From e6dd8456b856b8452c302fda0352378edcd91ccb Mon Sep 17 00:00:00 2001 From: "Lance R. Vick" Date: Mon, 15 Apr 2024 11:05:37 -0700 Subject: [PATCH 1/8] feat: package nodejs --- packages/nodejs/Containerfile | 40 +++++++++++++++++++++++++++++++++++ src/packages.mk | 18 ++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 packages/nodejs/Containerfile diff --git a/packages/nodejs/Containerfile b/packages/nodejs/Containerfile new file mode 100644 index 0000000..9bd65ad --- /dev/null +++ b/packages/nodejs/Containerfile @@ -0,0 +1,40 @@ +FROM scratch as base +ENV VERSION=20.11.1 +ENV SRC_HASH=4af1ba6ea848cc05908b8a62b02fb27684dd52b2a7988ee82b0cfa72deb90b94 +ENV SRC_FILE=node-v${VERSION}.tar.gz +ENV SRC_SITE=https://nodejs.org/dist/v${VERSION}/${SRC_FILE} +ENV CFLAGS="-march=x86-64 -mtune=generic -O2" + +FROM base as fetch +ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} . + +FROM fetch as build +COPY --from=stagex/busybox . / +COPY --from=stagex/gcc . / +COPY --from=stagex/binutils . / +COPY --from=stagex/make . / +COPY --from=stagex/musl . / +COPY --from=stagex/openssl . / +COPY --from=stagex/python . / +COPY --from=stagex/bzip2 . / +COPY --from=stagex/ninja . / +COPY --from=stagex/zlib . / +COPY --from=stagex/linux-headers . / +RUN tar -xf ${SRC_FILE} +WORKDIR node-v${VERSION} +RUN --network=none <<-EOF + set -eux + python configure.py \ + --without-snapshot + make BUILDTYPE=Release +EOF + +FROM build as install +RUN --network=none <<-EOF + set -eux + make DESTDIR=/rootfs install + find /rootfs -exec touch -hcd "@0" "{}" + +EOF + +FROM stagex/filesystem as package +COPY --from=install /rootfs/. / diff --git a/src/packages.mk b/src/packages.mk index da41350..197757e 100644 --- a/src/packages.mk +++ b/src/packages.mk @@ -2239,6 +2239,24 @@ out/ninja/index.json: \ out/python/index.json $(call build,ninja) +.PHONY: nodejs +nodejs: out/nodejs/index.json +out/nodejs/index.json: \ + packages/nodejs/Containerfile \ + out/binutils/index.json \ + out/busybox/index.json \ + out/bzip2/index.json \ + out/filesystem/index.json \ + out/gcc/index.json \ + out/linux-headers/index.json \ + out/make/index.json \ + out/musl/index.json \ + out/ninja/index.json \ + out/openssl/index.json \ + out/python/index.json \ + out/zlib/index.json + $(call build,nodejs) + .PHONY: npth npth: out/npth/index.json out/npth/index.json: \ From fa54294a9f4b194efb9cf7c8836dae473f1c377a Mon Sep 17 00:00:00 2001 From: "Lance R. Vick" Date: Tue, 16 Apr 2024 13:59:15 -0700 Subject: [PATCH 2/8] fix: lockdown more nodejs flags --- packages/nodejs/Containerfile | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/packages/nodejs/Containerfile b/packages/nodejs/Containerfile index 9bd65ad..ece35de 100644 --- a/packages/nodejs/Containerfile +++ b/packages/nodejs/Containerfile @@ -3,7 +3,6 @@ ENV VERSION=20.11.1 ENV SRC_HASH=4af1ba6ea848cc05908b8a62b02fb27684dd52b2a7988ee82b0cfa72deb90b94 ENV SRC_FILE=node-v${VERSION}.tar.gz ENV SRC_SITE=https://nodejs.org/dist/v${VERSION}/${SRC_FILE} -ENV CFLAGS="-march=x86-64 -mtune=generic -O2" FROM base as fetch ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} . @@ -18,14 +17,29 @@ COPY --from=stagex/openssl . / COPY --from=stagex/python . / COPY --from=stagex/bzip2 . / COPY --from=stagex/ninja . / +COPY --from=stagex/pkgconf . / +COPY --from=stagex/icu . / COPY --from=stagex/zlib . / COPY --from=stagex/linux-headers . / RUN tar -xf ${SRC_FILE} WORKDIR node-v${VERSION} +ENV CFLAGS="-march=x86-64 -mtune=generic -Os" +ENV CXXFLAGS="-march=x86-64 -mtune=generic -Os" +ENV CPPFLAGS="-march=x86-64 -mtune=generic -Os" RUN --network=none <<-EOF set -eux python configure.py \ - --without-snapshot + --prefix=/usr \ + --ninja \ + --enable-lto \ + --without-npm \ + --without-snapshot \ + --without-corepack \ + --shared-openssl \ + --shared-zlib \ + --with-icu-default-data-dir=$(icu-config --icudatadir) \ + --with-intl=system-icu \ + --openssl-use-def-ca-store make BUILDTYPE=Release EOF @@ -33,7 +47,6 @@ FROM build as install RUN --network=none <<-EOF set -eux make DESTDIR=/rootfs install - find /rootfs -exec touch -hcd "@0" "{}" + EOF FROM stagex/filesystem as package From a940f9e3b8932f1a34a6d1abec49a56755abe883 Mon Sep 17 00:00:00 2001 From: "Lance R. Vick" Date: Wed, 17 Jul 2024 12:41:06 -0700 Subject: [PATCH 3/8] maint: bump nodejs to 22.4.0 --- packages/nodejs/Containerfile | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/packages/nodejs/Containerfile b/packages/nodejs/Containerfile index ece35de..5e38481 100644 --- a/packages/nodejs/Containerfile +++ b/packages/nodejs/Containerfile @@ -1,8 +1,9 @@ FROM scratch as base -ENV VERSION=20.11.1 -ENV SRC_HASH=4af1ba6ea848cc05908b8a62b02fb27684dd52b2a7988ee82b0cfa72deb90b94 +ENV VERSION=22.4.0 +ENV SRC_HASH=b62cd83c9a57a11349883f89b1727a16e66c02eb6255a4bf32714ff5d93165f5 ENV SRC_FILE=node-v${VERSION}.tar.gz ENV SRC_SITE=https://nodejs.org/dist/v${VERSION}/${SRC_FILE} +ENV CFLAGS="-march=x86-64 -mtune=generic -O2" FROM base as fetch ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} . @@ -17,29 +18,14 @@ COPY --from=stagex/openssl . / COPY --from=stagex/python . / COPY --from=stagex/bzip2 . / COPY --from=stagex/ninja . / -COPY --from=stagex/pkgconf . / -COPY --from=stagex/icu . / COPY --from=stagex/zlib . / COPY --from=stagex/linux-headers . / RUN tar -xf ${SRC_FILE} WORKDIR node-v${VERSION} -ENV CFLAGS="-march=x86-64 -mtune=generic -Os" -ENV CXXFLAGS="-march=x86-64 -mtune=generic -Os" -ENV CPPFLAGS="-march=x86-64 -mtune=generic -Os" RUN --network=none <<-EOF set -eux python configure.py \ - --prefix=/usr \ - --ninja \ - --enable-lto \ - --without-npm \ - --without-snapshot \ - --without-corepack \ - --shared-openssl \ - --shared-zlib \ - --with-icu-default-data-dir=$(icu-config --icudatadir) \ - --with-intl=system-icu \ - --openssl-use-def-ca-store + --without-snapshot make BUILDTYPE=Release EOF @@ -47,6 +33,7 @@ FROM build as install RUN --network=none <<-EOF set -eux make DESTDIR=/rootfs install + find /rootfs -exec touch -hcd "@0" "{}" + EOF FROM stagex/filesystem as package From d12f1b8a0219cc7acf53e0aaa2577759a04c4a0b Mon Sep 17 00:00:00 2001 From: "Lance R. Vick" Date: Mon, 26 Aug 2024 02:41:37 -0700 Subject: [PATCH 4/8] maint: bump nodejs to 22.7.0 --- packages/nodejs/Containerfile | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/packages/nodejs/Containerfile b/packages/nodejs/Containerfile index 5e38481..78b83af 