Skip to content

Commit c14cfee

Browse files
nichtsfreinichtsfrei
committed
Fix: upload the images for amd64 and aarch64 in a multimanifest
This fixes the issue that we only supplied one platform in ghcr.io instead of both. The reason for that is that we have overridden the previously tag with the one that took the longest to build. Which usually was aarch64. Additionally this commit moves away from utilizing the greenbone.net docker proxies in favor of using ghcr where possible so that our critical pipelines hopefully run more stable. The downside of that change is that building images currently takes a longer time than previously because we cannot use the previously build assets anymore.
1 parent f8e6165 commit c14cfee

File tree

13 files changed

+81
-249
lines changed

13 files changed

+81
-249
lines changed

‎.docker/prod-oldstable.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG VERSION=oldstable
22
# this allows to override gvm-libs for e.g. smoketests
3-
ARG GVM_LIBS=registry.community.greenbone.net/community/gvm-libs
3+
ARG GVM_LIBS=ghcr.io/greenbone/gvm-libs
44

55
FROM rust:bookworm AS rust
66
COPY . /source

‎.docker/prod-testing.Dockerfile‎

Lines changed: 5 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,37 +6,11 @@ ARG GVM_LIBS_VERSION=testing-edge
66
FROM greenbone/openvas-smb:testing-edge AS openvas-smb
77
FROM rust AS rust
88

9-
FROM registry.community.greenbone.net/community/gvm-libs:${GVM_LIBS_VERSION} AS build
9+
FROM ghcr.io/greenbone/gvm-libs:${GVM_LIBS_VERSION} AS build
1010
COPY . /source
11+
RUN sh /source/.github/install-openvas-dependencies.sh
1112
RUN apt-get update && apt-get install --no-install-recommends --no-install-suggests -y \
12-
bison \
13-
build-essential \
14-
clang \
15-
clang-format \
16-
clang-tools \
17-
cmake \
18-
curl \
19-
git \
20-
lcov \
21-
libgnutls28-dev \
22-
libgpgme-dev \
23-
libjson-glib-dev \
24-
libksba-dev \
25-
libpaho-mqtt-dev \
26-
libpcap-dev \
27-
libgcrypt-dev \
28-
libssh-dev \
29-
libbsd-dev \
30-
libgnutls30t64 \
31-
libgssapi3-heimdal \
32-
libkrb5-26-heimdal \
33-
libasn1-8-heimdal \
34-
libroken19-heimdal \
35-
libhdb9-heimdal \
36-
libpopt0 \
37-
libcurl4 \
38-
libcurl4-gnutls-dev \
39-
libhiredis-dev \
13+
capnproto \
4014
&& rm -rf /var/lib/apt/lists/*
4115

4216
COPY --from=openvas-smb /usr/local/lib/ /usr/local/lib/
@@ -49,11 +23,12 @@ ENV RUSTUP_HOME=/usr/local/rustup \
4923
CARGO_HOME=/usr/local/cargo \
5024
PATH=/usr/local/cargo/bin:$PATH
5125
RUN apt update && apt install -y ca-certificates
26+
WORKDIR /source/rust
5227
RUN cargo build --release
5328
RUN cp target/release/openvasd /install/usr/local/bin
5429
RUN cp target/release/scannerctl /install/usr/local/bin
5530

56-
FROM registry.community.greenbone.net/community/gvm-libs:${GVM_LIBS_VERSION}
31+
FROM ghcr.io/greenbone/gvm-libs:${GVM_LIBS_VERSION}
5732
RUN apt-get update
5833
RUN apt-get install --no-install-recommends --no-install-suggests -y \
5934
bison \

‎.docker/prod.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG VERSION=edge
22
# this allows to override gvm-libs for e.g. smoketests
3-
ARG GVM_LIBS=registry.community.greenbone.net/community/gvm-libs
3+
ARG GVM_LIBS=ghcr.io/greenbone/gvm-libs
44

