Pin CMake in builder image

The builder image previously used the distro CMake package, which left the version dependent on manylinux and yum repository state. That made the CMake backend harder to reason about across architectures.

Install the official Kitware CMake 4.3.3 binary tarball in a shared stage instead. The stage verifies the architecture-specific SHA-256 before extracting it, and both the LLVM builder and final image use the pinned CMake from /opt/cmake.

Signed-off-by: Eric Shi <ershi@nvidia.com>

Author: shi-eric

docker/warp-builder/Dockerfile

@@ -55,17 +55,42 @@ RUN CUDA_MAJOR=$(echo ${CUDA_VERSION} | cut -d. -f1) && \
     --component $component || exit 1; \
     done
 
+# Install pinned CMake from official Kitware binary tarballs.
+FROM base AS cmake-installer
+
+ARG CMAKE_VERSION=4.3.3
+
+RUN ARCH=$(uname -m) && \
+    if [ "$ARCH" = "x86_64" ]; then \
+    CMAKE_ARCH="x86_64"; \
+    CMAKE_SHA256="927b2368a946c37269c3a66225ab00544e756459cdd0b5d0da438694fb9ff802"; \
+    elif [ "$ARCH" = "aarch64" ]; then \
+    CMAKE_ARCH="aarch64"; \
+    CMAKE_SHA256="9ea38356dbd3e32e51029a3e09a0f2f8e117ef4fbcaad7a21ffb36409bbd5cb4"; \
+    else \
+    echo "Unsupported architecture: $ARCH" && exit 1; \
+    fi && \
+    CMAKE_FILE="cmake-${CMAKE_VERSION}-linux-${CMAKE_ARCH}.tar.gz" && \
+    wget --max-redirect=1 "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}/${CMAKE_FILE}" && \
+    echo "${CMAKE_SHA256}  ${CMAKE_FILE}" | sha256sum -c - && \
+    mkdir -p /opt/cmake && \
+    tar -xzf "${CMAKE_FILE}" --strip-components=1 -C /opt/cmake && \
+    rm "${CMAKE_FILE}" && \
+    /opt/cmake/bin/cmake --version
+
 # Build LLVM from source
 FROM base AS llvm-builder
 WORKDIR /tmp/llvm-build
 
 ARG TARGETARCH
 
+COPY --from=cmake-installer /opt/cmake /opt/cmake
+ENV PATH=/opt/cmake/bin:${PATH}
+
 # Install build tools needed for LLVM (not needed in final image)
 RUN yum install -y \
     git \
     unzip \
-    cmake \
     && yum clean all
 
 # Install modern Ninja from GitHub releases (yum's ninja-build is too old for LLVM 21.1.0)
@@ -282,15 +307,13 @@ FROM base AS final
 ARG CUDA_VERSION
 ARG TARGETARCH
 
-# Install build tools needed by Warp's CMake backend.
-RUN yum install -y \
-    cmake \
-    && yum clean all
-
 # Copy CUDA installation from builder stage
 # parse_redist.py creates /opt/cuda/linux-${TARGETARCH}/ structure (e.g., linux-x86_64, linux-aarch64)
 COPY --from=cuda-installer /opt/cuda/linux-${TARGETARCH} /usr/local/cuda
 
+# Copy the pinned CMake binary distribution from Kitware.
+COPY --from=cmake-installer /opt/cmake /opt/cmake
+
 # Copy LLVM installation from builder stage
 COPY --from=llvm-builder /opt/llvm /opt/llvm
 
@@ -313,7 +336,7 @@ RUN mkdir -p /usr/local/cuda/licenses && \
     echo "See: https://docs.nvidia.com/cuda/eula/" >> /usr/local/cuda/licenses/README.txt
 
 # Set environment variables
-ENV PATH=/usr/local/cuda/bin:/opt/llvm/bin:${PATH}
+ENV PATH=/opt/cmake/bin:/usr/local/cuda/bin:/opt/llvm/bin:${PATH}
 ENV LD_LIBRARY_PATH=/usr/local/cuda/lib64:/usr/local/cuda/lib:/opt/llvm/lib:${LD_LIBRARY_PATH}
 ENV CUDA_HOME=/usr/local/cuda
 ENV CUDA_PATH=/usr/local/cuda