Skip to content

Commit 753d458

Browse files
atsansoneatsansone
authored
Updates SHA process (#5230)
Updates SHA process. Fixes #5229
1 parent 8a3f904 commit 753d458

7 files changed

+316
-7
lines changed

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,8 @@ tmp
3030
# Misc
3131
trash
3232
/src/_data/ci.yaml
33+
34+
# SHA Update
35+
# The script generates the .save file in case you need a rollback.
36+
*.save
37+
tool/new-dart-hashes.txt

‎Dockerfile

+8-6
Original file line numberDiff line numberDiff line change
@@ -33,24 +33,26 @@ ENV DART_SDK=/usr/lib/dart
3333
ENV PATH=$DART_SDK/bin:$PATH
3434
RUN set -eu; \
3535
case "$(dpkg --print-architecture)_${DART_CHANNEL}" in \
36+
# BEGIN dart-sha
3637
amd64_stable) \
37-
DART_SHA256="be679ccef3a0b28f19e296dd5b6374ac60dd0deb06d4d663da9905190489d48b"; \
38+
DART_SHA256="0150dff731ac017646941ebfa46ca2a7bbe5c634be0928262d524420341fc739"; \
3839
SDK_ARCH="x64";; \
3940
arm64_stable) \
40-
DART_SHA256="395180693ccc758e4e830d3b13c4879e6e96b6869763a56e91721bf9d4228250"; \
41+
DART_SHA256="2b2830001cd8732d356c4beee7be25c947e6cb6e8ca7b8ea748da47f6cc9d222"; \
4142
SDK_ARCH="arm64";; \
4243
amd64_beta) \
43-
DART_SHA256="bd0311f604def7e49215c6fbed823dc01284586f83963b6891cc6dee36da2488"; \
44+
DART_SHA256="dc85f9d7a739b4002ddeda181ce53c4e2c653c01fbd3c8096676ee99930f61f6"; \
4445
SDK_ARCH="x64";; \
4546
arm64_beta) \
46-
DART_SHA256="02de2c59d14fe4fcbcc6da756457be6966cd399bee507b2980d0e3c76fa4a2e3"; \
47+
DART_SHA256="a6166776794dd06f146877de94e09e688314a53b1c44429ed06ee03e29a6e5a8"; \
4748
SDK_ARCH="arm64";; \
4849
amd64_dev) \
49-
DART_SHA256="4b411a63f3b20dcb2fa8ad81d7ec0caf3fa19deb13b7ae5fbd66acce99cb992b"; \
50+
DART_SHA256="33adbd575bd4ec9ee682404d305002fd816ae909fe8c1007777f20c67712ec32"; \
5051
SDK_ARCH="x64";; \
5152
arm64_dev) \
52-
DART_SHA256="df63b26de4699be1738ddec36fcb98b98ac880e2223d1137caf40a529e8c0799"; \
53+
DART_SHA256="4cffcd38f32ddf1ca6ce2b361113cb85e7eb1300932f41031c7cb45206f5b045"; \
5354
SDK_ARCH="arm64";; \
55+
# END dart-sha
5456
esac; \
5557
SDK="dartsdk-linux-${SDK_ARCH}-release.zip"; \
5658
BASEURL="https://storage.googleapis.com/dart-archive/channels"; \

