Add tools image for .deb and .rpm signing (#76)

Adding the ability to sign the .deb and .rpm packages to the CI builder
images is problematic for RHEL. Since it actually isn't necessary to use
the same image to sign a package created by a particular image, this PR
adds the signing packages to a new "tools" image.

As an added bonus, it cleans up the documentation image by adding the
`--no-install-recommends` flag.

Author: bthomee

.github/workflows/tools-rippled.yml

@@ -44,6 +44,7 @@ jobs:
         tool:
           - documentation
           - pre-commit
+          - signing
     runs-on: ${{ matrix.architecture.runner }}
     permissions:
       packages: write
@@ -128,6 +129,7 @@ jobs:
         tool:
           - documentation
           - pre-commit
+          - signing
     runs-on: ubuntu-24.04
     needs:
       - build

docker/tools-rippled/Dockerfile

@@ -113,8 +113,30 @@ ENV CXX=/usr/bin/g++
 ARG DOXYGEN_VERSION
 ARG GRAPHVIZ_VERSION
 RUN <<EOF
+pkgs=()
+pkgs+=(doxygen=${DOXYGEN_VERSION})
+pkgs+=(graphviz=${GRAPHVIZ_VERSION})
+apt-get update
+apt-get install -y --no-install-recommends "${pkgs[@]}"
+apt-get clean
+rm -rf /var/lib/apt/lists/*
+EOF
+
+ENV HOME=/root
+WORKDIR ${HOME}
+
+# ====================== SIGNING IMAGE ======================
+# Note, we do not install a compiler here.
+
+FROM base AS signing
+
+# This is not inherited from base image.
+ARG DEBIAN_FRONTEND=noninteractive
+
+# Install tools to sign the .deb and .rpm installers containing our binary.
+RUN <<EOF
 apt-get update
-apt-get install -y doxygen=${DOXYGEN_VERSION} graphviz=${GRAPHVIZ_VERSION}
+apt-get install -y --no-install-recommends rpm
 apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF

docker/tools-rippled/README.md

@@ -69,6 +69,24 @@ docker buildx build . \
   --tag ${CONTAINER_IMAGE}
 ```
 
+#### Building the Docker image for signing
+
+In order to build an image, run the commands below from the root directory of
+the repository.
+
+```shell
+UBUNTU_VERSION=noble
+CONTAINER_IMAGE=ghcr.io/xrplf/ci/tools-rippled-signing:latest
+
+docker buildx build . \
+  --file docker/tools-rippled/Dockerfile \
+  --target signing \
+  --build-arg BUILDKIT_DOCKERFILE_CHECK=skip=InvalidDefaultArgInFrom \
+  --build-arg BUILDKIT_INLINE_CACHE=1 \
+  --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} \
+  --tag ${CONTAINER_IMAGE}
+```
+
 ### Pushing the Docker image
 
 #### Logging into the GitHub registry