Move the version (and hashes) of external dependencies to JSON files

(cherry picked from commit 4ccb0f786bab6e752ce8f6bc8223d428754c0081)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2aec01170704384bf8408e363e0987a1936a156b..4591b77d9ef3c9f31339f2bedfeaa77de031ce1b 100644 (file)
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -156,7 +156,7 @@ jobs:
     - run: inv ci-install-rust ${{ env.REPO_HOME }}
       if: matrix.product == 'dnsdist'
       working-directory: ./pdns/dnsdistdist/
-    - run: inv ci-build-and-install-quiche
+    - run: inv ci-build-and-install-quiche ${{ env.REPO_HOME }}
       if: matrix.product == 'dnsdist'
       working-directory: ./pdns/dnsdistdist/
     - name: Configure dnsdist

diff --git a/Dockerfile-dnsdist b/Dockerfile-dnsdist
index e89215d40b8db9b1aa01b9061ad98ffac4bd7bb8..0c8968789b447e330ce70d713622e6f0d4aa5a86 100644 (file)
--- a/Dockerfile-dnsdist
+++ b/Dockerfile-dnsdist
@@ -42,10 +42,16 @@ RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \
 
 
 RUN mkdir /libh2o && cd /libh2o && \
-      apt-get update && apt-get install -y cmake curl libssl-dev zlib1g-dev && \
-      curl -f -L https://github.com/PowerDNS/h2o/archive/refs/tags/v2.2.6+pdns2.tar.gz | tar xz && \
-      CFLAGS='-fPIC' cmake -DWITH_PICOTLS=off -DWITH_BUNDLED_SSL=off -DWITH_MRUBY=off -DCMAKE_INSTALL_PREFIX=/opt ./h2o-2.2.6-pdns2 && \
-      make install
+      apt-get update && apt-get install -y cmake curl jq libssl-dev zlib1g-dev && \
+      cd /source/builder-support/helpers/ && \
+      ./install_h2o.sh
+
+RUN mkdir /quiche && cd /quiche && \
+    apt-get install -y libclang-dev && \
+    apt-get clean && \
+    cd /source/builder-support/helpers/ && \
+    ./install_rust.sh && \
+    ./install_quiche.sh
 
 RUN mkdir /build && \
     LUAVER=$([ -z "${NO_LUA_JIT##*$(dpkg --print-architecture)*}" ] && echo 'lua5.3' || echo 'luajit') && \

diff --git a/Dockerfile-recursor b/Dockerfile-recursor
index 9b118cd866fc00172c4f8b688684c6d46f2ee9ea..cf94ac420db40e9612e073d6ea7ad9fd34005e45 100644 (file)
--- a/Dockerfile-recursor
+++ b/Dockerfile-recursor
@@ -13,7 +13,7 @@ ENV NO_LUA_JIT="s390x arm64"
 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
 
 # devscripts gives us mk-build-deps (and a lot of other stuff)
-RUN apt-get install -y --no-install-recommends devscripts equivs git curl && apt-get clean
+RUN apt-get install -y --no-install-recommends devscripts equivs git curl jq && apt-get clean
 
 COPY builder-support /source/builder-support
 
@@ -29,7 +29,8 @@ COPY .git /source/.git
 COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin
 
 COPY builder-support/helpers/install_rust.sh /source/install_rust.sh
-RUN /source/install_rust.sh
+COPY builder-support/helpers/rust.json /source/rust.json
+RUN cd /source/ && ./install_rust.sh
 
 # build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
 WORKDIR /source/pdns/recursordist

diff --git a/builder-support/dockerfiles/Dockerfile.debbuild b/builder-support/dockerfiles/Dockerfile.debbuild
index 71d30f6ee8b4ce6676e278f6ac4fb323b40e4cfb..bbf65dc45a8f0965ae1b94022600902f41cc7561 100644 (file)
--- a/builder-support/dockerfiles/Dockerfile.debbuild
+++ b/builder-support/dockerfiles/Dockerfile.debbuild
@@ -18,9 +18,8 @@ RUN mv pdns-recursor*.deb /dist; mv pdns-recursor*.ddeb /dist || true
 @IF [ -n "$M_dnsdist$M_all" ]
 RUN mkdir /libh2o && cd /libh2o && \
       apt-get update && apt-get install -y cmake curl libssl-dev zlib1g-dev && \
-      curl -f -L https://github.com/PowerDNS/h2o/archive/refs/tags/v2.2.6+pdns2.tar.gz | tar xz && \
-      CFLAGS='-fPIC' cmake -DWITH_PICOTLS=off -DWITH_BUNDLED_SSL=off -DWITH_MRUBY=off -DCMAKE_INSTALL_PREFIX=/opt ./h2o-2.2.6-pdns2 && \
-      make install
+      cd /pdns/builder-support/helpers/ && \
+      ./install_h2o.sh
 