55
FROM rust AS rust
66
COPY . /source

‎.github/workflows/control.yml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -112,26 +112,6 @@ jobs:
112112
with:
113113
is_latest_tag: ${{needs.init.outputs.docker_build_is_latest}}
114114
is_version_tag: ${{needs.init.outputs.docker_build_is_version }}
115-
container-testing:
116-
name: container
117-
needs: [init, build ]
118-
uses: ./.github/workflows/push-container-testing.yml
119-
secrets:
120-
dockerhub_user: ${{ secrets.DOCKERHUB_USERNAME }}
121-
dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN}}
122-
with:
123-
is_latest_tag: ${{needs.init.outputs.docker_build_is_latest}}
124-
is_version_tag: ${{needs.init.outputs.docker_build_is_version}}
125-
container-oldstable:
126-
name: container
127-
needs: [init, build ]
128-
uses: ./.github/workflows/push-container-oldstable.yml
129-
secrets:
130-
dockerhub_user: ${{ secrets.DOCKERHUB_USERNAME }}
131-
dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN}}
132-
with:
133-
is_latest_tag: ${{needs.init.outputs.docker_build_is_latest}}
134-
is_version_tag: ${{needs.init.outputs.docker_build_is_version}}
135115
release:
136116
permissions:
137117
contents: write

‎.github/workflows/push-container-oldstable.yml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎.github/workflows/push-container-testing.yml‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎.github/workflows/push-container.yml‎

Lines changed: 63 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -45,32 +45,45 @@ permissions:
4545
pull-requests: write
4646

