Skip to content

Commit 784d0f1

Browse files
richardlaurichardlau
committed
ansible: add Ubuntu 22.04 sharedlibs container
Add an Ubuntu 22.04 based sharedlibs container, intended to eventually replace the Ubuntu 18.04 based one. Changes compared to the Ubuntu 18.04 container: - Add FIPS variant for OpenSSL 3.0. - Add OpenSSL 3.1. - Dropped older versions of ICU that were used for Node.js 14.
1 parent 50f8b32 commit 784d0f1

1 file changed

Lines changed: 137 additions & 0 deletions

File tree

‎ansible/roles/docker/templates/ubuntu2204_sharedlibs.Dockerfile.j2‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
FROM ubuntu:22.04
2+
3+
ENV LC_ALL C
4+
ENV USER {{ server_user }}
5+
ENV JOBS {{ server_jobs | default(ansible_processor_vcpus) }}
6+
ENV SHELL /bin/bash
7+
ENV HOME /home/{{ server_user }}
8+
ENV PATH /usr/lib/ccache:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
9+
ENV NODE_COMMON_PIPE /home/{{ server_user }}/test.pipe
10+
ENV NODE_TEST_DIR /home/{{ server_user }}/tmp
11+
ENV OSTYPE linux-gnu
12+
ENV OSVARIANT docker
13+
ENV DESTCPU {{ arch }}
14+
ENV ARCH {{ arch }}
15+
ENV DEBIAN_FRONTEND noninteractive
16+
17+
RUN apt-get update && apt-get install apt-utils -y && \
18+
apt-get dist-upgrade -y && apt-get install -y \
19+
ccache \
20+
g++ \
21+
gcc \
22+
git \
23+
openjdk-17-jre-headless \
24+
pkg-config \
25+
curl \
26+
python3-pip \
27+
python-is-python3 \
28+
libfontconfig1 \
29+
libtool \
30+
automake
31+
32+
RUN pip3 install tap2junit=={{ tap2junit_version }}
33+
34+
RUN addgroup --gid {{ server_user_gid.stdout_lines[0] }} {{ server_user }}
35+
36+
RUN adduser --gid {{ server_user_gid.stdout_lines[0] }} --uid {{ server_user_uid.stdout_lines[0] }} --disabled-password --gecos {{ server_user }} {{ server_user }}
37+
38+
ENV ICU69DIR=/opt/icu-69.1 \
39+
ICU71DIR=/opt/icu-71.1
40+
41+
RUN for ICU_ENV in $(env | grep ICU..DIR); do \
42+
ICU_PREFIX=$(echo $ICU_ENV | cut -d '=' -f 2) && \
43+
ICU_VERSION=$(echo $ICU_PREFIX | cut -d '-' -f 2) && \
44+
ICU_MAJOR=$(echo $ICU_VERSION | cut -d '.' -f 1) && \
45+
ICU_MINOR=$(echo $ICU_VERSION | cut -d '.' -f 2) && \
46+
mkdir -p /tmp/icu-$ICU_VERSION && \
47+
cd /tmp/icu-$ICU_VERSION && \
48+
curl -sL "https://github.com/unicode-org/icu/releases/download/release-$ICU_MAJOR-$ICU_MINOR/icu4c-${ICU_MAJOR}_$ICU_MINOR-src.tgz" | tar zxv --strip=1 && \
49+
cd source && \
50+
./runConfigureICU Linux --prefix=$ICU_PREFIX && \
51+
make -j $JOBS && \
52+
make install && \
53+
rm -rf /tmp/icu-$ICU_VERSION; \
54+
done
55+
56+
ENV OPENSSL111VER 1.1.1u
57+
ENV OPENSSL111DIR /opt/openssl-$OPENSSL111VER
58+
59+
RUN mkdir -p /tmp/openssl_$OPENSSL111VER && \
60+
cd /tmp/openssl_$OPENSSL111VER && \
61+
curl -sL https://www.openssl.org/source/openssl-$OPENSSL111VER.tar.gz | tar zxv --strip=1 && \
62+
./config --prefix=$OPENSSL111DIR && \
63+
make -j $JOBS && \
64+
make install && \
65+
rm -rf /tmp/openssl_$OPENSSL111VER
66+
67+
# OpenSSL FIPS validation occurs post-release, and not for every version.
68+