 RUN builder/helpers/build-debs.sh dnsdist-${BUILDER_VERSION}
 

diff --git a/builder-support/dockerfiles/Dockerfile.debbuild-prepare b/builder-support/dockerfiles/Dockerfile.debbuild-prepare
index 64a5d401c5cfacd722f71f8b399f794cabcf4a0c..caf1847a4aa74aaa649b727e10a86eebbfdd7e45 100644 (file)
--- a/builder-support/dockerfiles/Dockerfile.debbuild-prepare
+++ b/builder-support/dockerfiles/Dockerfile.debbuild-prepare
@@ -1,6 +1,6 @@
 FROM dist-base as package-builder
 ARG APT_URL
-RUN DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends devscripts dpkg-dev build-essential python3-venv equivs curl
+RUN DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends devscripts dpkg-dev build-essential python3-venv equivs curl jq
 
 RUN mkdir /dist /pdns
 WORKDIR /pdns
@@ -9,13 +9,13 @@ ADD builder/helpers/ /pdns/builder/helpers/
 ADD builder-support/helpers/ /pdns/builder-support/helpers/
 
 @IF [ -n "$M_recursor$M_all" ]
-RUN /pdns/builder-support/helpers/install_rust.sh
+RUN cd /pdns/builder-support/helpers/ && ./install_rust.sh
 @ENDIF
 
 @IF [ -n "$M_dnsdist$M_all" ]
-RUN /pdns/builder-support/helpers/install_rust.sh
+RUN cd /pdns/builder-support/helpers/ && ./install_rust.sh
 RUN DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends git cmake clang
-RUN /pdns/builder-support/helpers/install_quiche.sh
+RUN cd /pdns/builder-support/helpers/ && ./install_quiche.sh
 @ENDIF
 
 # Used for -p option to only build specific packages

diff --git a/builder-support/dockerfiles/Dockerfile.recursor b/builder-support/dockerfiles/Dockerfile.recursor
index 088df9710c23bd80b0c037fb74abc886d078a22b..214ef9e622591a9fefbf693371e229a522398907 100644 (file)
--- a/builder-support/dockerfiles/Dockerfile.recursor
+++ b/builder-support/dockerfiles/Dockerfile.recursor
@@ -13,7 +13,8 @@ ADD builder-support/gen-version /pdns-recursor/pdns/recursordist/builder-support
 WORKDIR /pdns-recursor/pdns/recursordist
 
 ADD builder-support/helpers/ /pdns/builder-support/helpers/
-RUN /pdns/builder-support/helpers/install_rust.sh
+RUN cd /pdns/builder-support/helpers/ && \
+    ./install_rust.sh
 
 RUN mkdir /sdist
 

diff --git a/builder-support/dockerfiles/Dockerfile.rpmbuild b/builder-support/dockerfiles/Dockerfile.rpmbuild
index 048e6ad2ea4608253e94bd772205e6b05d9d1bf3..dee001a1985a283c9e0f91f6bf34abe0e69e5cfe 100644 (file)
--- a/builder-support/dockerfiles/Dockerfile.rpmbuild
+++ b/builder-support/dockerfiles/Dockerfile.rpmbuild
@@ -1,10 +1,10 @@
 FROM dist-base as package-builder
 RUN touch /var/lib/rpm/* && if $(grep -q 'release 7' /etc/redhat-release); then \
       yum upgrade -y && \
-      yum install -y rpm-build rpmdevtools python2 python3 curl "@Development Tools"; \
+      yum install -y rpm-build rpmdevtools python2 python3 curl jq "@Development Tools"; \
     else \
       yum upgrade -y && \
-      yum install --allowerasing -y rpm-build rpmdevtools python3 curl "@Development Tools"; \
+      yum install --allowerasing -y rpm-build rpmdevtools python3 curl jq "@Development Tools"; \
     fi
 
