Skip to content

Commit 979ffa6

Browse files
bhouse-nexthopbhouse-nexthop
committed
Signed-off-by: Brad House <bhouse@nexthop.ai>
1 parent 48db661 commit 979ffa6

670 files changed

Lines changed: 14397 additions & 86174 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/onie-build/Dockerfile‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# ONIE build environment for CI.
2+
#
3+
# Debian 13 (trixie) host for the modernized toolchain. Required because
4+
# kernel 6.18's objtool needs a newer host libelf than Debian 11 ships
5+
# (0.183 fails with "elf_update: invalid section alignment"), and
6+
# crosstool-NG 1.28 / GCC 14 align with the trixie host toolchain. (The
7+
# old crosstool-NG 1.24 / GCC 8.3 toolchain could NOT build on trixie.)
8+
#
9+
# This image builds the generic kvm_x86_64 target with secure boot
10+
# enabled. It includes the secure-boot tooling needed to exercise the SB
11+
# build path -- pesign, efitools, sbsigntool and gnupg2 (for key
12+
# generation and EFI signing) -- and meson/ninja, which flashrom 1.x
13+
# requires to build.
14+
FROM debian:13
15+
WORKDIR /onie
16+
17+
# Tolerate transient Debian mirror hiccups (connection resets mid-fetch).
18+
RUN echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
19+
20+
# Build dependencies for crosstool-NG and the ONIE image.
21+
RUN apt-get update && apt-get install -y \
22+
autoconf \
23+
autoconf-archive \
24+
automake \
25+
autopoint \
26+
bc \
27+
bison \
28+
bsdextrautils \
29+
build-essential \
30+
coreutils \
31+
cpio \
32+
curl \
33+
device-tree-compiler \
34+
dosfstools \
35+
efitools \
36+
fakeroot \
37+
flex \
38+
gawk \
39+
git \
40+
gnupg2 \
41+
gperf \
42+
help2man \
43+
libefivar-dev \
44+
libelf-dev \
45+
libexpat1 \
46+
libexpat1-dev \
47+
libncurses-dev \
48+
libpopt-dev \
49+
libssl-dev \
50+
libtool \
51+
libtool-bin \
52+
locales \
53+
meson \
54+
mtools \
55+
ninja-build \
56+
pesign \
57+
pkgconf \
58+
python3-all-dev \
59+
python3-sphinx \
60+
python3-venv \
61+
rst2pdf \
62+
rsync \
63+
sbsigntool \
64+
stgit \
65+
texinfo \
66+
tree \
67+
u-boot-tools \
68+
unzip \
69+
util-linux \
70+
uuid-dev \
71+
uuid-runtime \
72+
wget \
73+
zip \
74+
xorriso \
75+
&& rm -rf /var/lib/apt/lists/*
76+
77+
# Generate UTF-8 locale (needed for the uclibc / crosstool-NG build).
78+
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \
79+
locale-gen
80+
81+
# Create the build user with the same UID/GID as the host invoker so
82+
# build artifacts are not left owned by root. Override at build time
83+
# with --build-arg UID=$(id -u) --build-arg GID=$(id -g).
84+
#
85+
# NOTE: -l avoids docker layer-export hangs for large UIDs.
86+
# (https://github.com/moby/moby/issues/5419#issuecomment-41478290)
87+
ARG UID=1000
88+
ARG GID=1000
89+
RUN groupadd -g $GID build && \
90+
useradd -l -m -u $UID -g $GID -s /bin/bash build && \
91+
chown -R build:build /onie
92+
93+
USER build
94+
95+
# /sbin and /usr/sbin hold tools the build invokes.
96+
RUN echo 'export PATH="/sbin:/usr/sbin:$PATH"' >> ~/.bashrc
97+
98+
# The build runs git commands; give it a default identity.
99+
RUN git config --global user.email "build@example.com" && \
100+
git config --global user.name "Build User"
101+
102+
CMD ["/bin/bash", "--login"]

