Repository navigation
Add verified-garbage's x86 and ARMv7 runner images - #799
Closed
reaperhulk wants to merge 3 commits into
Closed
reaperhulk wants to merge 3 commits into
reaperhulk wants to merge 3 commits into
Conversation
verified-garbage runs its x86 jobs in rust:slim (installing the amd64 libc, git and python3 in every job) and its ARMv7 jobs in cryptography-runner-ubuntu-rolling:armv7l, whose stripped toolchain the jobs cannot update in place. Build one image for both, with only what those jobs use: the runner's libc and libstdc++ for the Node GitHub Actions injects, gcc, git, python3, OpenSSL's headers and CLI for the benchmarks, and an unstripped stable toolchain with the components and targets the jobs install, in a fixed RUSTUP_HOME and CARGO_HOME. It is built in a job of its own, as verified-garbage-runner:i686 (linux/386, on an x86-64 runner) and verified-garbage-runner:armv7l (linux/arm/v7, on an ARM64 runner), and each image is checked: the runner's Node runs in it, a crate builds and runs for every installed target, and rustup can uninstall the toolchain's components. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NpYBbKWv7QaJdAZp7VafSt
Move the build out of build-docker-images.yml into build-verified-garbage-images.yml, with the same triggers for its own paths. Install zstd for actions/cache, set RUSTUP_PERMIT_COPY_RENAME, and shrink the toolchain as the Ubuntu runner images do: deduplicate libLLVM and llvm-strip the big binaries (clippy's and rustfmt's too), keeping every file in rustup's component manifests so the jobs can still update it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NpYBbKWv7QaJdAZp7VafSt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NpYBbKWv7QaJdAZp7VafSt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
verified-garbage runs its x86 jobs in
rust:slim, installing the amd64 libc, git and python3 in every job. Its ARMv7 jobs run incryptography-runner-ubuntu-rolling:armv7lwith a separateRUSTUP_HOME, which works around that image's stripped toolchain. This adds one image for both 32-bit userspaces, containing only what those jobs use. It's built by a new workflow,build-verified-garbage-images.yml, modelled onbuild-docker-images.yml:ghcr.io/pyca/verified-garbage-runner:i686(linux/386, onubuntu-latest)ghcr.io/pyca/verified-garbage-runner:armv7l(linux/arm/v7, onubuntu-24.04-arm)Contents (
verified-garbage/Dockerfile, ondebian:trixie-slim)libc6andlibstdc++6for the runner's architecture (amd64/arm64), so the Node binary that GitHub Actions injects can rungccandlibc6-dev(rustc's linker; binutils providesreadelffor the Thumb check)gitandca-certificatesforactions/checkoutpython3for the coverage export and the benchmark comparisonzstdfor actions/cachelibssl-dev,pkg-configandopensslfor the benchmarks, which link rust-opensslthumbv7neon-unknown-linux-gnueabihftarget on ARMv7. These are the components and target the jobs install. The host triple is the userspace's, and the toolchain lives in a fixedRUSTUP_HOME/CARGO_HOME, because jobs run withHOME=/github/home.The toolchain is shrunk the same way as the Ubuntu runner images (#798): libLLVM is deduplicated and the big binaries are run through
llvm-strip. Every file in rustup's manifests is kept, so jobs can update the toolchain in place.RUSTUP_PERMIT_COPY_RENAME=1is also set.Checks
After building, the workflow runs these inside each image:
rustup component removeon the toolchain's componentsTesting
Locally, I built the i386 package layer and ran the runner's x86-64 Node inside it. The rustup step and the ARMv7 image have only been checked by this PR's CI.
Follow-ups
verified-garbage-runnerpackage will be private when it's first pushed from main. It needs to be made public, or given read access for pyca/verified-garbage.🤖 Generated with Claude Code
https://claude.ai/code/session_01NpYBbKWv7QaJdAZp7VafSt
Generated by Claude Code