From 12d8ca526a991f3fde0bf367658215a0899d5237 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Thu, 2 Mar 2023 15:42:09 -0500 Subject: [PATCH 1/7] Update Dockerfile.hsm to use debian:bullseye base image --- docker/Dockerfile.hsm | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docker/Dockerfile.hsm b/docker/Dockerfile.hsm index 05c1ef82..a317ea27 100644 --- a/docker/Dockerfile.hsm +++ b/docker/Dockerfile.hsm @@ -1,23 +1,25 @@ -FROM golang:alpine AS builder +FROM golang AS builder WORKDIR /src COPY . . -RUN apk add --no-cache curl git make -RUN apk add --no-cache gcc musl-dev pkgconf pcsc-lite-dev +RUN apt-get update +RUN apt-get install -y --no-install-recommends \ + gcc pkgconf libpcsclite-dev RUN make V=1 download RUN make V=1 GOFLAGS="" build -FROM smallstep/step-kms-plugin:latest AS kms +FROM smallstep/step-kms-plugin:debian AS kms -FROM smallstep/step-cli:latest +FROM smallstep/step-cli:debian COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca COPY --from=kms /usr/local/bin/step-kms-plugin /usr/local/bin/step-kms-plugin USER root -RUN apk add --no-cache libcap && setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/step-ca -RUN apk add --no-cache pcsc-lite pcsc-lite-libs +RUN apt-get install -y --no-install-recommends libcap2-bin && \ + setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/step-ca +RUN apt-get install -y --no-install-recommends pcscd libpcsclite1 RUN mkdir -p /run/pcscd RUN chown step:step /run/pcscd USER step From 79b3924322e8f557eff53401c078226074e13fbd Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 6 Mar 2023 09:25:43 -0800 Subject: [PATCH 2/7] Fix docker tags --- docker/Dockerfile.hsm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile.hsm b/docker/Dockerfile.hsm index a317ea27..66d711e7 100644 --- a/docker/Dockerfile.hsm +++ b/docker/Dockerfile.hsm @@ -9,9 +9,9 @@ RUN apt-get install -y --no-install-recommends \ RUN make V=1 download RUN make V=1 GOFLAGS="" build -FROM smallstep/step-kms-plugin:debian AS kms +FROM smallstep/step-kms-plugin:bullseye AS kms -FROM smallstep/step-cli:debian +FROM smallstep/step-cli:bullseye COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca COPY --from=kms /usr/local/bin/step-kms-plugin /usr/local/bin/step-kms-plugin From 4378300c809e1111efbc29b58c428b4f15dacd37 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Mon, 6 Mar 2023 09:40:50 -0800 Subject: [PATCH 3/7] Update cache before installing packages --- docker/Dockerfile.hsm | 1 + 1 file changed, 1 insertion(+) diff --git a/docker/Dockerfile.hsm b/docker/Dockerfile.hsm index 66d711e7..782b7431 100644 --- a/docker/Dockerfile.hsm +++ b/docker/Dockerfile.hsm @@ -17,6 +17,7 @@ COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca COPY --from=kms /usr/local/bin/step-kms-plugin /usr/local/bin/step-kms-plugin USER root +RUN apt-get update RUN apt-get install -y --no-install-recommends libcap2-bin && \ setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/step-ca RUN apt-get install -y --no-install-recommends pcscd libpcsclite1 From b92f37a61d00e4b07d36bf3d5dc20c5dba314e60 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Tue, 21 Mar 2023 09:59:16 -0700 Subject: [PATCH 4/7] Use cloud tag on step-kms-plugin --- docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 00fa9c0e..7469392d 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -7,7 +7,7 @@ RUN apk add --no-cache curl git make RUN make V=1 download RUN make V=1 bin/step-ca -FROM smallstep/step-kms-plugin-cloud:latest AS kms +FROM smallstep/step-kms-plugin:cloud AS kms FROM smallstep/step-cli:latest From 25e35aa0ad32d340fd9a6e04d30370f2539d956e Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Tue, 21 Mar 2023 14:57:56 -0700 Subject: [PATCH 5/7] Small dockerfile refactor --- docker/Dockerfile | 6 ++---- docker/Dockerfile.hsm | 7 +++---- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 7469392d..553d831f 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -3,9 +3,9 @@ FROM golang:alpine AS builder WORKDIR /src COPY . . -RUN apk add --no-cache curl git make -RUN make V=1 download +RUN apk add --no-cache curl git make libcap RUN make V=1 bin/step-ca +RUN setcap CAP_NET_BIND_SERVICE=+eip bin/step-ca FROM smallstep/step-kms-plugin:cloud AS kms @@ -14,8 +14,6 @@ FROM smallstep/step-cli:latest COPY --from=builder /src/bin/step-ca /usr/local/bin/step-ca COPY --from=kms /usr/local/bin/step-kms-plugin /usr/local/bin/step-kms-plugin -USER root -RUN apk add --no-cache libcap && setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/step-ca USER step ENV CONFIGPATH="/home/step/config/ca.json" diff --git a/docker/Dockerfile.hsm b/docker/Dockerfile.hsm index 782b7431..61ea6694 100644 --- a/docker/Dockerfile.hsm +++ b/docker/Dockerfile.hsm @@ -6,8 +6,9 @@ COPY . . RUN apt-get update RUN apt-get install -y --no-install-recommends \ gcc pkgconf libpcsclite-dev -RUN make V=1 download -RUN make V=1 GOFLAGS="" build +RUN make V=1 GOFLAGS="" bin/step-ca +RUN apt-get install -y --no-install-recommends libcap2-bin && \ + setcap CAP_NET_BIND_SERVICE=+eip bin/step-ca FROM smallstep/step-kms-plugin:bullseye AS kms @@ -18,8 +19,6 @@ COPY --from=kms /usr/local/bin/step-kms-plugin /usr/local/bin/step-kms-plugin USER root RUN apt-get update -RUN apt-get install -y --no-install-recommends libcap2-bin && \ - setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/step-ca RUN apt-get install -y --no-install-recommends pcscd libpcsclite1 RUN mkdir -p /run/pcscd RUN chown step:step /run/pcscd From df2909e712a7750d433f45a52f45273bb40fd0eb Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Tue, 21 Mar 2023 15:01:02 -0700 Subject: [PATCH 6/7] Further docker simplifications --- docker/Dockerfile.hsm | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile.hsm b/docker/Dockerfile.hsm index 61ea6694..8ae1e7c7 100644 --- a/docker/Dockerfile.hsm +++ b/docker/Dockerfile.hsm @@ -5,10 +5,9 @@ COPY . . RUN apt-get update RUN apt-get install -y --no-install-recommends \ - gcc pkgconf libpcsclite-dev + gcc pkgconf libpcsclite-dev libcap2-bin RUN make V=1 GOFLAGS="" bin/step-ca -RUN apt-get install -y --no-install-recommends libcap2-bin && \ - setcap CAP_NET_BIND_SERVICE=+eip bin/step-ca +RUN setcap CAP_NET_BIND_SERVICE=+eip bin/step-ca FROM smallstep/step-kms-plugin:bullseye AS kms From 366561601523ddf9f6edbbf6343c05c5f8a790b0 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Tue, 11 Apr 2023 09:40:49 -0700 Subject: [PATCH 7/7] Deprecate the step-ca-hsm image in favor of step-ca:hsm --- .github/workflows/release.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c98837a8..d395f590 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,6 @@ jobs: runs-on: ubuntu-latest env: DOCKER_IMAGE: smallstep/step-ca - DOCKER_IMAGE_HSM: smallstep/step-ca-hsm outputs: version: ${{ steps.extract-tag.outputs.VERSION }} is_prerelease: ${{ steps.is_prerelease.outputs.IS_PRERELEASE }} @@ -38,12 +37,12 @@ jobs: VERSION=${GITHUB_REF#refs/tags/v} echo "VERSION=${VERSION}" >> ${GITHUB_OUTPUT} echo "DOCKER_TAGS=${{ env.DOCKER_IMAGE }}:${VERSION}" >> ${GITHUB_ENV} - echo "DOCKER_TAGS_HSM=${{ env.DOCKER_IMAGE_HSM }}:${VERSION}" >> ${GITHUB_ENV} + echo "DOCKER_TAGS_HSM=${{ env.DOCKER_IMAGE }}:${VERSION}-hsm" >> ${GITHUB_ENV} - name: Add Latest Tag if: steps.is_prerelease.outputs.IS_PRERELEASE == 'false' run: | echo "DOCKER_TAGS=${{ env.DOCKER_TAGS }},${{ env.DOCKER_IMAGE }}:latest" >> ${GITHUB_ENV} - echo "DOCKER_TAGS_HSM=${{ env.DOCKER_TAGS_HSM }},${{ env.DOCKER_IMAGE_HSM }}:latest" >> ${GITHUB_ENV} + echo "DOCKER_TAGS_HSM=${{ env.DOCKER_TAGS_HSM }},${{ env.DOCKER_IMAGE }}:hsm" >> ${GITHUB_ENV} - name: Create Release id: create_release uses: actions/create-release@v1