.circleci/Dockerfile

   1 FROM debian:10
   2
   3
   4 # Configuration version history
   5 # v1.0   - Initial version by Etienne Champetier
   6 # v1.0.1 - Run as non-root, add unzip, xz-utils
   7 # v1.0.2 - Add bzr
   8 # v1.0.3 - Verify usign signatures
   9 # v1.0.4 - Add support for Python3
  10 # v1.0.5 - Add 19.07 public keys, verify keys
  11 # v1.0.6 - Add 21.02 public keys, update Debian image to version 10, add rsync
  12
  13 RUN apt update && apt install -y \
  14 build-essential \
  15 bzr \
  16 curl \
  17 jq \
  18 gawk \
  19 gettext \
  20 git \
  21 libncurses5-dev \
  22 libssl-dev \
  23 python \
  24 python3 \
  25 signify-openbsd \
  26 subversion \
  27 rsync \
  28 time \
  29 unzip \
  30 wget \
  31 xz-utils \
  32 zlib1g-dev \
  33 && rm -rf /var/lib/apt/lists/*
  34
  35 RUN useradd -c "OpenWrt Builder" -m -d /home/build -s /bin/bash build
  36 USER build
  37 ENV HOME /home/build
  38
  39 # OpenWrt Build System (PGP key for unattended snapshot builds)
  40 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/626471F1.asc' | gpg --import \
  41  && gpg --fingerprint --with-colons '<pgpsign-snapshots@openwrt.org>' | grep '^fpr:::::::::54CC74307A2C6DC9CE618269CD84BCED626471F1:$' \
  42  && echo '54CC74307A2C6DC9CE618269CD84BCED626471F1:6:' | gpg --import-ownertrust
  43
  44 # OpenWrt Build System (PGP key for 17.01 "Reboot" release builds)
  45 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/D52BBB6B.asc' | gpg --import \
  46  && gpg --fingerprint --with-colons '<pgpsign-17.01@openwrt.org>' | grep '^fpr:::::::::B09BE781AE8A0CD4702FDCD3833C6010D52BBB6B:$' \
  47  && echo 'B09BE781AE8A0CD4702FDCD3833C6010D52BBB6B:6:' | gpg --import-ownertrust
  48
  49 # OpenWrt Release Builder (18.06 Signing Key)
  50 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/17E1CE16.asc' | gpg --import \
  51  && gpg --fingerprint --with-colons '<openwrt-devel@lists.openwrt.org>' | grep '^fpr:::::::::6768C55E79B032D77A28DA5F0F20257417E1CE16:$' \
  52  && echo '6768C55E79B032D77A28DA5F0F20257417E1CE16:6:' | gpg --import-ownertrust
  53
  54 # OpenWrt Build System (PGP key for 19.07 release builds)
  55 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/2074BE7A.asc' | gpg --import \
  56  && gpg --fingerprint --with-colons '<pgpsign-19.07@openwrt.org>' | grep '^fpr:::::::::D9C6901F45C9B86858687DFF28A39BC32074BE7A:$' \
  57  && echo 'D9C6901F45C9B86858687DFF28A39BC32074BE7A:6:' | gpg --import-ownertrust
  58
  59 # OpenWrt Build System (PGP key for 21.02 release builds)
  60 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/88CA59E8.asc' | gpg --import \
  61  && gpg --fingerprint --with-colons '<pgpsign-21.02@openwrt.org>' | grep '^fpr:::::::::667205E379BAF348863A5C6688CA59E88F681580:$' \
  62  && echo '667205E379BAF348863A5C6688CA59E88F681580:6:' | gpg --import-ownertrust
  63
  64 # untrusted comment: Public usign key for unattended snapshot builds
  65 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' --create-dirs -o /home/build/usign/b5043e70f9a75cde \
  66  && echo 'd7ac10f9ed1b38033855f3d27c9327d558444fca804c685b17d9dcfb0648228f */home/build/usign/b5043e70f9a75cde' | sha256sum --check
  67
  68 # untrusted comment: Public usign key for 19.07 release builds
  69 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/f94b9dd6febac963' --create-dirs -o /home/build/usign/f94b9dd6febac963 \
  70  && echo 'b1d09457cfbc36fccfe18382d65c54a2ade3e7fd3902da490a53aa517b512755 */home/build/usign/f94b9dd6febac963' | sha256sum --check
  71
  72 # untrusted comment: Public usign key for 21.02 release builds
  73 RUN curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/2f8b0b98e08306bf' --create-dirs -o /home/build/usign/2f8b0b98e08306bf  && echo 'd102bdd75421c62490b97f520f9db06aadb44ad408b244755d26e96ea5cd3b7f */home/build/usign/2f8b0b98e08306bf' | sha256sum --check