republish canton images (#3278)

Signed-off-by: Itai Segall <itai.segall@digitalasset.com>

Author: isegall-da

MAINTENANCE.md

@@ -16,15 +16,12 @@
 1. Generate a patch file of the JSON API v2 OpenAPI definition by running `diff-openapi.sh` in `token-standard/dependencies/canton-json-api-v2/openapi/`.
 2. Choose the Canton version you wish to upgrade to. The currently published versions on
    Artifactory can be found [here](https://digitalasset.jfrog.io/ui/repos/tree/General/canton-enterprise).
-3. Compute the hashes of the corresponding enterprise and oss versions by running:
-   `nix store prefetch-file --json --hash-type sha256 https://digitalasset.jfrog.io/artifactory/canton-enterprise/canton-enterprise-<version>.tar.gz | jq -r '.hash'` and
-   `nix store prefetch-file --json --hash-type sha256  https://www.canton.io/releases/canton-open-source-<version>.tar.gz | jq -r '.hash'`
-4. Update the Canton version and hashes of the oss and enterprise versions in `nix/canton-sources.json`.
-5. In case you have also made configuration changes to Canton in `simple-topology-canton.conf`, remember
+3. Update the hashes in `nix/canton-sources.json` by running: `build-tools/bump-canton.sh <version>`
+4. In case you have also made configuration changes to Canton in `simple-topology-canton.conf`, remember
    to also make the corresponding changes for our cluster deployments. It is recommended to test any configuration
    changes on scratchnet first.
-6. Update the OpenAPI definitions from step 1 by running `update-openapi.sh` in `token-standard/dependencies/canton-json-api-v2/openapi/`.
-7. Cleanup the `openapi.patch` file.
+5. Update the OpenAPI definitions from step 1 by running `update-openapi.sh` in `token-standard/dependencies/canton-json-api-v2/openapi/`.
+6. Cleanup the `openapi.patch` file.
    Check `token-standard/dependencies/canton-json-api-v2/openapi/CHANGES.md` and apply any changes manually if CI breaks due to
    token standard CLI issues that look caused by bad OpenAPI definitions.
 

build-tools/bump-canton.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source "${TOOLS_LIB}/libcli.source"
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <new-canton-version>"
+    exit 1
+fi
+
+NEW_VERSION="$1"
+
+function set_value() {
+  local key="$1"
+  local value="$2"
+
+  jq --arg key "$key" --arg value "$value" '.[ $key ] = $value' nix/canton-sources.json > nix/canton-sources.tmp.json
+  mv nix/canton-sources.tmp.json nix/canton-sources.json
+}
+
+set_value version "$NEW_VERSION"
+
+_info "Fetching enterprise tar.gz hash..."
+enterprise_sha256=$(nix store prefetch-file --json --hash-type sha256 "https://digitalasset.jfrog.io/artifactory/canton-enterprise/canton-enterprise-${NEW_VERSION}.tar.gz" | jq -r '.hash')
+# Apparently, nix256 is a thing... While nix seems to accept both, when you have the wrong one,
+# nix shows the nix256-formatted one, so we use that one too
+# (also for backward compatibility with the format we used before this script)
+enterprise_nix256="sha256:"$(nix hash convert --to nix32 "$enterprise_sha256")
+set_value enterprise_sha256 "$enterprise_nix256"
+
+_info "Fetching open source tar.gz hash..."
+oss_sha256=$(nix store prefetch-file --json --hash-type sha256 "https://www.canton.io/releases/canton-open-source-${NEW_VERSION}.tar.gz" | jq -r '.hash')
+oss_nix256="sha256:"$(nix hash convert --to nix32 "$oss_sha256")
+set_value oss_sha256 "$oss_nix256"
+
+for img in base participant mediator sequencer; do
+  _info "Fetching image sha256 for canton-$img..."
+  sha=$(skopeo inspect "docker://europe-docker.pkg.dev/da-images/public-all/docker/canton-$img:${CANTON_VERSION}" --format '{{.Digest}}')
+  set_value "canton_${img}_image_sha256" "$sha"
+done

cluster/images/canton-base-image-dep.mk

@@ -8,8 +8,6 @@ target-driver := $(dir)/target/driver.jar
 $(dir)/$(docker-build): $(target-driver)
 $(dir)/$(docker-build): build_arg := --build-arg base_version=$(shell get-snapshot-version)
 
-include cluster/images/canton-base-image-dep.mk
-
 $(target-driver): ${COMETBFT_DRIVER}/driver.jar
 	cp $< $@
 

cluster/images/canton-cometbft-sequencer/local.mk

@@ -1,11 +1,12 @@
 # Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-ARG base_version
-FROM canton:${base_version}
+ARG canton_version
+ARG image_sha256
+FROM europe-docker.pkg.dev/da-images/public-all/docker/canton-base:${canton_version}@${image_sha256}
 
-ARG base_version
-LABEL org.opencontainers.image.base.name="canton:${base_version}"
+ARG canton_version
+LABEL org.opencontainers.image.base.name="canton-base:${canton_version}"
 
 EXPOSE 5007
 EXPOSE 5008
@@ -18,9 +19,3 @@ COPY app.conf bootstrap.sc /app/
 
 HEALTHCHECK --start-period=10m \
   CMD grpcurl -plaintext localhost:5061 grpc.health.v1.Health/Check && grpcurl -plaintext localhost:5062 grpc.health.v1.Health/Check || exit 1
-
-# Not upstreamed on purpose, this is the Splice part to allow easy overrides from within Splice:
-COPY additional-config.conf /app/
-USER root
-RUN chown -R nonroot:nonroot /app/additional-config.conf
-USER nonroot

cluster/images/canton-domain/Dockerfile

@@ -1,7 +1,3 @@
-# This file is frozen, and will be deleted soon (in favor of its copy upstream in Canton repo).
-# Please DO NOT modify this file. For quick iterations on config changes, use additional-config.conf.
-# For permanent ones, please upstream the change to Canton repo.
-
 include required(file("/app/storage.conf"))
 
 canton {

cluster/images/canton-domain/additional-config.conf

@@ -4,6 +4,4 @@
 dir := $(call current_dir)
 
 $(dir)/$(docker-build): $(dir)/app.conf $(dir)/bootstrap.sc
-$(dir)/$(docker-build): build_arg := --build-arg base_version=$(shell get-snapshot-version)
-
-include cluster/images/canton-base-image-dep.mk
+$(dir)/$(docker-build): build_arg := --build-arg canton_version=${CANTON_VERSION} --build-arg image_sha256=${CANTON_BASE_IMAGE_SHA256}

cluster/images/canton-domain/app.conf

@@ -1,18 +1,11 @@
 # Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-ARG base_version
-FROM canton:${base_version}
+ARG canton_version
+ARG image_sha256
 
-ARG base_version
-LABEL org.opencontainers.image.base.name="canton:${base_version}"
+FROM europe-docker.pkg.dev/da-images/public-all/docker/canton-mediator:${canton_version}@${image_sha256}
 
-EXPOSE 5007
-EXPOSE 10013
-
-COPY app.conf /app/
-
-# Not upstreamed on purpose, this is the Splice part to allow easy overrides from within Splice:
 COPY additional-config.conf /app/
 USER root
 RUN chown -R nonroot:nonroot /app/additional-config.conf