‎Dockerfile.save

+168
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
FROM ruby:3.2-slim-bookworm@sha256:6ff55a14560f94d6c199033e4aa90cc7f0b7afaea5a50bc91cfbc4905f366f39 as base
2+
3+
ENV DEBIAN_FRONTEND=noninteractive
4+
ENV TZ=US/Pacific
5+
RUN apt update && apt install -yq --no-install-recommends \
6+
build-essential \
7+
ca-certificates \
8+
curl \
9+
git \
10+
gnupg \
11+
lsof \
12+
make \
13+
unzip \
14+
vim-nox \
15+
&& rm -rf /var/lib/apt/lists/*
16+
17+
RUN echo "alias lla='ls -lAhG --color=auto'" >> ~/.bashrc
18+
WORKDIR /root
19+
20+
21+
# google-chrome-stable
22+
23+
24+
# ============== DART ==============
25+
# See https://github.com/dart-lang/dart-docker
26+
# See https://github.com/dart-lang/setup-dart/blob/main/setup.sh
27+
FROM base as dart
28+
ARG DART_VERSION=latest
29+
ARG DART_CHANNEL=stable
30+
ENV DART_VERSION=$DART_VERSION
31+
ENV DART_CHANNEL=$DART_CHANNEL
32+
ENV DART_SDK=/usr/lib/dart
33+
ENV PATH=$DART_SDK/bin:$PATH
34+
RUN set -eu; \
35+
case "$(dpkg --print-architecture)_${DART_CHANNEL}" in \
36+
# BEGIN dart-sha
37+
amd64_stable) \
38+
DART_SHA256="be679ccef3a0b28f19e296dd5b6374ac60dd0deb06d4d663da9905190489d48b"; \
39+
SDK_ARCH="x64";; \
40+
arm64_stable) \
41+
DART_SHA256="395180693ccc758e4e830d3b13c4879e6e96b6869763a56e91721bf9d4228250"; \
42+
SDK_ARCH="arm64";; \
43+
amd64_beta) \
44+
DART_SHA256="bd0311f604def7e49215c6fbed823dc01284586f83963b6891cc6dee36da2488"; \
45+
SDK_ARCH="x64";; \
46+
arm64_beta) \
47+
DART_SHA256="02de2c59d14fe4fcbcc6da756457be6966cd399bee507b2980d0e3c76fa4a2e3"; \
48+
SDK_ARCH="arm64";; \
49+
amd64_dev) \
50+
DART_SHA256="4b411a63f3b20dcb2fa8ad81d7ec0caf3fa19deb13b7ae5fbd66acce99cb992b"; \
51+
SDK_ARCH="x64";; \
52+
arm64_dev) \
53+
DART_SHA256="df63b26de4699be1738ddec36fcb98b98ac880e2223d1137caf40a529e8c0799"; \
54+
SDK_ARCH="arm64";; \
55+
# END dart-sha
56+
esac; \
57+
SDK="dartsdk-linux-${SDK_ARCH}-release.zip"; \
58+
BASEURL="https://storage.googleapis.com/dart-archive/channels"; \
59+
URL="$BASEURL/$DART_CHANNEL/release/$DART_VERSION/sdk/$SDK"; \
60+
curl -fsSLO "$URL"; \
61+
echo "$DART_SHA256 *$SDK" | sha256sum --check --status --strict - || (\
62+
echo -e "\n\nDART CHECKSUM FAILED! Run 'make fetch-sums' for updated values.\n\n" && \
63+
rm "$SDK" && \
64+
exit 1 \
65+
); \
66+
unzip "$SDK" > /dev/null && mv dart-sdk "$DART_SDK" && rm "$SDK";
67+
ENV PUB_CACHE="${HOME}/.pub-cache"
68+
RUN dart --disable-analytics
69+
RUN echo -e "Successfully installed Dart SDK:" && dart --version
70+
71+
72+
# ============== DART-TESTS ==============
73+
from dart as dart-tests
74+
WORKDIR /app
75+
COPY ./ ./
76+
RUN dart pub get
77+
ENV BASE_DIR=/app
78+