100644 --- a/packages/nodejs/Containerfile +++ b/packages/nodejs/Containerfile @@ -1,9 +1,8 @@ FROM scratch as base -ENV VERSION=22.4.0 -ENV SRC_HASH=b62cd83c9a57a11349883f89b1727a16e66c02eb6255a4bf32714ff5d93165f5 +ENV VERSION=22.7.0 +ENV SRC_HASH=7a7c99282d59866d971b2da12c99596cb15782b9c3efe2e2146390c14f4d490e ENV SRC_FILE=node-v${VERSION}.tar.gz ENV SRC_SITE=https://nodejs.org/dist/v${VERSION}/${SRC_FILE} -ENV CFLAGS="-march=x86-64 -mtune=generic -O2" FROM base as fetch ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} . @@ -22,10 +21,21 @@ COPY --from=stagex/zlib . / COPY --from=stagex/linux-headers . / RUN tar -xf ${SRC_FILE} WORKDIR node-v${VERSION} +ENV SOURCE_DATE_EPOCH=1 +ENV LDFLAGS=" \ + -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro \ + -Wl,-z,now -Wl,-z,pack-relative-relocs" +ENV CFLAGS=" \ + -march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \ + -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security \ + -fstack-clash-protection -fcf-protection \ + -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer" +ENV CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS" +ENV LTOFLAGS="-flto=auto" + RUN --network=none <<-EOF set -eux - python configure.py \ - --without-snapshot + python configure.py make BUILDTYPE=Release EOF From bd7ce59caac41e39276e0c243c29d72a8f4cbab4 Mon Sep 17 00:00:00 2001 From: "Lance R. Vick" Date: Thu, 29 Aug 2024 12:30:13 -0700 Subject: [PATCH 5/8] feat: use ninja and shared libs for nodejs --- packages/brotli/Containerfile | 9 +++-- packages/c-ares/Containerfile | 35 ++++++++++++++++++ packages/libev/Containerfile | 44 +++++++++++++++++++++++ packages/libnghttp2/Containerfile | 59 +++++++++++++++++++++++++++++++ packages/nodejs/Containerfile | 20 ++++++++++- src/packages.mk | 51 ++++++++++++++++++++++++++ 6 files changed, 215 insertions(+), 3 deletions(-) create mode 100644 packages/c-ares/Containerfile create mode 100644 packages/libev/Containerfile create mode 100644 packages/libnghttp2/Containerfile diff --git a/packages/brotli/Containerfile b/packages/brotli/Containerfile index be02f79..ecd81e2 100644 --- a/packages/brotli/Containerfile +++ b/packages/brotli/Containerfile @@ -35,8 +35,13 @@ RUN --network=none <<-EOF EOF FROM build AS install -RUN DESTDIR=/rootfs cmake --install build -RUN find /rootfs -exec touch -hcd "@0" "{}" + +RUN <<-EOF + set -eux + DESTDIR=/rootfs cmake --install build + for file in common dec enc; do + install -D -m 755 build/libbrotli$file.a /rootfs/usr/lib/ + done +EOF FROM stagex/filesystem AS package COPY --from=install /rootfs/. / diff --git a/packages/c-ares/Containerfile b/packages/c-ares/Containerfile new file mode 100644 index 0000000..ab27305 --- /dev/null +++ b/packages/c-ares/Containerfile @@ -0,0 +1,35 @@ +FROM scratch AS base +ENV VERSION=1.33.1 +ENV SRC_HASH=06869824094745872fa26efd4c48e622b9bd82a89ef0ce693dc682a23604f415 +ENV SRC_FILE=c-ares-${VERSION}.tar.gz +ENV SRC_SITE=https://github.com/c-ares/c-ares/releases/download/v${VERSION}/${SRC_FILE} + +FROM base AS fetch +ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} . + +FROM fetch AS build +COPY --from=stagex/busybox . / +COPY --from=stagex/binutils . / +COPY --from=stagex/musl . / +COPY --from=stagex/make . / +COPY --from=stagex/gcc . / + +RUN --network=none tar -xf ${SRC_FILE} +WORKDIR c-ares-${VERSION} +RUN --network=none < Date: Mon, 26 Aug 2024 04:10:17 -0700 Subject: [PATCH 6/8] fix: brotli prefix --- packages/brotli/Containerfile | 7 ++++--- packages/nodejs/Containerfile | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/packages/brotli/Containerfile b/packages/brotli/Containerfile index ecd81e2..fd651e5 100644 --- a/packages/brotli/Containerfile +++ b/packages/brotli/Containerfile @@ -23,13 +23,13 @@ RUN --network=none <<-EOF set -eux cmake -B build -G Ninja \ -DCMAKE_BUILD_TYPE=None \ - -DCMAKE_INSTALL_PREFIX=/usr/lib \ + -DCMAKE_INSTALL_PREFIX=/usr \ -DBUILD_SHARED_LIBS=OFF cmake --build build cmake -B build -G Ninja \ -DCMAKE_BUILD_TYPE=None \ - -DCMAKE_INSTALL_PREFIX=/usr/lib \ + -DCMAKE_INSTALL_PREFIX=/usr \ -DBUILD_SHARED_LIBS=ON cmake --build build EOF @@ -39,8 +39,9 @@ RUN <<-EOF set -eux DESTDIR=/rootfs cmake --install build for file in common dec enc; do - install -D -m 755 build/libbrotli$file.a /rootfs/usr/lib/ + install -D -m 755 build/libbrotli$file.a /rootfs/usr/lib64 done + mv /rootfs/usr/lib64 /rootfs/usr/lib EOF FROM stagex/filesystem AS package diff --git a/packages/nodejs/Containerfile b/packages/nodejs/Containerfile index a089d06..d9526ca 100644 --- a/packages/nodejs/Containerfile +++ b/packages/nodejs/Containerfile @@ -52,6 +52,7 @@ RUN --network=none <<-EOF --shared-brotli \ --without-npm \ --without-corepack \ + --with-intl=system-icu \ --with-icu-default-data-dir=$(icu-config --icudatadir) \ --openssl-use-def-ca-store make BUILDTYPE=Release From c429ae642b2cf3d3cd9650698fe4ff73650fa4d8 Mon Sep 17 00:00:00 2001 From: "Lance R. Vick" Date: Mon, 26 Aug 2024 11:42:36 -0700 Subject: [PATCH 7/8] fix: linting --- packages/c-ares/Containerfile | 2 +- packages/libev/Containerfile | 2 +- packages/libnghttp2/Containerfile | 2 +- packages/nodejs/Containerfile | 12 ++++++------ 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/packages/c-ares/Containerfile b/packages/c-ares/Containerfile index ab27305..cf551f3 100644 --- a/packages/c-ares/Containerfile +++ b/packages/c-ares/Containerfile @@ -15,7 +15,7 @@ COPY --from=stagex/make . / COPY --from=stagex/gcc . / RUN --network=none tar -xf ${SRC_FILE} -WORKDIR c-ares-${VERSION} +WORKDIR /c-ares-${VERSION} RUN --network=none < Date: Thu, 29 Aug 2024 12:05:06 -0700 Subject: [PATCH 8/8] fix: cleanup/linting --- packages/nodejs/Containerfile | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/packages/nodejs/Containerfile b/packages/nodejs/Containerfile index ee8e554..9b93433 100644 --- a/packages/nodejs/Containerfile +++ b/packages/nodejs/Containerfile @@ -55,15 +55,11 @@ RUN --network=none <<-EOF --with-intl=system-icu \ --with-icu-default-data-dir=$(icu-config --icudatadir) \ --openssl-use-def-ca-store - make BUILDTYPE=Release + make BUILDTYPE=Release -j $(nproc) EOF FROM build AS install -RUN --network=none <<-EOF - set -eux - make DESTDIR=/rootfs install - find /rootfs -exec touch -hcd "@0" "{}" + -EOF +RUN --network=none make DESTDIR=/rootfs install FROM stagex/filesystem AS package COPY --from=install /rootfs/. /