cloudbuild_docker.yaml

# This cloudbuild script builds docker images we expect users to
# commonly deploy, and stores these in cloud registry.
# This builds the images multi-arch so they run on x64 and Raspberry Pi.
timeout: 3600s
options:
  machineType: E2_HIGHCPU_32
  volumes:
  - name: go-modules
    path: /go
  env:
  - GO111MODULE=on
  - GOPROXY=https://proxy.golang.org
  - PROJECT_ROOT=github.com/google/trillian-examples
  - GOPATH=/go
  - GOLANG_PROTOBUF_REGISTRATION_CONFLICT=ignore # Temporary work-around v1.proto already registered error.
  - 'DOCKER_CLI_EXPERIMENTAL=enabled'

steps:
  - name: 'gcr.io/cloud-builders/docker'
    args: ['run', '--privileged', 'linuxkit/binfmt:v0.8']
    id: 'initialize-qemu'
  - name: 'gcr.io/cloud-builders/docker'
    args: ['buildx', 'create', '--name', 'mybuilder']
    id: 'create-builder'
  - name: 'gcr.io/cloud-builders/docker'
    args: ['buildx', 'use', 'mybuilder']
    id: 'select-builder'
  - name: 'gcr.io/cloud-builders/docker'
    args: ['buildx', 'inspect', '--bootstrap']
    id: 'show-target-build-platforms'

  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/witness:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/witness:latest',
      '-f', './witness/golang/cmd/witness/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-witness-image'
  # Write this build to a serverless log. Note that this step is experimental, and it is configured
  # to always appear to succeed from the view of Cloud Build, although more details may be found in
  # the logs.
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
      # Set ERR trap to be inherited by shell functions. Allows our bash command logs to show up in
      # Cloud Console.
      - '-E'
      - '-c'
      - |
        docker pull gcr.io/$PROJECT_ID/witness &&
        # Special /workspace path:
        # https://cloud.google.com/build/docs/configuring-builds/pass-data-between-steps#passing_data_using_workspaces
        echo $(docker images --format '{{.Digest}}' gcr.io/$PROJECT_ID/witness) > /workspace/image-digest.txt ||
        # Tell Cloud Build that this step succeeded. See this workaround documented here:
        # https://github.com/GoogleCloudPlatform/cloud-builders/issues/253#issuecomment-381600420
        exit 0
    waitFor:
      - build-witness-image
    id: 'store-witness-image-digest'
  - name: 'gcr.io/cloud-builders/gcloud'
    entrypoint: 'bash'
    args:
      # Set ERR trap to be inherited by shell functions. Allows our bash command logs to show up in
      # Cloud Console.
      - '-E'
      - '-c'
      - |
        gcloud functions call create_gcs_object --data="{
          \"bucket\":\"${_BUCKET}\",
          \"entryContent\":\"${REPO_NAME},${COMMIT_SHA},$(cat /workspace/image-digest.txt),linux/amd64\",
          \"entryPath\":\"${_ENTRIES_DIR}/linux-amd64-${COMMIT_SHA}\"
        }" &&
        gcloud functions call create_gcs_object --data="{
          \"bucket\":\"${_BUCKET}\",
          \"entryContent\":\"${REPO_NAME},${COMMIT_SHA},$(cat /workspace/image-digest.txt),linux/arm/v7\",
          \"entryPath\":\"${_ENTRIES_DIR}/linux-arm-v7-${COMMIT_SHA}\"
        }" &&
        gcloud functions call sequence --data="{
          \"entriesDir\": \"${_ENTRIES_DIR}\",
          \"origin\": \"default\",
          \"bucket\": \"${_BUCKET}\"
        }" &&
        gcloud functions call integrate --data="{
          \"origin\": \"default\",
          \"bucket\": \"${_BUCKET}\"
        }" ||
        # Tell Cloud Build that this step succeeded. See this workaround documented here:
        # https://github.com/GoogleCloudPlatform/cloud-builders/issues/253#issuecomment-381600420
        exit 0
    waitFor:
      - store-witness-image-digest
    id: 'write-to-transparency-log'

  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/sumdb-feeder:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/sumdb-feeder:latest',
      '-f', './sumdbaudit/witness/cmd/feeder/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-sumdb-feeder-image'
  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/distribute-to-github:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/distribute-to-github:latest',
      '-f', './serverless/cmd/distribute/github/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-distribute-to-github-image'
  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/serverless-feeder:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/serverless-feeder:latest',
      '-f', './serverless/cmd/feeder/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-serverless-feeder-image'
  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/rekor-feeder:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/rekor-feeder:latest',
      '-f', './feeder/cmd/rekor_feeder/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-rekor-feeder-image'
  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/pixel-bt-feeder:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/pixel-bt-feeder:latest',
      '-f', './feeder/cmd/pixel_bt_feeder/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-pixel-feeder-image'
  - name: 'gcr.io/cloud-builders/docker'
    args: [
      'buildx',
      'build',
      '--platform', '$_DOCKER_BUILDX_PLATFORMS',
      '-t', 'gcr.io/$PROJECT_ID/omniwitness-monolith:latest',
      '--cache-from', 'gcr.io/$PROJECT_ID/omniwitness-monolith:latest',
      '-f', './witness/golang/omniwitness/monolith/Dockerfile',
      '--push',
      '.'
    ]
    waitFor:
      - show-target-build-platforms
    id: 'build-omniwitness-monolith-image'

substitutions:
  _DOCKER_BUILDX_PLATFORMS: 'linux/amd64,linux/arm/v7'
  _BUCKET: 'transparency_log'
  _ENTRIES_DIR: 'log_entries'