mirror of
https://github.com/saymrwulf/xous-core.git
synced 2026-11-04 04:27:34 +00:00
0959ea80db
* Verify checksum of downloaded rust target riscv32imac-unknown-xous_*.zip * Pin base image to a sha256 digest * Quote build arg to prevent shell injection attacks * Run cargo --locked to make sure builds follow Cargo.lock * Use --proto '=https' for curl to only allow HTTPS protocol to prevent downgrade attacks * Create non-root user to run cargo commands and build artifacts
36 lines
1.4 KiB
Docker
36 lines
1.4 KiB
Docker
ARG RUST_VERSION="1.92.0"
|
|
ARG IMG_SHA256=""
|
|
FROM rust:${RUST_VERSION}-slim-bullseye${IMG_SHA256:+@sha256:${IMG_SHA256}} AS toolchain
|
|
|
|
ARG EXTRA="1"
|
|
|
|
RUN set -eux; \
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
git \
|
|
unzip \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& download_url="https://github.com/betrusted-io/rust/releases/download"; \
|
|
zipfile="riscv32imac-unknown-xous_${RUST_VERSION}.zip"; \
|
|
curl --proto '=https' --tlsv1.2 -fsSL -O "${download_url}/${RUST_VERSION}.${EXTRA}/${zipfile}"; \
|
|
sha256="fc7e7210444ee33c96956c4015eeafe96a588c12d68385ad763a4d1f3c6ec811"; \
|
|
echo "${sha256} *${zipfile}" | sha256sum --strict --check -; \
|
|
unzip "${zipfile}" -d "$(rustc --print sysroot)"; \
|
|
rm "${zipfile}"
|
|
|
|
RUN rustup target add riscv32imac-unknown-none-elf
|
|
|
|
|
|
FROM toolchain AS builder
|
|
ARG app="helloworld"
|
|
RUN useradd --create-home --uid 1000 baozi
|
|
USER baozi
|
|
WORKDIR /home/baozi/xous-core
|
|
COPY --chown=baozi:baozi . .
|
|
RUN --mount=type=cache,target=/home/baozi/.cargo/registry,uid=1000,gid=1000 cargo --locked xtask dabao "${app}"
|
|
|
|
|
|
FROM scratch
|
|
COPY --from=builder /home/baozi/xous-core/target/riscv32imac-unknown-xous-elf/release/apps.uf2 /
|
|
COPY --from=builder /home/baozi/xous-core/target/riscv32imac-unknown-xous-elf/release/loader.uf2 /
|
|
COPY --from=builder /home/baozi/xous-core/target/riscv32imac-unknown-xous-elf/release/xous.uf2 /
|