 RUN mkdir /dist /pdns
@@ -16,16 +16,17 @@ ADD builder/helpers/ /pdns/builder/helpers/
 ADD builder-support/helpers/ /pdns/builder-support/helpers/
 
 @IF [ -n "$M_recursor$M_all" ]
-RUN /pdns/builder-support/helpers/install_rust.sh
+RUN cd pdns/builder-support/helpers/ && ./install_rust.sh
 @ENDIF
 
 @IF [ -n "$M_dnsdist$M_all" ]
-RUN /pdns/builder-support/helpers/install_rust.sh
 # We do not build Quiche (DNS over QUIC support) on el-7 because the clang
 # version is too old to build the 'boring-sys' crate needed by Quiche
 RUN if ! $(grep -q 'release 7' /etc/redhat-release); then \
+      cd /pdns/builder-support/helpers/ && ./install_rust.sh; \
       yum install -y git cmake clang; \
-      /pdns/builder-support/helpers/install_quiche.sh; \
+      cd /pdns/builder-support/helpers/ && \
+      ./install_quiche.sh; \
     fi
 @ENDIF
 
@@ -62,9 +63,8 @@ RUN touch /var/lib/rpm/* &&  if $(grep -q 'release 7' /etc/redhat-release); then
 # this is fine because --allowerasing is only there to deal with libcurl conflicting with libcurl-minimal on some el9 images
 RUN touch /var/lib/rpm/* && mkdir /libh2o && cd /libh2o && \
       yum install -y --allowerasing curl libcurl openssl-devel cmake || yum install -y curl libcurl openssl-devel cmake && \
-      curl -f -L https://github.com/PowerDNS/h2o/archive/refs/tags/v2.2.6+pdns2.tar.gz | tar xz && \
-      CFLAGS='-fPIC' cmake -DWITH_PICOTLS=off -DWITH_BUNDLED_SSL=off -DWITH_MRUBY=off -DCMAKE_INSTALL_PREFIX=/opt ./h2o-2.2.6-pdns2 && \
-      make install
+      cd /pdns/builder-support/helpers/ && \
+      ./install_h2o.sh
 
 RUN touch /var/lib/rpm/* && if $(grep -q 'release 7' /etc/redhat-release); then \
       scl enable devtoolset-11 -- builder/helpers/build-specs.sh builder-support/specs/dnsdist.spec; \

diff --git a/builder-support/helpers/h2o.json b/builder-support/helpers/h2o.json
new file mode 100644 (file)
index 0000000..bff2e6d
--- /dev/null
+++ b/builder-support/helpers/h2o.json
@@ -0,0 +1,4 @@
+{
+  "version": "2.2.6-pdns2",
+  "SHA256SUM": "e25959c3f9a102e7a332ca0bb8b3f533eb14919d5a60ca999730c2ebee4b548f"
+}

diff --git a/builder-support/helpers/install_h2o.sh b/builder-support/helpers/install_h2o.sh
new file mode 100755 (executable)
index 0000000..7c70460
--- /dev/null
+++ b/builder-support/helpers/install_h2o.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -v
+set -e
+
+readonly H2O_VERSION=$(jq -r .version < h2o.json)
+readonly H2O_TARBALL="v${H2O_VERSION}.tar.gz"
+readonly H2O_TARBALL_URL="https://github.com/PowerDNS/h2o/archive/refs/tags/${H2O_TARBALL}"
+readonly H2O_TARBALL_HASH=$(jq -r .SHA256SUM < h2o.json)
+
+cd /tmp
+echo $0: Downloading $H2O_TARBALL
+curl -f -L -o "${H2O_TARBALL}" "${H2O_TARBALL_URL}"
+
+# Line below should echo two spaces between digest and name
+echo "${H2O_TARBALL_HASH}"  "${H2O_TARBALL}" | sha256sum -c -
+tar xf "${H2O_TARBALL}"
+CFLAGS='-fPIC' cmake -DWITH_PICOTLS=off -DWITH_BUNDLED_SSL=off -DWITH_MRUBY=off -DCMAKE_INSTALL_PREFIX=/opt ./h2o-${H2O_VERSION}
+make -j $(nproc)
+make install
+rm -rf "${H2O_TARBALL}" "h2o-${H2O_VERSION}"

diff --git a/builder-support/helpers/install_quiche.sh b/builder-support/helpers/install_quiche.sh
index 82f2501fbaa8cb23859e829ce5fb503367d21439..b09793fcd00d9c331425a175ed4596049daa6905 100755 (executable)
--- a/builder-support/helpers/install_quiche.sh
+++ b/builder-support/helpers/install_quiche.sh
@@ -2,10 +2,10 @@
 set -v
 set -e
 
