minisign/Dockerfile at master · jedisct1/minisign · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
FROM alpine:latest AS build

WORKDIR /usr/src/minisign

RUN apk add --no-cache \
    build-base \
    cmake \
    curl \
    pkgconfig \
    catatonit \
    && apk add --no-cache upx || true

RUN set -eux; \
    curl -fsSL https://download.libsodium.org/libsodium/releases/LATEST.tar.gz | tar xzf -; \
    cd libsodium-stable; \
    env CPPFLAGS="-DED25519_NONDETERMINISTIC=1" \
        ./configure \
        --disable-dependency-tracking; \
    make -j"$(nproc)" check; \
    make install; \
    cd ..; \
    rm -rf libsodium-stable

COPY . .

RUN set -eux; \
    mkdir build; \
    cd build; \
    cmake \
        -DCMAKE_BUILD_TYPE=MinSizeRel \
        -DCMAKE_C_FLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE" \
        -DCMAKE_EXE_LINKER_FLAGS="-pie -Wl,-z,relro,-z,now" \
        -DBUILD_STATIC_EXECUTABLES=1 \
        ..; \
    make -j"$(nproc)"; \
    strip minisign

RUN upx --lzma build/minisign || true

WORKDIR /staging/etc
RUN set -eux; \
    echo "_minisign:x:65534:" > group; \
    echo "_minisign:x:65534:65534:minisign:/dev/null:/etc" > passwd

RUN mkdir -p /staging/tmp /staging/minisign

FROM scratch

COPY --from=build /staging/ /
COPY --from=build /usr/src/minisign/build/minisign /usr/bin/catatonit /usr/bin/

USER 65534:65534
WORKDIR /minisign
ENTRYPOINT ["/usr/bin/catatonit", "--", "/usr/bin/minisign"]