4747
jobs:
48-
49-
debian_stable_arm64:
50-
name: ghcr:debian:stable:arm64
51-
runs-on: self-hosted-generic-arm64
52-
steps:
53-
- name: Checkout repository
54-
uses: actions/checkout@v6
55-
- uses: ./.github/actions/copy-docker-binaries
56-
with:
57-
arch: arm64
58-
- name: Container build and push 3rd gen
59-
id: build-and-push
60-
uses: greenbone/actions/container-build-push-generic@v3
61-
with:
62-
image-platforms: linux/arm64
63-
build-docker-file: .docker/prod.Dockerfile
64-
build-args: |
65-
REPOSITORY=${{ github.repository }}
66-
cosign-key: ${{ secrets.cosign_key_opensight }}
67-
cosign-key-password: ${{ secrets.cosign_password_opensight }}
68-
# The tlog function does not currently support an ed25519 key.
69-
cosign-tlog-upload: "false"
70-
image-labels: |
71-
org.opencontainers.image.vendor=Greenbone
72-
org.opencontainers.image.base.name=greenbone/gvm-libs
73-
image-tags: |
48+
build:
49+
if: ${{ github.repository == 'greenbone/openvas-scanner' }}
50+
strategy:
51+
fail-fast: false
52+
matrix:
53+
include:
54+
- build:
55+
name: stable
56+
dockerfile: .docker/prod.Dockerfile
57+
stable-name: stable
58+
edge-name: edge
59+
- build:
60+
name: testing
61+
dockerfile: .docker/prod-testing.Dockerfile
62+
stable-name: testing
63+
edge-name: testing-edge
64+
- build:
65+
name: oldstable
66+
dockerfile: .docker/prod-oldstable.Dockerfile
67+
stable-name: oldstable
68+
edge-name: oldstable-edge
69+
name: Build and Push Container Images (${{ matrix.build.name }})
70+
uses: greenbone/workflows/.github/workflows/container-build-push-gea.yml@main
71+
with:
72+
ref: ${{ inputs.ref-name }}
73+
ref-name: ${{ inputs.ref-name }}
74+
name: ${{ matrix.build.name }}
75+
dockerfile: ${{ matrix.build.dockerfile }}
76+
stable-name: ${{ matrix.build.stable-name }}
77+
edge-name: ${{ matrix.build.edge-name }}
78+
enable-latest: ${{ matrix.build.name == 'stable' }}
79+
enable-pr: ${{ matrix.build.name == 'stable' }}
80+
enable-version: ${{ matrix.build.name == 'stable' }}
81+
labels: |
82+
org.opencontainers.image.vendor=Greenbone
83+
org.opencontainers.image.base.name=debian:stable-slim
84+
build-args: ${{ matrix.build.build-args }}
85+
prefix: ${{ matrix.build.prefix }}
86+
tags: |
7487
# when IS_LATEST_TAG is set create a stable and a latest tag
7588
type=raw,value=latest,enable=${{ inputs.is_latest_tag }}
7689
type=raw,value=stable,enable=${{ inputs.is_latest_tag }}
@@ -83,73 +96,30 @@ jobs:
8396
type=raw,value={{branch}}-{{sha}},enable=${{ github.ref_type == 'branch' && github.event_name == 'push' && github.ref_name != 'main' }}
8497
# use pr-$PR_ID for pull requests (will not be uploaded)
8598
type=ref,event=pr
86-
registry: ${{ vars.IMAGE_REGISTRY }}
87-
registry-username: ${{ github.actor }}
88-
registry-password: ${{ secrets.GITHUB_TOKEN }}
89-
90-
debian_stable:
91-
name: ghcr:debian:stable
92-
runs-on: ubuntu-latest
99+
100+
secrets: inherit
101+
102+
notify:
103+
needs:
104+
- build
105+
if: ${{ !cancelled() && github.event_name != 'pull_request' && github.repository == 'greenbone/openvas-scanner' }}
106+
uses: greenbone/workflows/.github/workflows/notify-mattermost-2nd-gen.yml@main
107+
with:
108+
status: ${{ contains(needs.*.result, 'failure') && 'failure' || 'success' }}
109+
secrets: inherit
110+
111+
trigger-replication:
112+
needs:
113+
- build
114+
if: ${{ !cancelled() && github.event_name != 'pull_request' && github.repository == 'greenbone/openvas-scanner' }}
115+
runs-on: self-hosted-generic
93116
steps:
94-
- name: Checkout repository
95-
uses: actions/checkout@v6
96-
- uses: ./.github/actions/copy-docker-binaries
97-
with:
98-
arch: amd64
99-
- name: Container build and push 3rd gen
100-
id: build-and-push
101-
uses: greenbone/actions/container-build-push-generic@v3
117+
- name: Ensure all tags are replicated on the public registry
118+
uses: greenbone/actions/trigger-harbor-replication@v3
119+
if: ${{ github.event_name != 'pull_request' }}
102120
with:
103-
build-docker-file: .docker/prod.Dockerfile
104-
build-args: |
105-
REPOSITORY=${{ github.repository }}
106-
cosign-key: ${{ secrets.cosign_key_opensight }}
107-
cosign-key-password: ${{ secrets.cosign_password_opensight }}
108-
# The tlog function does not currently support an ed25519 key.
109-
cosign-tlog-upload: "false"
110-
image-labels: |
111-
org.opencontainers.image.vendor=Greenbone
112-
org.opencontainers.image.base.name=greenbone/gvm-libs
113-
image-tags: |
114-
# when IS_LATEST_TAG is set create a stable and a latest tag
115-
type=raw,value=latest,enable=${{ inputs.is_latest_tag }}
116-
type=raw,value=stable,enable=${{ inputs.is_latest_tag }}
117-
# if tag version is set than create a version tags
118-
type=semver,pattern={{version}},enable=${{ inputs.is_version_tag }}
119-
type=semver,pattern={{major}}.{{minor}},enable=${{ inputs.is_version_tag }}
120-
type=semver,pattern={{major}},enable=${{ inputs.is_version_tag }}
121-
# if on main or a branch TODO calculate upfront
122-
type=raw,value=edge,enable=${{ github.ref_name == 'main' }}
123-
type=raw,value={{branch}}-{{sha}},enable=${{ github.ref_type == 'branch' && github.event_name == 'push' && github.ref_name != 'main' }}
124-
# use pr-$PR_ID for pull requests (will not be uploaded)
125-
type=ref,event=pr
126-
registry: ${{ vars.IMAGE_REGISTRY }}
127-
registry-username: ${{ github.actor }}
128-
registry-password: ${{ secrets.GITHUB_TOKEN }}
129-
scout-user: ${{ secrets.dockerhub_user }}
130-
scout-password: ${{ secrets.dockerhub_token }}
121+
registry: ${{ vars.GREENBONE_REGISTRY }}
122+
token: ${{ secrets.GREENBONE_REGISTRY_REPLICATION_TOKEN }}
123+
user: ${{ secrets.GREENBONE_REGISTRY_REPLICATION_USER }}
124+
131125