-readonly QUICHE_VERSION='0.18.0'
+readonly QUICHE_VERSION=$(jq -r .version < quiche.json)
 readonly QUICHE_TARBALL="${QUICHE_VERSION}.tar.gz"
 readonly QUICHE_TARBALL_URL="https://github.com/cloudflare/quiche/archive/${QUICHE_TARBALL}"
-readonly QUICHE_TARBALL_HASH='eb242a14c4d801a90b57b6021dd29f7a62099f3a4d7a7ba889e105f8328e6c1f'
+readonly QUICHE_TARBALL_HASH=$(jq -r .SHA256SUM < quiche.json)
 
 INSTALL_PREFIX=/usr
 SOEXT=so
@@ -19,8 +19,9 @@ if [ $(uname) = Darwin ]; then
 fi
 
 cd /tmp
-echo $0: Downloading $QUICHE_TARBALL
+echo $0: Downloading ${QUICHE_TARBALL}
 curl -L -o "${QUICHE_TARBALL}" "${QUICHE_TARBALL_URL}"
+echo $0: Checking that the hash of ${QUICHE_TARBALL} is ${QUICHE_TARBALL_HASH}
 # Line below should echo two spaces between digest and name
 echo "${QUICHE_TARBALL_HASH}"  "${QUICHE_TARBALL}" | sha256sum -c -
 tar xf "${QUICHE_TARBALL}"

diff --git a/builder-support/helpers/install_rust.sh b/builder-support/helpers/install_rust.sh
index 17f7fb294a32afa51cd27547e332f0f8d207bfc5..bd1b4ade19f66ed8c8a63bc6a7e20062405db65f 100755 (executable)
--- a/builder-support/helpers/install_rust.sh
+++ b/builder-support/helpers/install_rust.sh
@@ -5,7 +5,8 @@ set -e
 ARCH=$(arch)
 
 # Default version
-RUST_VERSION=rust-1.73.0-$ARCH-unknown-linux-gnu
+RUST_VERSION_NUMBER=$(jq -r .version < rust.json)
+RUST_VERSION=rust-$RUST_VERSION_NUMBER-$ARCH-unknown-linux-gnu
 
 if [ $# -ge 1 ]; then
     RUST_VERSION=$1
@@ -15,8 +16,8 @@ fi
 SITE=https://downloads.powerdns.com/rust
 RUST_TARBALL=$RUST_VERSION.tar.gz
 
-SHA256SUM_x86_64=aa4cf0b7e66a9f5b7c623d4b340bb1ac2864a5f2c2b981f39f796245dc84f2cb
-SHA256SUM_aarch64=e54d7d886ba413ae573151f668e76ea537f9a44406d3d29598269a4a536d12f6
+SHA256SUM_x86_64=$(jq -r .SHA256SUM_x86_64 < rust.json)
+SHA256SUM_aarch64=$(jq -r .SHA256SUM_aarch64 < rust.json)
 
 NAME=SHA256SUM_$ARCH
 eval VALUE=\$$NAME
@@ -35,6 +36,7 @@ fi
 #
 cd /tmp
 echo $0: Downloading $RUST_TARBALL
+echo $0: Expecting hash $VALUE
 
 curl -f -o $RUST_TARBALL $SITE/$RUST_TARBALL
 # Line below should echo two spaces between digest and name

diff --git a/builder-support/helpers/quiche.json b/builder-support/helpers/quiche.json
new file mode 100644 (file)
index 0000000..e3025b3
--- /dev/null
+++ b/builder-support/helpers/quiche.json
@@ -0,0 +1,4 @@
+{
+  "version": "0.20.1",
+  "SHA256SUM": "9c460d8ecf6c80c06bf9b42f91201ef33f912e2615a871ff2d0e50197b901c71"
+}

