Martin Vogel
1f50c9d46c
Resolves the two open Pinned-Dependencies code-scanning alerts (and one sibling the scanner had not flagged yet): - ubuntu:noble in Dockerfile and Dockerfile.lint is pinned to its multi-arch manifest-list digest (verified against the registry and the scanner's remediation digest, which match). - mstorsjo/llvm-mingw drops the floating :latest and pins the current digest the same way. - The MSYS2 zlib sysroot package in Dockerfile.mingw is verified against a pinned sha256 before extraction instead of piping the download straight into tar. Dockerfile.alpine was already pinned; both rebuilt images (test, lint) verified building with the new digests. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
67 lines
3.2 KiB
Docker
67 lines
3.2 KiB
Docker
# Cross-compile AND run Windows tests locally using llvm-mingw + Wine.
|
|
#
|
|
# llvm-mingw: LLVM/Clang-based MinGW toolchain
|
|
# Wine: runs the resulting .exe for actual test execution
|
|
#
|
|
# Usage:
|
|
# docker compose -f test-infrastructure/docker-compose.yml run --rm build-windows
|
|
# docker compose -f test-infrastructure/docker-compose.yml run --rm test-windows
|
|
|
|
# Pinned by digest (supply-chain: no floating tags). This is the multi-arch
|
|
# manifest-list digest of mstorsjo/llvm-mingw:latest as of 2026-07-23; bump
|
|
# deliberately by re-resolving the digest, never back to a bare tag.
|
|
FROM mstorsjo/llvm-mingw:latest@sha256:5cbf421906f889e01c8d4005787474e302df6daa197286ebf212d419024966af
|
|
|
|
# curl+zstd are required (zlib sysroot fetch below). Wine is BEST-EFFORT: it
|
|
# only runs the .exe, and its i386 packages are unavailable on an arm64 Docker
|
|
# host (e.g. Colima on Apple Silicon), so a Wine failure must NOT abort the
|
|
# image build - the cross-COMPILE check still works without it.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends curl zstd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN (dpkg --add-architecture i386 && apt-get update && \
|
|
apt-get install -y --no-install-recommends wine64 && rm -rf /var/lib/apt/lists/*) \
|
|
|| echo "WARN: Wine unavailable on this host arch -> compile-only mode"
|
|
|
|
# Install zlib into the llvm-mingw sysroot (from MSYS2 CLANG64 repo).
|
|
# The package is verified against its pinned sha256 before extraction —
|
|
# a bare curl|tar would execute whatever the mirror serves.
|
|
RUN mkdir -p /tmp/zlib-pkg && \
|
|
curl -sL "https://mirror.msys2.org/mingw/clang64/mingw-w64-clang-x86_64-zlib-1.3.1-1-any.pkg.tar.zst" \
|
|
-o /tmp/zlib.pkg.tar.zst && \
|
|
echo "b7f0c06e6d48128209a3a441f96b92351e565a0d031278c56a8db8a9b5ec291a /tmp/zlib.pkg.tar.zst" \
|
|
| sha256sum -c - && \
|
|
zstd -d < /tmp/zlib.pkg.tar.zst | tar xf - -C /tmp/zlib-pkg && \
|
|
rm /tmp/zlib.pkg.tar.zst && \
|
|
cp -rn /tmp/zlib-pkg/clang64/include/* /opt/llvm-mingw/x86_64-w64-mingw32/include/ && \
|
|
cp -rn /tmp/zlib-pkg/clang64/lib/* /opt/llvm-mingw/x86_64-w64-mingw32/lib/ && \
|
|
rm -rf /tmp/zlib-pkg
|
|
|
|
# Add Wine to PATH (Ubuntu noble puts it in /usr/lib/wine/)
|
|
ENV PATH="/usr/lib/wine:${PATH}"
|
|
|
|
# Verify all tools are installed
|
|
RUN echo "=== Tool check ===" && \
|
|
x86_64-w64-mingw32-clang --version | head -1 && \
|
|
x86_64-w64-mingw32-clang++ --version | head -1 && \
|
|
make --version | head -1 && \
|
|
ls /opt/llvm-mingw/x86_64-w64-mingw32/include/zlib.h && \
|
|
(wine64 --version 2>/dev/null || echo "WARN: wine64 not on PATH, checking alternatives...") && \
|
|
(which wine64 || which wine || find / -name "wine64" -type f 2>/dev/null | head -1 || echo "ERROR: wine not found") && \
|
|
echo "=== All tools OK ==="
|
|
|
|
# Pre-init Wine to avoid first-run prompts during test
|
|
RUN WINEDEBUG=-all wine64 wineboot --init 2>/dev/null || \
|
|
WINEDEBUG=-all wine wineboot --init 2>/dev/null || \
|
|
echo "WARN: Wine init skipped"
|
|
|
|
WORKDIR /src
|
|
|
|
ENTRYPOINT ["/bin/bash", "-c"]
|
|
|
|
# Default: cross-compile production build
|
|
CMD ["make -j4 -f Makefile.cbm clean-c && \
|
|
make -j4 -f Makefile.cbm cbm \
|
|
CC=x86_64-w64-mingw32-clang \
|
|
CXX=x86_64-w64-mingw32-clang++ \
|
|
&& echo '=== Windows cross-compile: OK ==='"]
|