Merge pull request #528 from openziti/release-next

Release 0.22.9

.github/workflows/main.yml

@@ -131,43 +131,51 @@ jobs:
           $(go env GOPATH)/bin/ziti-ci trigger-jenkins-smoke-build
 
       - name: Set up QEMU
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')
         uses: docker/setup-qemu-action@master
         with:
           platforms: amd64,arm64,arm
 
       - name: Set up Docker BuildKit
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')
         id: buildx
         uses: docker/setup-buildx-action@master
 
       - name: Login to Docker Hub
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')
         uses: docker/login-action@v1
         with:
           username: ${{ secrets.DOCKER_HUB_API_USER }}
           password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
 
       - name: Set up Docker image tags
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')
         env:
           SNAPSHOT_REPO: openziti/ziti-tunnel
           RELEASE_REPO: netfoundry/ziti-tunnel
         id: tagprep
         run: |
-          # If this is release tag then add the release repo and semver and "latest" to the list of tags
-          BRANCH_REF="${GITHUB_HEAD_REF:-${GITHUB_REF}}"
-          TAGS=""                                                                          
-          if [[ "${BRANCH_REF}" =~ refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then             
-            # drop the prefix, preserving the semver                                       
-            REF_TAG=${BRANCH_REF#refs/tags/v}                                              
-            for REPO in ${SNAPSHOT_REPO} ${RELEASE_REPO}; do                               
-              TAGS+=",${REPO}:${REF_TAG},${REPO}:latest"                                   
-            done                                                                           
-          else                                                                             
-            REF_TAG="$(sed -E 's/[^a-zA-Z0-9]/-/g;s/(^[^a-zA-Z0-9]+|[^a-zA-Z0-9]+$)//g' <<< "${BRANCH_REF}" | tr '[:upper:]' '[:lower:]')"
-            TAGS+="${SNAPSHOT_REPO}:${REF_TAG}"                                            
-          fi                                                                               
-          TAGS=${TAGS#,} # drop leading comma char                                         
-          # Set output parameters.                                                         
-          echo ::set-output name=tags::${TAGS}                                             
+          # the Docker cross-build only runs on branches main or release-v*
+          # where ziti-ci always computes and pushes a new release tag
+          ZITI_VERSION="$($(go env GOPATH)/bin/ziti-ci -q get-current-version)"
+          # drop the leaving "v" char, if any
+          ZITI_VERSION=${ZITI_VERSION#v}
+          DOCKER_TAGS=""
+          if [[ "${ZITI_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            for REPO in ${SNAPSHOT_REPO} ${RELEASE_REPO}; do
+              DOCKER_TAGS+=",${REPO}:${ZITI_VERSION},${REPO}:latest"
+            done
+          else
+            # fail the job because we could not obtain the current version from ziti-ci
+            exit 1
+          fi
+          DOCKER_TAGS=${DOCKER_TAGS#,} # drop leading comma char, if exists
+          # Set output parameters.
+          echo "DEBUG: DOCKER_TAGS=${DOCKER_TAGS}"
+          echo ::set-output name=tags::${DOCKER_TAGS}
+
       - name: Build & Push Multi-Platform Container Image to Hub
+        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v')
         uses: docker/build-push-action@v2
         with:
           builder: ${{ steps.buildx.outputs.name }}

ziti-tunnel/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:stable-slim as fetch-ziti-artifacts
+FROM debian:buster-slim as fetch-ziti-artifacts
 
 # This build stage grabs artifacts that are copied into the final image.
 # It uses the same base as the final image to maximize docker cache hits.
@@ -25,12 +25,10 @@ RUN bash ./fetch-ziti-bins.sh ziti-tunnel
 #
 ################
 
-FROM debian:stable-slim
+FROM debian:buster-slim
 
 RUN mkdir -p /usr/local/bin /etc/ssl/certs
 RUN apt-get -q update && apt-get -q install -y --no-install-recommends iptables
-# Use 32-bit arm binaries on arm64 until we have 64-bit arm builds. This also affects fetch-ziti-bins.sh.
-RUN if [ "$(uname -m)" = "aarch64" ]; then dpkg --add-architecture armhf; apt update; apt install -y libc6:armhf; fi
 COPY --from=fetch-ziti-artifacts /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs
 COPY --from=fetch-ziti-artifacts /tmp/ziti-tunnel /usr/local/bin
 COPY ./docker-entrypoint.sh /

ziti-tunnel/docker/Dockerfile.copy

@@ -1,4 +1,4 @@
-FROM debian:stable-slim as fetch-ziti-artifacts
+FROM debian:buster-slim as fetch-ziti-artifacts
 