‎.github/workflows/build-onie.yml‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
name: Build ONIE (kvm_x86_64)
2+
3+
# Builds the generic amd64 ONIE image for the kvm_x86_64 target, intended
4+
# to run as a VM under KVM/QEMU. The build follows the upstream-recommended
5+
# containerized flow (see contrib/build-env and machine/kvm_x86_64/INSTALL),
6+
# with secure boot enabled: the workflow generates demonstration signing
7+
# keys and self-signs the shim before building.
8+
9+
# Run on every push and pull request: the point of this workflow is to
10+
# confirm the change still builds, and the kvm_x86_64 image depends on far
11+
# more than the build files (installer/, rootconf/, patches/, ...), so path
12+
# filtering would risk skipping validation on build-affecting changes.
13+
on:
14+
workflow_dispatch:
15+
push:
16+
pull_request:
17+
18+
# Cancel an in-progress run when a newer commit is pushed to the same ref,
19+
# so stacked pushes don't pile up concurrent builds.
20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.ref }}
22+
cancel-in-progress: true
23+
24+
jobs:
25+
build:
26+
name: Build kvm_x86_64
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Checkout
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
34+
35+
- name: Determine host UID/GID
36+
id: ids
37+
run: |
38+
echo "uid=$(id -u)" >> "$GITHUB_OUTPUT"
39+
echo "gid=$(id -g)" >> "$GITHUB_OUTPUT"
40+
41+
- name: Build the ONIE build-environment image
42+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
43+
with:
44+
context: .github/onie-build
45+
tags: onie-build-env:latest
46+
build-args: |
47+
UID=${{ steps.ids.outputs.uid }}
48+
GID=${{ steps.ids.outputs.gid }}
49+
load: true
50+
cache-from: type=gha
51+
cache-to: type=gha,mode=max
52+
53+
# Cache the crosstool-NG cross toolchain -- the long pole of a cold
54+
# build. We cache the whole stamp chain (so make does not rebuild on a
55+
# missing root stamp) but only the parts the warm, no-op path actually
56+
# needs -- NOT the multi-GB crosstool-NG build scratch or ct-ng source
57+
# tree, which are only used while building the toolchain. On a cache
58+
# hit "make xtools" is a no-op and the real build only uses the
59+
# installed toolchain, so dropping the scratch keeps the cache blob
60+
# small and fast/reliable to restore.
61+
#
62+
# build/stamp-project -- top-of-chain project stamp
63+
# build/download -- toolchain tarballs + download stamps
64+
# build/crosstool-ng/stamp -- crosstool-NG build stamps
65+
# build/x-tools/*/stamp -- xtools build stamps
66+
# build/x-tools/*/install -- the installed cross toolchain
67+
# build/x-tools/*/build/.config -- xtools config (an xtools-build prereq)
68+
#
69+
# The key is tied to every input that can change the toolchain --
70+
# including the Dockerfile, since it defines the compiler/host
71+
# environment the toolchain is built in. No loose restore-keys: any
72+
# input change forces a clean rebuild rather than restoring a
73+
# mismatched toolchain.
74+
- name: Restore cross-toolchain cache
75+
id: xtools-cache
76+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
77+
with:
78+
path: |
79+
build/stamp-project
80+
build/download
81+
build/crosstool-ng/stamp
82+
build/x-tools/*/stamp
83+
build/x-tools/*/install
84+
build/x-tools/*/build/.config
85+
key: onie-xtools-kvm_x86_64-${{ hashFiles('build-config/make/xtools.make', 'build-config/make/crosstool-ng.make', 'build-config/make/compiler.make', 'build-config/conf/crosstool/**', 'patches/crosstool-NG/**', '.github/onie-build/Dockerfile') }}
86+
87+
# ONIE drives its build with stamp files compared by mtime. A fresh
88+
# checkout gives every repo source file a current mtime, which is newer
89+
# than the restored stamps -- so make would consider the toolchain
90+
# stale and rebuild it (e.g. build/.../.config depends on the
91+
# checked-out conf/crosstool config). A cache hit means the key
92+
# matched, i.e. every toolchain input is unchanged and the restored
93+
