mirror of
https://github.com/XRPLF/rippled.git
synced 2026-06-02 16:26:48 +00:00
49cb3f45a4
Co-authored-by: semgrep-companion-app[bot] <218312740+semgrep-companion-app[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
96 lines
2.9 KiB
Docker
96 lines
2.9 KiB
Docker
ARG BASE_IMAGE=nixos/nix:latest
|
|
|
|
# Nix builder
|
|
FROM nixos/nix:latest AS builder-source
|
|
|
|
RUN mkdir -p ~/.config/nix && \
|
|
echo "experimental-features = nix-command flakes" >> ~/.config/nix/nix.conf
|
|
|
|
# Copy our source and setup our working dir.
|
|
COPY nix/ci-env.nix /tmp/build/nix/ci-env.nix
|
|
COPY nix/packages.nix /tmp/build/nix/packages.nix
|
|
COPY nix/utils.nix /tmp/build/nix/utils.nix
|
|
COPY flake.nix /tmp/build/
|
|
COPY flake.lock /tmp/build/
|
|
WORKDIR /tmp/build
|
|
|
|
FROM builder-source AS builder
|
|
|
|
# Build our Nix CI environment (all build tools in a single store path)
|
|
RUN nix \
|
|
--option filter-syscalls false \
|
|
build
|
|
|
|
# Copy the Nix store closure into a directory. The Nix store closure is the
|
|
# entire set of Nix store values that we need for our build.
|
|
RUN mkdir /tmp/nix-store-closure && \
|
|
cp -R $(nix-store -qR result/) /tmp/nix-store-closure
|
|
|
|
# Final image
|
|
FROM ${BASE_IMAGE}
|
|
|
|
# bash is not located at /bin/bash in nixos/nix, so we need to create a symlink to it.
|
|
RUN if [ -d /nix ]; then \
|
|
ln -s /root/.nix-profile/bin/bash /bin/bash; \
|
|
fi
|
|
|
|
# Use Bash as the default shell for RUN commands, using the options
|
|
# `set -o errexit -o pipefail`, and as the entrypoint.
|
|
SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
|
|
ENTRYPOINT ["/bin/bash"]
|
|
|
|
# Copy /nix/store and the env symlink tree
|
|
COPY --from=builder /tmp/nix-store-closure /nix/store
|
|
COPY --from=builder /tmp/build/result /nix/ci-env
|
|
|
|
ENV PATH="/nix/ci-env/bin:$PATH"
|
|
|
|
# Externally-built dynamically-linked ELF binaries hard-code the loader path
|
|
# (e.g. /lib64/ld-linux-x86-64.so.2) in their PT_INTERP header. Copy the
|
|
# loader from the Nix store to that path when the base image doesn't already
|
|
# provide one (i.e. on nixos/nix).
|
|
RUN <<EOF
|
|
case "$(uname -m)" in
|
|
x86_64) target=/lib64/ld-linux-x86-64.so.2 ;;
|
|
aarch64) target=/lib/ld-linux-aarch64.so.1 ;;
|
|
*) echo "Unsupported arch: $(uname -m)" >&2; exit 1 ;;
|
|
esac
|
|
if [ ! -e "$target" ]; then
|
|
# Use the loader from the same glibc that gcc links libc against, so
|
|
# ld-linux and libc/libpthread share GLIBC_PRIVATE symbols at runtime.
|
|
src="$(dirname "$(gcc -print-file-name=libc.so.6)")/$(basename "$target")"
|
|
[ -e "$src" ] || { echo "ld-linux not found at $src" >&2; exit 1; }
|
|
mkdir -p "$(dirname "$target")"
|
|
cp "$src" "$target"
|
|
fi
|
|
EOF
|
|
|
|
RUN <<EOF
|
|
ccache --version
|
|
clang --version
|
|
clang++ --version
|
|
clang-format --version
|
|
cmake --version
|
|
conan --version
|
|
g++ --version
|
|
gcc --version
|
|
gcovr --version
|
|
git --version
|
|
make --version
|
|
mold --version
|
|
ninja --version
|
|
perl --version
|
|
pkg-config --version
|
|
pre-commit --version
|
|
python3 --version
|
|
run-clang-tidy --help
|
|
vim --version
|
|
EOF
|
|
|
|
# Sanity-check that the sanitizer runtimes shipped with g++/clang++ work
|
|
# end-to-end against the system loader.
|
|
COPY docker/cpp_files/ /tmp/cpp_files/
|
|
COPY docker/check-sanitizers.sh /tmp/check-sanitizers.sh
|
|
|
|
RUN grep -qi ubuntu /etc/os-release 2>/dev/null && /tmp/check-sanitizers.sh /tmp/cpp_files || true
|