network host --memory=3g --memory-swap=4g --cpu-shares=256 -t "$image" "$context"
|
|
printf 'Built and test-gated: %s\n' "$image"
|
|
docker image inspect "$image" --format '{{.Id}}'
|
|
# Context is deliberately kept for audit/retries. Remove only this task's cache
|
|
# manually after preserving the release image/source receipt.
|