ENV TOOL_DIR=$BASE_DIR/tool
79+
CMD ["./tool/test.sh"]
80+
81+
82+
# ============== NODEJS INSTALL ==============
83+
FROM dart as node
84+
85+
RUN mkdir -p /etc/apt/keyrings \
86+
&& curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
87+
&& echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_18.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
88+
&& apt-get update -yq \
89+
&& apt-get install nodejs -yq \
90+
&& npm install -g npm # Ensure latest npm
91+
92+
93+
# ============== DEV/JEKYLL SETUP ==============
94+
FROM node as dev
95+
WORKDIR /app
96+
97+
ENV JEKYLL_ENV=development
98+
COPY Gemfile Gemfile.lock ./
99+
RUN gem update --system && gem install bundler
100+
RUN BUNDLE_WITHOUT="test production" bundle install --jobs=4 --retry=2
101+
102+
ENV NODE_ENV=development
103+
COPY package.json package-lock.json ./
104+
RUN npm install -g firebase-tools@12.4.0
105+
RUN npm install
106+
107+
COPY ./ ./
108+
109+
# Ensure packages are still up-to-date if anything has changed
110+
# RUN dart pub get --offline
111+
RUN dart pub get
112+
113+
# Let's not play "which dir is this"
114+
ENV BASE_DIR=/app
115+
ENV TOOL_DIR=$BASE_DIR/tool
116+
117+
# Jekyl
118+
EXPOSE 4000
119+
EXPOSE 35729
120+
121+
# Firebase emulator port
122+
# Airplay runs on :5000 by default now
123+
EXPOSE 5500
124+
125+
# re-enable defult in case we want to test packages
126+
ENV DEBIAN_FRONTEND=dialog
127+
128+
129+
# ============== FIREBASE EMULATE ==============
130+
FROM dev as emulate
131+
RUN bundle exec jekyll build --config _config.yml,_config_test.yml
132+
CMD ["make", "emulate"]
133+
134+
135+
# ============== BUILD PROD JEKYLL SITE ==============
136+
FROM node AS build
137+
WORKDIR /app
138+
139+
ENV JEKYLL_ENV=production
140+
COPY Gemfile Gemfile.lock ./
141+
RUN gem update --system && gem install bundler
142+
RUN BUNDLE_WITHOUT="test development" bundle install --jobs=4 --retry=2 --quiet
143+
144+
ENV NODE_ENV=production
145+
COPY package.json package-lock.json ./
146+
RUN npm install
147+
148+
COPY ./ ./
149+
150+
RUN dart pub get
151+
152+
ENV BASE_DIR=/app
153+
ENV TOOL_DIR=$BASE_DIR/tool
154+
155+
ARG BUILD_CONFIGS=_config.yml
156+
ENV BUILD_CONFIGS=$BUILD_CONFIGS
157+
RUN bundle exec jekyll build --config $BUILD_CONFIGS
158+
159+
160+
# ============== DEPLOY to FIREBASE ==============
161+
FROM build as deploy
162+
RUN npm install -g firebase-tools@12.4.0
163+
ARG FIREBASE_TOKEN
164+
ENV FIREBASE_TOKEN=$FIREBASE_TOKEN
165+
ARG FIREBASE_PROJECT=default
166+
ENV FIREBASE_PROJECT=$FIREBASE_PROJECT
167+
RUN [[ -z "$FIREBASE_TOKEN" ]] && echo "FIREBASE_TOKEN is required for container deploy!"
168+
RUN make deploy-ci