# See https://www.openssl.org/docs/fips.html and the version documented in the
69+
# certificate and security policy.
70+
ENV OPENSSL30FIPSVER 3.0.8
71+
ENV OPENSSL30FIPSDIR /opt/openssl-$OPENSSL30FIPSVER-fips
72+
73+
RUN mkdir -p /tmp/openssl-$OPENSSL30FIPSVER && \
74+
cd /tmp/openssl-$OPENSSL30FIPSVER && \
75+
curl -sL https://www.openssl.org/source/openssl-$OPENSSL30FIPSVER.tar.gz | tar zxv --strip=1 && \
76+
./config --prefix=$OPENSSL30FIPSDIR enable-fips && \
77+
make -j $JOBS && \
78+
make install && \
79+
rm -rf /tmp/openssl-$OPENSSL30FIPSVER
80+
# Install the FIPS provider. Update OpenSSL config file to enable FIPS.
81+
RUN LD_LIBRARY_PATH=$OPENSSL30FIPSDIR/lib64 $OPENSSL30FIPSDIR/bin/openssl fipsinstall \
82+
-module $OPENSSL30FIPSDIR/lib64/ossl-modules/fips.so -provider_name fips \
83+
-out $OPENSSL30FIPSDIR/ssl/fipsmodule.cnf && \
84+
sed -i -r '/^providers = provider_sect/a alg_section = evp_properties' $OPENSSL30FIPSDIR/ssl/openssl.cnf && \
85+
sed -i -r 's/^# (fips = fips_sect)/\1/g' $OPENSSL30FIPSDIR/ssl/openssl.cnf && \
86+
sed -i -r "s|^# (.include fipsmodule.cnf)|.include $OPENSSL30FIPSDIR\/ssl\/fipsmodule.cnf|g" $OPENSSL30FIPSDIR/ssl/openssl.cnf && \
87+
echo "\n"\
88+
"[evp_properties]\n"\
89+
"default_properties = \"fips=yes\"\n"\
90+
>> $OPENSSL30FIPSDIR/ssl/openssl.cnf
91+
92+
ENV OPENSSL30VER 3.0.8+quic
93+
ENV OPENSSL30DIR /opt/openssl-$OPENSSL30VER
94+
95+
RUN mkdir -p /tmp/openssl-$OPENSSL30VER && \
96+
cd /tmp/openssl-$OPENSSL30VER && \
97+
git clone https://github.com/quictls/openssl.git -b openssl-$OPENSSL30VER --depth 1 && \
98+
cd openssl && \
99+
./config --prefix=$OPENSSL30DIR && \
100+
make -j $JOBS && \
101+
make install && \
102+
rm -rf /tmp/openssl-$OPENSSL30VER
103+
104+
ENV OPENSSL31VER 3.1.1
105+
ENV OPENSSL31DIR /opt/openssl-$OPENSSL31VER
106+
107+
RUN mkdir -p /tmp/openssl-$OPENSSL31VER && \
108+
cd /tmp/openssl-$OPENSSL31VER && \
109+
curl -sL https://www.openssl.org/source/openssl-$OPENSSL31VER.tar.gz | tar zxv --strip=1 && \
110+
./config --prefix=$OPENSSL31DIR && \
111+
make -j $JOBS && \
112+
make install && \
113+
rm -rf /tmp/openssl-$OPENSSL31VER
114+
115+
ENV ZLIBVER 1.2.13
116+
ENV ZLIB12DIR /opt/zlib_$ZLIBVER
117+
118+
RUN mkdir -p /tmp/zlib_$ZLIBVER && \
119+
cd /tmp/zlib_$ZLIBVER && \
120+
curl -sL https://zlib.net/fossils/zlib-$ZLIBVER.tar.gz | tar zxv --strip=1 && \
121+
./configure --prefix=$ZLIB12DIR && \
122+
make -j $JOBS && \
123+
make install && \
124+
rm -rf /tmp/zlib_$ZLIBVER
125+
126+
VOLUME /home/{{ server_user }}/ /home/{{ server_user }}/.ccache
127+
128+
USER iojs:iojs
129+
130+
ENV CCACHE_TEMPDIR /home/iojs/.ccache/{{ item.name }}
131+
132+
CMD cd /home/iojs \
133+
&& curl https://ci.nodejs.org/jnlpJars/agent.jar -O \
134+
&& java -Xmx{{ server_ram|default('128m') }} \
135+
-jar /home/{{ server_user }}/agent.jar \
136+
-jnlpUrl {{ jenkins_url }}/computer/{{ item.name }}/jenkins-agent.jnlp \
137+
-secret {{ item.secret }}

0 commit comments

Comments
 (0)
⚡