Use Podman for static Qt browser bundle
ober
95bcdf40f5c6b78f309f1717299b7fb93dc2e3fe
--- a/Dockerfile.qt +++ b/Dockerfile.qt @@ -1,6 +1,6 @@ -# Docker recipe for building the bundled jerboa-browser Linux Qt artifact. +# OCI container recipe for building the bundled jerboa-browser Linux Qt artifact. # -# This mirrors the jerboa-emacs static-qt workflow: build inside Docker, create a +# This mirrors the jerboa-emacs static-qt workflow: build inside Podman, create a # container, and copy the finished artifact from /out. Unlike jemacs-qt, this # project uses Qt WebEngine, so the result is not a single fully static Qt # executable. The tarball contains the native Jerboa browser binary, the Qt @@ -8,11 +8,11 @@ # and WebEngine resource files. # # Usage: -# docker build -f Dockerfile.qt -t jerboa-browser-qt-builder . -# id=$(docker create jerboa-browser-qt-builder) -# docker cp $id:/out/jerboa-browser-static-qt.tar.gz . && docker rm $id +# podman build -f Dockerfile.qt -t jerboa-browser-qt-builder . +# id=$(podman create jerboa-browser-qt-builder) +# podman cp $id:/out/jerboa-browser-static-qt.tar.gz . && podman rm $id -ARG JERBOA_IMAGE=jerboa21/jerboa +ARG JERBOA_IMAGE=docker.io/jerboa21/jerboa FROM ${JERBOA_IMAGE} AS builder ENV DEBIAN_FRONTEND=noninteractive --- a/Makefile +++ b/Makefile @@ -30,10 +30,10 @@ SANDBOX_DIR ?= dist/webengine-sandbox CC ?= cc CARGO ?= cargo CARGO_AUDIT ?= $(shell command -v cargo-audit 2>/dev/null || printf '%s/.cargo/bin/cargo-audit' "$$HOME") -DOCKER ?= docker -DOCKER_PLATFORM ?= linux/amd64 -DOCKER_BUILD_FLAGS ?= -JERBOA_IMAGE ?= jerboa21/jerboa +PODMAN ?= podman +PODMAN_PLATFORM ?= linux/amd64 +PODMAN_BUILD_FLAGS ?= +JERBOA_IMAGE ?= docker.io/jerboa21/jerboa STATIC_QT_IMAGE ?= jerboa-browser-qt-builder STATIC_QT_TARBALL ?= jerboa-browser-static-qt-linux-amd64.tar.gz @@ -79,7 +79,7 @@ lib/libyubikey_native.$(SOEXT): vendor-yubikey yubikey-native: lib/libyubikey_native.$(SOEXT) -.PHONY: all build binary install run test test-all test-keymap test-minibuffer test-commands test-keys test-nav test-hint test-pass test-polish test-securestore test-adblock test-gui test-buffers test-native repl security audit sbom reproducibility-report binary-smoke webengine-sandbox-evidence verify release-evidence clean help check-jerbuild check-docker ensure-jerboa-tools static-qt docker-static-qt vendor-yubikey yubikey-native +.PHONY: all build binary install run test test-all test-keymap test-minibuffer test-commands test-keys test-nav test-hint test-pass test-polish test-securestore test-adblock test-gui test-buffers test-native repl security audit sbom reproducibility-report binary-smoke webengine-sandbox-evidence verify release-evidence clean help check-jerbuild check-podman ensure-jerboa-tools static-qt podman-static-qt vendor-yubikey yubikey-native .DEFAULT_GOAL := help all: binary @@ -103,9 +103,11 @@ ensure-jerboa-tools: exit 1; \ } -check-docker: - @command -v $(DOCKER) >/dev/null 2>&1 || \ - { echo "ERROR: Docker executable '$(DOCKER)' not found. Install Docker or set DOCKER=/path/to/docker."; exit 1; } +check-podman: + @command -v $(PODMAN) >/dev/null 2>&1 || \ + { echo "ERROR: Podman executable '$(PODMAN)' not found. Install Podman or set PODMAN=/path/to/podman."; exit 1; } + @$(PODMAN) info >/dev/null 2>&1 || \ + { echo "ERROR: Podman executable '$(PODMAN)' is installed but not reachable. On macOS/Windows, run 'podman machine start' and retry."; exit 1; } # Build the self-contained native ./jerboa-browser via .jerbuild. binary: check-jerbuild vendor-yubikey $(FUSE_SHIM) @@ -320,20 +322,20 @@ release-evidence: verify repl: $(JEXEC) scheme/browser-repl.ss -# Docker wrapper matching the jerboa-emacs static-qt workflow. Qt WebEngine is +# Podman wrapper matching the jerboa-emacs static-qt workflow. Qt WebEngine is # not emitted as one fully static executable; the artifact is a bundled Linux # tarball with the native browser binary plus the Qt WebEngine runtime. -static-qt: docker-static-qt +static-qt: podman-static-qt -docker-static-qt: check-docker - @echo "=== Building jerboa-browser Linux Qt artifact with Docker ===" - $(DOCKER) pull $(JERBOA_IMAGE) - $(DOCKER) build $(DOCKER_BUILD_FLAGS) --platform $(DOCKER_PLATFORM) \ +podman-static-qt: check-podman + @echo "=== Building jerboa-browser Linux Qt artifact with Podman ===" + $(PODMAN) pull --platform $(PODMAN_PLATFORM) $(JERBOA_IMAGE) + $(PODMAN) build $(PODMAN_BUILD_FLAGS) --platform $(PODMAN_PLATFORM) \ --build-arg JERBOA_IMAGE="$(JERBOA_IMAGE)" \ -f Dockerfile.qt -t $(STATIC_QT_IMAGE) . - @id=$$($(DOCKER) create $(STATIC_QT_IMAGE)) && \ - trap '$(DOCKER) rm $$id >/dev/null 2>&1 || true' EXIT INT TERM && \ - $(DOCKER) cp $$id:/out/jerboa-browser-static-qt.tar.gz ./$(STATIC_QT_TARBALL) + @id=$$($(PODMAN) create $(STATIC_QT_IMAGE)) && \ + trap '$(PODMAN) rm $$id >/dev/null 2>&1 || true' EXIT INT TERM && \ + $(PODMAN) cp $$id:/out/jerboa-browser-static-qt.tar.gz ./$(STATIC_QT_TARBALL) @echo "" @ls -lh $(STATIC_QT_TARBALL) @tar tzf $(STATIC_QT_TARBALL) | grep -E '/bin/jerboa-browser$$' >/dev/null || \ @@ -377,7 +379,7 @@ help: @echo "" @echo " make binary build the self-contained native ./jerboa-browser" @echo " make install build + install to $(BIN_DIR)/jerboa-browser" - @echo " make static-qt build the bundled Linux Qt/WebEngine tarball via Docker" + @echo " make static-qt build the bundled Linux Qt/WebEngine tarball via Podman" @echo " make verify run full tests, security checks, and dependency audit" @echo " make sbom write SBOM/provenance evidence under dist/sbom" @echo " make reproducibility-report rebuild the browser binary twice" --- a/README.md +++ b/README.md @@ -143,7 +143,7 @@ default, a protected passphrase file, or the interactive prompt. ```sh make binary # the self-contained native ./jerboa-browser -make static-qt # bundled Linux Qt/WebEngine tarball via Docker (linux/amd64) +make static-qt # bundled Linux Qt/WebEngine tarball via Podman (linux/amd64) make vendor-yubikey # clone https://git.sr.ht/~lisp/jerboa-yubikey into vendor/ make yubikey-native # build lib/libyubikey_native for direct USB YubiKey access make test # (browser) suite + secure-store unit tests; also test-{keymap,…,polish} @@ -153,7 +153,7 @@ make test-securestore # just the pure secure-store crypto/format unit tests make test-gui # offline Qt snapshot harness (offscreen, headless) ``` -`make static-qt` mirrors the jerboa-emacs Docker workflow and copies out +`make static-qt` mirrors the jerboa-emacs container workflow through Podman and copies out `jerboa-browser-static-qt-linux-amd64.tar.gz`. Because this backend is Qt WebEngine, the artifact is a bundled Linux tarball rather than a literal one-file static executable. It includes the native browser binary, the --- a/packaging/README.md +++ b/packaging/README.md @@ -97,7 +97,7 @@ Total ≈ 299 MB (dominated by QtWebEngineCore + ICU). ```sh packaging/linux/build-tarball.sh # → qt-webengine/build/jerboa-browser-<ver>-linux-<arch>.tar.gz BUNDLE_QT=1 packaging/linux/build-tarball.sh -make static-qt # Docker build, copies ./jerboa-browser-static-qt-linux-amd64.tar.gz +make static-qt # Podman build, copies ./jerboa-browser-static-qt-linux-amd64.tar.gz ``` The tarball always bundles the backend `libjerboa_browser.so`, the @@ -137,6 +137,6 @@ uses an interactive terminal prompt. The packaged browser does not accept profile-vault secrets through process environment variables and does not embed a build-local fallback secret. -`make static-qt` always uses `BUNDLE_QT=1` inside Docker, with the -`jerboa21/jerboa` image plus Ubuntu Qt WebEngine packages, and validates the +`make static-qt` always uses `BUNDLE_QT=1` inside Podman, with the +`docker.io/jerboa21/jerboa` image plus Ubuntu Qt WebEngine packages, and validates the tarball in a clean Ubuntu stage with no Qt package installed. --- a/packaging/linux/build-tarball.sh +++ b/packaging/linux/build-tarball.sh @@ -321,7 +321,7 @@ WRAP # native-rust) — the secure store needs it; without it the binary aborts # at startup ("no entry for jerboa_last_error"). Reuse the Makefile rule # (cargo build --features crypto, symlinked into ./lib). Best-effort: a - # stale-cargo CI host can't build a v4-lockfile crate, but the Docker + # stale-cargo CI host can't build a v4-lockfile crate, but the Podman # static-qt path (modern cargo) builds it and asserts it in the tarball. ( cd "$REPO" && make "lib/libjerboa_native.so" ) || true if [ -f "$REPO/lib/libjerboa_native.so" ]; then