26 lines
1.6 KiB
Bash
26 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
# Builds only a local, unqualified image from the inspected exact source adapter.
|
|
set -euo pipefail
|
|
CONTROL=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
[[ $# == 2 ]] || { echo 'usage: build-local-candidate.sh SOURCE_GIT NEW_WORK_DIR' >&2; exit 2; }
|
|
[[ ! -e "$2" ]] || { echo 'New disposable work directory required' >&2; exit 2; }
|
|
mkdir -p "$2"
|
|
work=$(realpath "$2")
|
|
bash "$CONTROL/prepare-source.sh" "$1" "$work/source"
|
|
cp "$CONTROL/Dockerfile" "$work/source/Dockerfile.archipelago"
|
|
# The frozen upstream has no native signer bridge. Bind the canonical platform
|
|
# asset to this candidate explicitly; never fetch or vendor an untracked copy.
|
|
cp "$CONTROL/../../neode-ui/public/nostr-provider.js" "$work/source/.archipelago-nostr-provider.js"
|
|
sha256sum "$work/source/.archipelago-nostr-provider.js" | cut -d' ' -f1 > "$work/source/.archipelago-provider-sha256"
|
|
# Context is the verified export only; no Git remote, homes, sockets or credentials.
|
|
printf '.git\n**/node_modules\n**/data\n.env\n**/.env\n' > "$work/source/.containerignore"
|
|
name="localhost/archy-podsteadr-qualification:$(date -u +%Y%m%dT%H%M%SZ)-$$"
|
|
printf '%s\n' "$name" > "$work/image.tag"
|
|
timeout --signal=TERM --kill-after=15s 1200 podman build \
|
|
--format=docker --pull=never --http-proxy=false --network=slirp4netns:allow_host_loopback=false \
|
|
--cpu-period=100000 --cpu-quota=200000 --memory=2g --memory-swap=2g \
|
|
--ulimit=nproc=4096:4096 --jobs=1 --force-rm \
|
|
--iidfile "$work/image.id" --tag "$name" \
|
|
--file "$work/source/Dockerfile.archipelago" "$work/source"
|
|
echo 'Local candidate only: provenance, lifecycle, media and financial review remain separate.'
|