‎Makefile

+10
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,16 @@ fetch-sums:
145145
--version ${DART_VERSION} \
146146
--channel ${DART_CHANNEL}
147147

148+
# Check Dart sums pulls the set of Dart SDK SHA256 hashes
149+
# and writes them to a temp file.
150+
check-sums:
151+
tool/check-dart-sdk.sh
152+
153+
# Update Dart sums replaces the Dart SDK SHA256 hashes
154+
# in the Dockerfile and deletes the temp file.
155+
update-sums:
156+
tool/update-dart-sdk.sh
157+
148158
# Test the dev container with pure docker
149159
test-builds:
150160
docker build -t ${BUILD_TAG}:stable \

‎tool/check-dart-sdk.sh

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/usr/bin/env bash
2+
# Use this file locally to update Dart SDK checksum values in the Dockerfile
3+
# Prints output similar to cases in Dockerfile for easy composition
4+
# when having to update checksum values for updates dart SDK.
5+
set -eu -o pipefail
6+
TOOL_DIR="${TOOL_DIR:=$(dirname "$0")}"
7+
source $TOOL_DIR/utils.sh
8+
9+
VERSION="latest"
10+
CHANNEL="stable"
11+
12+
while (( "$#" )); do
13+
case "$1" in
14+
--version)
15+
VERSION=$2
16+
shift 2
17+
;;
18+
--channel)
19+
CHANNEL=$2
20+
shift 2
21+
;;
22+
*)
23+
echo "Unsupported argument $1" >&2
24+
exit 1
25+
;;
26+
esac
27+
done
28+
29+
echo -e "\nPulling latest Dart SHA hashes.\n\nThis will take a moment.\n"
30+
31+
BASEURL="https://storage.googleapis.com/dart-archive/channels"
32+
CHANNELS="stable beta dev"
33+
ARCHS="amd64 arm64"
34+
ENDING='\\\n'
35+
FILE=$TOOL_DIR/new-dart-hashes.txt
36+
37+
true > $FILE
38+
39+
for CHANNEL in $CHANNELS; do
40+
for ARCH in $ARCHS; do
41+
printf " ${ARCH}_${CHANNEL}) $ENDING" >> $FILE
42+
_arch=$ARCH
43+
if [[ "$_arch" == "amd64" ]]; then
44+
_arch='x64'
45+
fi
46+
_filename="dartsdk-linux-${_arch}-release.zip"
47+
_url="$BASEURL/$CHANNEL/release/$VERSION/sdk/$_filename"
48+
curl -fsSLO $_url
49+
_checksum=$(shasum -a 256 $_filename)
50+
read -a _fname_arr <<< "${_checksum}" # Read in string output as array
51+
_checkonly="${_fname_arr%:*}" # Remove filename portion of checksum output
52+
printf " DART_SHA256=\"$_fname_arr\"; $ENDING" >> $FILE
53+
printf " SDK_ARCH=\"$_arch\";; $ENDING" >> $FILE
54+
echo "Pulled ${ARCH}_${CHANNEL}: $_fname_arr"
55+
rm $_filename
56+
done
57+
done
58+
59+
echo -e "\n\nPulled latest Dart SHA hashes and saved to $FILE.\n"
60+
61+
lead='# BEGIN dart-sha$'
62+
tail='# END dart-sha$'
63+
new_file='tool/new-dart-hashes.txt'
64+
existing_file='Dockerfile'
65+
66+
new_hash=$(sed -n -e '/DART_SHA/ p' -e '/DART_SHA/ q' $new_file)
67+
old_hash=$(sed -n -e '/DART_SHA/ p' -e '/DART_SHA/ q' $existing_file)
68+
69+
echo -e "Old $old_hash"
70+
echo -e "New $new_hash"
71+
72+
# Compare the SHA hashes.
73+
if [[ "$new_hash" == "$old_hash" ]]; then
74+
echo -e "Current SHA hashes are the latest hashes.\n"
75+
echo -e "No update needed.\n"
76+
rm $new_file
77+
echo -e "Removed $new_file.\n"
78+
echo -e "Re-run check-dart-sdk.sh to pull the current SHA hashes.\n"
79+
else
80+
if [[ -f "$new_file" ]]; then
81+
echo -e "Retrieved replacement hashes and saved to $new_file.\n"
82+
if [[ -f "$existing_file" ]]; then
83+
echo -e "Found Dockerfile at $existing_file.\n"
84+
echo -e "Run tool/update-dart-sums.sh."
85+
else
86+
echo -e "No Dockerfile found."
87+
fi
88+
else
89+
echo -e "No replacement hashes found at this time.\n"
90+
fi
91+
fi

‎tool/fetch-dart-sdk-sums.sh

-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ ENDING='\\\n'
3434
printf "\n$(blue "Copy the following output and replace the existing code in the Dockerfile")\n"
3535
printf "$(blue "inside the 'set -eu' run statement:")\n\n"
3636

37-
3837
for CHANNEL in $CHANNELS; do
3938
for ARCH in $ARCHS; do
4039
printf "$(yellow "${ARCH}_${CHANNEL})") $ENDING"

‎tool/update-dart-sums.sh

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/usr/bin/env bash
2+
3+
# Use this file to update the Dart SHA256 hashes
4+
# in the Dockerfile. Run after check-dart-sdk.sh
5+
6+
lead='# BEGIN dart-sha$'
7+
tail='# END dart-sha$'
8+
new_file='tool/new-dart-hashes.txt'
9+
existing_file='Dockerfile'
10+
11+
new_hash=$(sed -n -e '/DART_SHA/ p' -e '/DART_SHA/ q' $new_file)
12+
old_hash=$(sed -n -e '/DART_SHA/ p' -e '/DART_SHA/ q' $existing_file)
13+
14+
echo -e "Old $old_hash"
15+
echo -e "New $new_hash"
16+
17+
if [[ -z "$new_hash" ]]; then
18+
echo "No new hash found."
19+
else [[ -z "$old_hash" ]]
20+
echo "Comparing hashes"
21+
if [["$new_hash" = "$old_hash"]]; then
22+
echo "Hashes match. No changes needed."
23+
else
24+
echo "New hashes found. Replacing hashes.\n"
25+
echo $(sed -i.save -e "/$lead/,/$tail/{ /$lead/{p; r $new_file
26+
}; /$tail/p;d;}" $existing_file)
27+
echo "Replaced hashes"
28+
fi
29+
fi
30+
31+
rm $new_file
32+
echo -e "Removed $new_file. Re-run check-dart-sdk.sh to pull the current SHA hashes.\n"
33+
34+
echo -e "Update completed."

0 commit comments

Comments
 (0)