model-transparency-go/Containerfile.model-transparency-go.rh at main · securesign/model-transparency-go · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
FROM registry.redhat.io/ubi9/go-toolset:9.8-1789040808@sha256:685ccca486cc2c82b0818d835abecb1aed7a396e76ba416cfc47c28067f5d365 AS build-env

ARG BUILD_TAGS=""

ENV APP_ROOT=/opt/app-root \
    GOPATH=/opt/app-root \
    GOFLAGS="-buildvcs=false"

USER root

RUN mkdir -p /opt/app-root/src && git config --global --add safe.directory /opt/app-root/src

WORKDIR /opt/app-root/src

COPY . .

RUN go mod vendor

RUN set -euo pipefail; \
    GIT_VERSION="$(git describe --tags --always --dirty 2>/dev/null || echo v0.0.0)"; \
    GIT_HASH="$(git rev-parse HEAD 2>/dev/null || echo unknown)"; \
    GIT_TREESTATE="clean"; \
    BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"; \
    LDFLAGS="-X sigs.k8s.io/release-utils/version.gitVersion=${GIT_VERSION} \
             -X sigs.k8s.io/release-utils/version.gitCommit=${GIT_HASH} \
             -X sigs.k8s.io/release-utils/version.gitTreeState=${GIT_TREESTATE} \
             -X sigs.k8s.io/release-utils/version.buildDate=${BUILD_DATE} \
             -w -s"; \
    git update-index --assume-unchanged Containerfile.model-transparency-go.rh; \
    git update-index --assume-unchanged Containerfile.cli-stack.rh; \
    CGO_ENABLED=1 go build -tags="${BUILD_TAGS}" -trimpath -ldflags "${LDFLAGS}" \
        -o model_transparency_cli ./cmd/model-signing; \
    cp model_transparency_cli model_transparency_cli_linux; \
    CGO_ENABLED=1 go build -tags="${BUILD_TAGS},pkcs11" -trimpath -ldflags "${LDFLAGS}" \
        -o model_transparency_cli_pkcs11_linux ./cmd/model-signing; \
    CGO_ENABLED=1 go build -tags="${BUILD_TAGS},otel" -trimpath -ldflags "${LDFLAGS}" \
        -o model_transparency_cli_otel_linux ./cmd/model-signing; \
    git update-index --no-assume-unchanged Containerfile.model-transparency-go.rh; \
    git update-index --no-assume-unchanged Containerfile.cli-stack.rh

FROM registry.redhat.io/ubi9-minimal@sha256:d235f607e1d6d833f031db107dc42206e4dd4d5aa9142c43d3771fb7f9bea76a

COPY --from=build-env /opt/app-root/src/model_transparency_cli /usr/local/bin/model_transparency_cli
COPY --from=build-env /opt/app-root/src/model_transparency_cli_linux /usr/local/bin/model_transparency_cli_linux
COPY --from=build-env /opt/app-root/src/model_transparency_cli_pkcs11_linux /usr/local/bin/model_transparency_cli_pkcs11_linux
COPY --from=build-env /opt/app-root/src/model_transparency_cli_otel_linux /usr/local/bin/model_transparency_cli_otel_linux

COPY LICENSE /licenses/license.txt

WORKDIR /opt/app-root/src/home

USER 65532:65532

ENTRYPOINT ["model_transparency_cli"]
CMD ["--help"]

LABEL description="Supply chain security for ML"
LABEL io.k8s.description="Supply chain security for ML"
LABEL io.k8s.display-name="Go based Model Transparency Library"
LABEL io.openshift.tags="model transparency security ml"
LABEL summary="Provides a go library for model transparency."
LABEL com.redhat.component="model-transparency-go"
LABEL name="rhtas/model-transparency-cli-rhel9"
LABEL org.opencontainers.image.version="1.0.0"