 # This build stage grabs artifacts that are copied into the final image.
 # It uses the same base as the final image to maximize docker cache hits.
@@ -25,15 +25,13 @@ COPY ${ARTIFACTS_DIR}/${TARGETARCH}/${TARGETOS}/ziti-tunnel .
 #
 ################
 
-FROM debian:stable-slim
+FROM debian:buster-slim
 
 ARG DOCKER_BUILD_DIR=.
 ARG ZITI_TUNNELER_BIN=ziti-tunnel
 
 RUN mkdir -p /usr/local/bin /etc/ssl/certs
 RUN apt-get -q update && apt-get -q install -y --no-install-recommends iptables
-# Use 32-bit arm binaries on arm64 until we have 64-bit arm builds. This also affects fetch-ziti-bins.sh.
-RUN if [ "$(uname -m)" = "aarch64" ]; then dpkg --add-architecture armhf; apt update; apt install -y libc6:armhf; fi
 COPY --from=fetch-ziti-artifacts /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs
 COPY --from=fetch-ziti-artifacts /tmp/${ZITI_TUNNELER_BIN} /usr/local/bin
 COPY ${DOCKER_BUILD_DIR}/docker-entrypoint.sh /

ziti-tunnel/docker/buildx.sh

@@ -33,7 +33,7 @@ EOF
 BASENAME=$(basename "$0") || exit $?
 DIRNAME=$(dirname "$0") || exit $?
 
-while getopts :c:hPr: OPT;do
+while getopts :chPr: OPT;do
     case $OPT in
         c) 	FLAGS+=$OPT     # don't checkout vZITI_VERSION
             ;;
@@ -65,18 +65,25 @@ else
     git checkout "v${ZITI_VERSION}"
 fi
 
-docker run --rm --privileged docker/binfmt:a7996909642ee92942dcd6cff44b9b95f08dad64
+docker run --rm --privileged linuxkit/binfmt:v0.8
 grep -E -q enabled /proc/sys/fs/binfmt_misc/qemu-arm
-docker run --rm arm64v8/alpine uname -a|grep -E -q 'aarch64 Linux'
-docker run --rm arm32v7/alpine uname -a|grep -E -q 'armv7l Linux'
+docker run --rm --platform arm arm32v7/alpine  uname -a|grep -E -q 'armv7l Linux'
+docker run --rm --platform arm64 arm64v8/alpine uname -a|grep -E -q 'aarch64 Linux'
 
 docker buildx create --use --name=ziti-builder 2>/dev/null || docker buildx use --default ziti-builder
 
-docker buildx build "$DIRNAME" \
+# if default then push to Hub
+BUILDX_OUTPUT="--push"
+if [[ ${FLAGS:-} =~ P ]]; then
+    # if no push then load in image cache
+    BUILDX_OUTPUT=""
+fi
+
+eval docker buildx build "$DIRNAME" \
     --platform linux/amd64,linux/arm/v7,linux/arm64 \
     --build-arg "ZITI_VERSION=${ZITI_VERSION}" \
     --tag "${CONTAINER_REPO}:${ZITI_VERSION}" \
     --tag "${CONTAINER_REPO}:latest" \
-    --push
+    "${BUILDX_OUTPUT:-}"
 
 docker buildx stop ziti-builder

ziti-tunnel/docker/fetch-ziti-bins.sh

@@ -30,7 +30,8 @@ echo "Fetching from Artifactory."
 host_arch=$(uname -m)
 case "${host_arch}" in
 "x86_64") artifact_arch="amd64";;
-"armv7l"|"aarch64") artifact_arch="arm";;
+"armv7l") artifact_arch="arm";;
+"aarch64") artifact_arch="arm64";;
 *) echo "ERROR: ziti binaries do not exist for architecture ${host_arch}"; exit 1;;
 esac