update/refactor

Dockerfile.deps

@@ -3,6 +3,58 @@ FROM ${BASE_IMAGE} AS base
 
 ## ---
 
+FROM base AS catatonit
+SHELL [ "/bin/sh", "-ec" ]
+
+COPY /scripts/*        /usr/local/sbin/
+COPY /extra-scripts/*  /usr/local/sbin/
+
+## current HEAD: "main: don't use secure_getenv", December 14, 2024
+ENV CATATONIT_COMMIT=56579adbb42c0c7ad94fc12d844b38fc5b37b3ce
+
+# ARG CATATONIT_BASE_URI='https://codeload.github.com/openSUSE/catatonit/tar.gz'
+# ARG CATATONIT_URI="${CATATONIT_BASE_URI}/${CATATONIT_COMMIT}"
+
+ARG CATATONIT_BASE_URI='https://github.com/openSUSE/catatonit/archive'
+ARG CATATONIT_URI="${CATATONIT_BASE_URI}/${CATATONIT_COMMIT}.tar.gz"
+
+# hadolint ignore=DL3020
+ADD "${CATATONIT_URI}"  /tmp/catatonit.tar.gz
+
+RUN pkg='build-essential debhelper musl-dev autoconf autoconf-archive' ; \
+    apt-install.sh ${pkg} ; \
+    ## build catatonit
+    d=/tmp/catatonit ; \
+    rm -rf "$d" ; \
+    mkdir -p "$d" ; \
+    ( \
+        cd "$d" ; \
+        tar --strip-components=1 -xf /tmp/catatonit.tar.gz ; \
+        commit_abbrev=$(printf '%s' "${CATATONIT_COMMIT}" | cut -c1-8) ; \
+        sed -i "s/+dev/+git.${commit_abbrev}/" configure.ac ; \
+        # DEB_HOST_GNU_TYPE=$(dpkg-architecture -q DEB_HOST_GNU_TYPE) ; \
+        # export HOSTCC="${DEB_HOST_GNU_TYPE}-gcc" ; \
+        DEB_TARGET_GNU_TYPE=$(dpkg-architecture -q DEB_TARGET_GNU_TYPE) ; \
+        DEB_TARGET_MUSL_TYPE=$(printf '%s' "${DEB_TARGET_GNU_TYPE}" | sed -E 's/-gnu$/-musl/') ; \
+        export CC="${DEB_TARGET_MUSL_TYPE}-gcc" ; \
+        export CFLAGS='-Os -g -pipe -fpie -fstack-protector-strong -fstack-clash-protection -fcf-protection -D_FORTIFY_SOURCE=2' ; \
+        export LDFLAGS='-static-pie -Wl,-z -Wl,relro' ; \
+        autoreconf -fiv ; \
+        ./configure ; \
+        make -j1 ; \
+        ls -l catatonit ; \
+        # "${DEB_TARGET_GNU_TYPE}-strip" --strip-debug --strip-unneeded catatonit ; \
+        strip --strip-debug --strip-unneeded catatonit ; \
+        ls -l catatonit ; \
+        cp catatonit /usr/local/bin/ ; \
+    ) ; \
+    ## cleanup
+    rm -rf "$d" ; \
+    apt-remove.sh ${pkg} ; \
+    apt-clean.sh
+
+## ---
+
 FROM base AS patroni
 SHELL [ "/bin/sh", "-ec" ]
 
@@ -31,7 +83,7 @@ RUN w=$(mktemp -d) ; : "${w:?}" ; \
     set -e ; \
     rm -rf "$w/" ; unset w ; \
     apt-install.sh build-essential ; \
-    pip-env.sh pip install 'cython' ; \
+    pip-env.sh pip install 'cython~=3.0.12' ; \
     pip-env.sh pip install \
       --no-binary 'cffi,psutil,pyyaml' \
       -r /tmp/requirements.txt \
@@ -55,18 +107,21 @@ RUN w=$(mktemp -d) ; : "${w:?}" ; \
     echo ; \
     find "${PYTHON_SITE_PACKAGES}/" -type f -name '*.so*' -printf '%p\0' \
     | sed -zE '/rust/d' \
-    | xargs -0r strip --verbose --strip-debug --strip-unneeded ; \
+    | xargs -0r strip --strip-debug --strip-unneeded ; \
     echo ; \
     find "${PYTHON_SITE_PACKAGES}/" -type f -name '*.so*' -exec ls -l {} + ; \
     apt-remove.sh build-essential ; \
     apt-clean.sh
 
 ## avoid changing already present packages
-RUN find "${PYTHON_SITE_PACKAGES}/" -mindepth 1 -maxdepth 1 -printf '%P\0' \
+RUN rm -rfv \
+      /usr/local/bin/pip \
+      /usr/local/bin/pip3* \
+    ; \
+    find "${PYTHON_SITE_PACKAGES}/" -mindepth 1 -maxdepth 1 -printf '%P\0' \
     | sed -zEn \
       -e '/^pip(|-.+\.dist-info)$/p' \
-    | env -C "${PYTHON_SITE_PACKAGES}" xargs -0r \
-      rm -rf
+    | env -C "${PYTHON_SITE_PACKAGES}" xargs -0r rm -rf
 
 ## ---
 
@@ -80,6 +135,8 @@ COPY /scripts/*  /usr/local/sbin/
 COPY /apt/sources.pgdg      /etc/apt/sources.list.d/pgdg.sources
 COPY /apt/preferences.pgdg  /etc/apt/preferences.d/pgdg
 
+COPY --from=catatonit  /usr/local/bin/catatonit  /usr/local/bin/
+
 COPY --from=patroni  /usr/local/bin/            /usr/local/bin/
 COPY --from=patroni  /${PYTHON_SITE_PACKAGES}/  /${PYTHON_SITE_PACKAGES}/
 
@@ -108,8 +165,7 @@ RUN _lang=en_US.UTF8 ; \
     locale -a | grep -Fixq "${_lang}"
 ENV LANG=en_US.UTF8
 
-RUN find /usr/local/sbin/ ! -type d -ls -delete ; \
-    jdupes -1LSpr /usr/
+RUN find /usr/local/sbin/ ! -type d -ls -delete
 
 ## ---
 
@@ -157,7 +213,9 @@ RUN find /usr/local/ -type f -name '*.py[co]' -printf '%P\0' \
     | sort -zV \
     | tar -C /usr/local --null -T - -cf - \
     | tar -xf -
-  
+
+## ---
+
 FROM deps-intermediate AS deps
 
 ## RFC: Python cache