mirror of
https://github.com/luxfi/kms.git
synced 2026-07-27 05:54:18 +00:00
hanzo-dev
a20bc707f1
The Docker builds set GOPRIVATE=luxfi/*,hanzoai/* which routes module fetches 'direct' (git) and bypasses sum.golang.org. After luxfi/keys@v1.1.0 was force-republished, the git tag content diverged from the immutable proxy/sumdb hash — so 'go mod download' fetched bits that no longer matched the (correct, sumdb-canonical) go.sum, failing every image build with SECURITY ERROR checksum mismatch. These modules are public; resolving them through the default public proxy + sumdb yields the canonical immutable hash that matches go.sum and a re-publish can no longer break. GITHUB_TOKEN insteadOf stays for the direct fallback.
39 lines
1.5 KiB
Docker
39 lines
1.5 KiB
Docker
# luxfi/kms-operator — minimal KMSSecret reconciler.
|
|
# Single static Go binary, no CGO, scratch runtime.
|
|
|
|
FROM golang:1.26.4-bookworm AS builder
|
|
ENV GOTOOLCHAIN=auto
|
|
ARG GITHUB_TOKEN
|
|
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
|
|
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
|
|
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates tzdata \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& echo 'nonroot:x:65532:65532:nonroot:/home/nonroot:/sbin/nologin' >> /etc/passwd \
|
|
&& echo 'nonroot:x:65532:' >> /etc/group
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
COPY vendor ./vendor
|
|
COPY cmd/kms-operator ./cmd/kms-operator
|
|
# zapclient and its in-module deps (envelope, zap) — vendor only carries
|
|
# external deps, so the module's own packages must be in the build context.
|
|
COPY pkg/zapclient ./pkg/zapclient
|
|
COPY pkg/envelope ./pkg/envelope
|
|
COPY pkg/zap ./pkg/zap
|
|
|
|
RUN CGO_ENABLED=0 go build -mod=vendor \
|
|
-ldflags="-s -w" -o /usr/local/bin/kms-operator ./cmd/kms-operator
|
|
|
|
FROM scratch
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
|
|
COPY --from=builder /etc/passwd /etc/passwd
|
|
COPY --from=builder /etc/group /etc/group
|
|
COPY --from=builder /usr/local/bin/kms-operator /usr/local/bin/kms-operator
|
|
USER 65532:65532
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/usr/local/bin/kms-operator"]
|