132-
#not able to speed that up via prebuild binaries
133-
greenbone_reg_debian_stable:
134-
name: greenbone-reg:debian:stable
135-
uses: greenbone/workflows/.github/workflows/container-build-push-2nd-gen.yml@main
136-
with:
137-
image-url: community/openvas-scanner
138-
image-labels: |
139-
org.opencontainers.image.vendor=Greenbone
140-
org.opencontainers.image.base.name=greenbone/gvm-libs
141-
service: openvas-scanner
142-
secrets:
143-
COSIGN_KEY_OPENSIGHT: ${{ secrets.cosign_key_opensight }}
144-
COSIGN_KEY_PASSWORD_OPENSIGHT: ${{ secrets.cosign_password_opensight }}
145-
DOCKERHUB_USERNAME: ${{ secrets.dockerhub_user }}
146-
DOCKERHUB_TOKEN: ${{ secrets.dockerhub_token }}
147-
GREENBONE_BOT_TOKEN: ${{ secrets.greenbone_bot_token }}
148-
GREENBONE_REGISTRY: ${{ secrets.greenbone_registry }}
149-
GREENBONE_REGISTRY_USER: ${{ secrets.greenbone_registry_user }}
150-
GREENBONE_REGISTRY_TOKEN: ${{ secrets.greenbone_registry_token }}
151-
GREENBONE_REGISTRY_READ_USER: ${{ secrets.greenbone_registry_read_user }}
152-
GREENBONE_REGISTRY_READ_TOKEN: ${{ secrets.greenbone_registry_read_token }}
153-
GREENBONE_REGISTRY_REPLICATION_USER: ${{ secrets.greenbone_registry_replication_user }}
154-
GREENBONE_REGISTRY_REPLICATION_TOKEN: ${{ secrets.greenbone_registry_replication_token }}
155-
MATTERMOST_WEBHOOK_URL: ${{ secrets.mattermost_webhook_url }}

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ everything needed for scanning. Currently it uses the openvas-scanner as scan en
4444

4545
## Docker, [Greenbone Community Containers](https://greenbone.github.io/docs/latest/22.4/container/)
4646

47-
If you want to use the docker files provided in this repository you can pull them from the [Greenbone registry](registry.community.greenbone.net/community/openvas-scanner:stable). You can also locally build them using:
47+
If you want to use the docker files provided in this repository you can pull them from the [Greenbone registry](ghcr.io/greenbone/openvas-scanner:stable). You can also locally build them using:
4848
```
4949
docker build -t <image-name> -f .docker/prod.Dockerfile .
5050
```

‎charts/openvasd/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44

55
# Is currently reqired by openvasd to control openvas
66
ospd:
7-
repository: registry.community.greenbone.net/community/ospd-openvas
7+
repository: ghcr.io/greenbone/ospd-openvas
88
pullPolicy: Always
99
tag: "edge"
1010

1111
# Contains openvasd
1212
openvas:
13-
repository: registry.community.greenbone.net/community/openvas-scanner
13+
repository: ghcr.io/greenbone/openvas-scanner
1414
pullPolicy: Always
1515
tag: "edge"
1616

0 commit comments

Comments
 (0)