mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
5119b0f5f3
Start the no_std core as a second workspace member. The crate is empty: it holds the rule that code in it builds for any target with an allocator (no std, no async runtime, no OS calls, no target cfg), and the root crate does not depend on it yet, so nothing that builds or ships changes. The root package stays first in Cargo.toml with its version line untouched, since the packaging scripts read the release version from it, and the core is fixed at 0.0.0 with publish = false so releases keep a single bump site. default-members names both crates, so the bare cargo clippy and test commands in local CI and GitHub CI cover the core as well as the root package. Add a fence to both runners: clippy and the tests of the core on its own, so a dependency feature that only the root crate enables cannot hide one the core needs. Pin the privileged interface-binding step to the fips package's lib test binary. With two lib test executables, `tail -1` picked whichever cargo listed last, and the core's binary passes the ethernet filter having run nothing. The step now also runs under bash with pipefail and fails unless at least one test passed. Widen the comment-reference, portable-atomics and log-string guards to core/src/, and add core/ to the stale-binary checks of the mdns, native-api and deb-install harnesses, so code that later moves into the core stays checked. Copy core/ into the two nostr relay example images, whose build would otherwise fail to load the workspace manifest, and give the standalone BLE spike under testing/ble an empty workspace table of its own, so cargo keeps loading it as its own project rather than refusing it as an unlisted member of the root workspace. Add core/README.md for anyone reading or adding code under core/: what the crate is for, the rules its code follows, how to add a dependency without letting workspace feature unification hide a missing feature, how tests work under no_std, a checklist for moving a module in from the root crate, and the checks to run before a change.
70 lines
2.5 KiB
Docker
70 lines
2.5 KiB
Docker
# ── Build stage: compile FIPS from source ──
|
|
FROM rust:1.94-slim-trixie AS builder
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
pkg-config && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
COPY Cargo.toml Cargo.lock rust-toolchain.toml build.rs ./
|
|
COPY src ./src
|
|
COPY core ./core
|
|
|
|
RUN cargo build --release && \
|
|
cp target/release/fips target/release/fipsctl target/release/fipstop /usr/local/bin/
|
|
|
|
# ── Runtime stage ──
|
|
FROM debian:trixie-slim
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
iproute2 iputils-ping dnsutils dnsmasq iptables \
|
|
openssh-client openssh-server python3 \
|
|
tcpdump netcat-openbsd curl iperf3 && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install nak (Nostr Army Knife) — detect arch and download the correct binary.
|
|
# Asset naming: nak-<version>-linux-<arch>
|
|
RUN ARCH=$(dpkg --print-architecture) && \
|
|
case "$ARCH" in \
|
|
amd64) NAK_ARCH="linux-amd64" ;; \
|
|
arm64) NAK_ARCH="linux-arm64" ;; \
|
|
armhf) NAK_ARCH="linux-arm" ;; \
|
|
*) echo "Unsupported arch: $ARCH" && exit 1 ;; \
|
|
esac && \
|
|
NAK_VERSION=$(curl -sSL --retry 3 \
|
|
"https://api.github.com/repos/fiatjaf/nak/releases/latest" \
|
|
| grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\(.*\)".*/\1/') && \
|
|
echo "Installing nak ${NAK_VERSION} for ${NAK_ARCH}" && \
|
|
curl -sSL --retry 3 \
|
|
"https://github.com/fiatjaf/nak/releases/download/${NAK_VERSION}/nak-${NAK_VERSION}-${NAK_ARCH}" \
|
|
-o /usr/local/bin/nak && \
|
|
chmod +x /usr/local/bin/nak && \
|
|
nak --version
|
|
|
|
# Setup SSH server with no authentication (test only!)
|
|
RUN mkdir -p /var/run/sshd && \
|
|
ssh-keygen -A && \
|
|
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' /etc/ssh/sshd_config && \
|
|
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
|
|
passwd -d root
|
|
|
|
# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
|
|
RUN printf '%s\n' \
|
|
'port=53' \
|
|
'listen-address=127.0.0.1' \
|
|
'bind-interfaces' \
|
|
'server=/fips/127.0.0.1#5354' \
|
|
'server=127.0.0.11' \
|
|
'no-resolv' \
|
|
>> /etc/dnsmasq.conf
|
|
|
|
COPY --from=builder /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop /usr/local/bin/
|
|
|
|
COPY examples/sidecar-nostr-relay/entrypoint.sh /entrypoint.sh
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|