# toolchain is valid, so bump the restored artifacts ahead of the
94+
# checkout to make "make xtools" a genuine no-op.
95+
- name: Mark restored toolchain up to date
96+
if: steps.xtools-cache.outputs.cache-hit == 'true'
97+
# Restoring build/stamp-project makes make skip the project-stamp
98+
# recipe, which is what normally creates the project output dirs --
99+
# so recreate them (build/images is an output, not part of the
100+
# cache, and the kernel install copies vmlinuz into it).
101+
#
102+
# Then touch only the files make compares -- the stamp files and the
103+
# toolchain .config. Do NOT touch the toolchain tree itself: it
104+
# contains read-only binaries and symlinks to host tools (bash,
105+
# make, ...) that touch would follow and fail to update.
106+
run: |
107+
mkdir -p build build/images build/download
108+
find build/stamp-project build/download \
109+
build/crosstool-ng/stamp \
110+
build/x-tools/*/stamp \
111+
build/x-tools/*/build/.config \
112+
-type f -exec touch {} +
113+
114+
- name: Build cross toolchain
115+
run: |
116+
docker run --rm --privileged \
117+
-v "${PWD}:/onie" \
118+
onie-build-env \
119+
bash -lc 'cd build-config && make -j"$(nproc)" \
120+
MACHINE=kvm_x86_64 \
121+
xtools'
122+
123+
# Save only on a cache miss, and only after the toolchain build above
124+
# succeeded (default if: success()), so a broken toolchain is never
125+
# cached. Running before the full build means a later-stage failure
126+
# still preserves the toolchain for the next run.
127+
- name: Save cross-toolchain cache
128+
if: steps.xtools-cache.outputs.cache-hit != 'true'
129+
uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
130+
with:
131+
path: |
132+
build/stamp-project
133+
build/download
134+
build/crosstool-ng/stamp
135+
build/x-tools/*/stamp
136+
build/x-tools/*/install
137+
build/x-tools/*/build/.config
138+
key: ${{ steps.xtools-cache.outputs.cache-primary-key }}
139+
140+
- name: Build ONIE
141+
run: |
142+
docker run --rm --privileged \
143+
-v "${PWD}:/onie" \
144+
onie-build-env \
145+
bash -lc 'cd build-config && \
146+
make MACHINE=kvm_x86_64 signing-keys-generate && \
147+
make MACHINE=kvm_x86_64 shim-self-sign && \
148+
make -j"$(nproc)" MACHINE=kvm_x86_64 all recovery-iso'
149+
150+
# Scan the SBOM (produced by `make all`) for known vulnerabilities and
151+
# publish the table to the job log and the run summary. This is a
152+
# report, not a gate: sbom-vuln-scan.py always exits 0 (CVEs already
153+
# fixed by ONIE patches are suppressed via OpenVEX), so it never fails
154+
# the build. The SBOM tools (incl. grype) were provisioned by the SBOM
155+
# step of `make all`.
156+
- name: SBOM vulnerability scan
157+
run: |
158+
docker run --rm \
159+
-v "${PWD}:/onie" \
160+
onie-build-env \
161+
bash -lc 'cd build-config && make MACHINE=kvm_x86_64 sbom-vuln-scan'
162+
for f in build/images/*.sbom.vulns.md; do
163+
[ -f "$f" ] || continue
164+
cat "$f" >> "$GITHUB_STEP_SUMMARY"
165+
done

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@
44
/cscope.out.po
55
build
66
local.make
7-
onie-installer
7+
onie-installer
8+
encryption/machines/

‎README.rst‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,13 @@ Building ONIE
1515
The recommended way to set up an ONIE build environment is to use a Docker image, as described
1616
in the ONIE Documentation under `Preparing An ONIE Build Environment <https://opencomputeproject.github.io/onie/developers/building.html#preparing-an-onie-build-environment>`_.
1717

18+
Software Bill of Materials
19+
==========================
20+
21+
Every build emits a Software Bill of Materials (CycloneDX 1.6 and SPDX 2.3)
22+
describing the third-party software shipped in the image. See `README.sbom
23+
<README.sbom>`_ for details.
24+
1825
******************************
1926
Mailing List and Collaboration
2027
******************************

0 commit comments

Comments
 (0)