diff --git a/builder-support/helpers/rust.json b/builder-support/helpers/rust.json
new file mode 100644 (file)
index 0000000..ac9e47f
--- /dev/null
+++ b/builder-support/helpers/rust.json
@@ -0,0 +1,5 @@
+{
+  "version": "1.75.0",
+  "SHA256SUM_x86_64": "473978b6f8ff216389f9e89315211c6b683cf95a966196e7914b46e8cf0d74f6",
+  "SHA256SUM_aarch64": "30828cd904fcfb47f1ac43627c7033c903889ea4aca538f53dcafbb3744a9a73"
+}

diff --git a/builder-support/specs/pdns-recursor.spec b/builder-support/specs/pdns-recursor.spec
index 8408500e98a8c4ef8ed4a6134e4331be20a5b85e..df4b6b9682340483b238cec0789894ad6a3fc4d2 100644 (file)
--- a/builder-support/specs/pdns-recursor.spec
+++ b/builder-support/specs/pdns-recursor.spec
@@ -4,6 +4,7 @@ Release: %{getenv:BUILDER_RPM_RELEASE}%{?dist}
 Summary: Modern, advanced and high performance recursing/non authoritative name server
 Group: System Environment/Daemons
 License: GPLv2
+Vendor: PowerDNS.COM BV
 URL: https://powerdns.com
 Source0: %{name}-%{getenv:BUILDER_VERSION}.tar.bz2
 

diff --git a/builder-support/specs/pdns.spec b/builder-support/specs/pdns.spec
index 9f265eda1d543b040e40aa13cb45315941d6dd7a..ac02b68d52260eca3ce9e131c1125590fc1a8603 100644 (file)
--- a/builder-support/specs/pdns.spec
+++ b/builder-support/specs/pdns.spec
@@ -7,6 +7,7 @@ Release: %{getenv:BUILDER_RPM_RELEASE}%{dist}
 Summary: A modern, advanced and high performance authoritative-only nameserver
 Group: System Environment/Daemons
 License: GPLv2
+Vendor: PowerDNS.COM BV
 URL: https://powerdns.com
 Source0: %{name}-%{getenv:BUILDER_VERSION}.tar.bz2
 

diff --git a/tasks.py b/tasks.py
index 3583d4d3d6e2e8293068e7615fcfe9297a4b7f19..0fa6fdd2ba257936f888ce255d273bc78fb0fa83 100644 (file)
--- a/tasks.py
+++ b/tasks.py
@@ -1,6 +1,7 @@
 from invoke import task
 from invoke.exceptions import Failure, UnexpectedExit
 
+import json
 import os
 import sys
 import time
@@ -8,8 +9,6 @@ import time
 auth_backend_ip_addr = os.getenv('AUTH_BACKEND_IP_ADDR', '127.0.0.1')
 
 clang_version = os.getenv('CLANG_VERSION', '13')
-quiche_version = '0.18.0'
-quiche_hash = 'eb242a14c4d801a90b57b6021dd29f7a62099f3a4d7a7ba889e105f8328e6c1f'
 
 all_build_deps = [
     'ccache',
@@ -172,7 +171,8 @@ def install_clang_runtime(c):
 
 @task
 def ci_install_rust(c, repo):
-    c.sudo(f'{repo}/builder-support/helpers/install_rust.sh')
+    with c.cd(f'{repo}/builder-support/helpers/'):
+        c.run('sudo sh install_rust.sh')
 
 def install_libdecaf(c, product):
     c.run('git clone https://git.code.sf.net/p/ed448goldilocks/code /tmp/libdecaf')
@@ -910,7 +910,12 @@ def coverity_upload(c, email, project, tarball):
             https://scan.coverity.com/builds?project={project}', hide=True)
 
 @task
-def ci_build_and_install_quiche(c):
+def ci_build_and_install_quiche(c, repo):
+    with open(f'{repo}/builder-support/helpers/quiche.json') as quiche_json:
+        quiche_data = json.load(quiche_json)
+        quiche_version = quiche_data['version']
+        quiche_hash = quiche_data['SHA256SUM']
+
     # we have to pass -L because GitHub will do a redirect, sadly
     c.run(f'curl -L -o quiche-{quiche_version}.tar.gz https://github.com/cloudflare/quiche/archive/{quiche_version}.tar.gz')
     # Line below should echo two spaces between digest and name