Add a single unix image for all-OS code signing#286
Merged
DilumAluthge merged 11 commits intoJun 14, 2026
Conversation
The julia-publish pipeline's publish_all step (re)signs and (re)packages the per-platform Julia release artifacts, but currently runs on a bare agent and fails with 'aws: command not found'. This image carries the full toolchain it needs: AWS CLI v2, python3, p7zip-full (7z), hfsprogs + Mozilla's libdmg-hfsplus (dmg/hfsplus/mkfshfs) for the macOS .dmg, wine64 + a JRE for the Inno Setup .exe compiler, and jsign for Authenticode signing via Azure Trusted Signing. x86_64 only, since publish_all runs only on linux/x86_64. Refs: JuliaCI/julia-buildkite#544 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… by name Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Headless Wine prefix init in a debootstrap chroot is flaky; make it deterministic and fail loudly instead of shipping a silently-broken image: - WINEDLLOVERRIDES="mscoree,mshtml=" disables Wine's Mono/Gecko first-run downloads (Inno Setup needs neither; the prompt otherwise hangs headlessly / fetches over the network). - wineserver -w blocks on the async `wineboot --init` before the installer runs. - the build now HARD-FAILS (exit 1) if ISCC.exe is missing or doesn't run under Wine (runs `ISCC.exe /?` and greps its banner), replacing the previous `set +e`/`|| true` soft warning. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…kfshfs The image build failed in CI: 'Package hfsprogs has no installation candidate' -- hfsprogs (mkfs.hfsplus) was removed from Debian after bullseye. The image already builds libdmg-hfsplus's own mkfshfs, so use that for HFS+ creation and drop the hfsprogs apt package. Smoke checks now verify mkfshfs/hfsplus/dmg are on PATH. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…n chroot) Second CI failure: openjdk-21-jre-headless post-install (default-jre- headless -> ca-certificates-java) fails to configure in the debootstrap chroot -- ca-certificates-java needs a working JVM at configure time, which a minimal chroot doesn't provide. Drop default-jre-headless from apt and install a self-contained Temurin JRE 21 tarball (no dpkg hooks), symlinked to /usr/local/bin/java for jsign. (ISCC.exe runs under Wine, not the JVM, so Java is only needed by jsign.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…no mkfs) mozilla/libdmg-hfsplus builds only the 'dmg' and 'hfsplus' tools -- it has no HFS+ *creation* tool, so the image build was failing on a non-existent 'mkfshfs' binary. Create the filesystem with newfs_hfs (the 'mkfs.hfsplus' from Apple's diskdev_cmds, which Debian shipped as hfsprogs before dropping it after bullseye), built from the same pinned Fedora-hosted tarball Mozilla uses for Firefox DMGs. Only the newfs_hfs target is built (with gcc; the top-level Makefile's clang/-fblocks is only needed for fsck_hfs). Adds uuid-dev for <uuid/uuid.h>. build_dmg.sh now defaults MKFSHFS_TOOL=newfs_hfs. Also temporarily trims the CI matrix to julia_publish.x86_64 only, to avoid burning resources on the other ~36 images while iterating; revert before merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A bare symlink of the java binary fails at runtime with 'libjli.so: cannot open shared object file' -- the launcher resolves libjli.so relative to argv[0]'s directory (/usr/local/lib) rather than its real install dir. Use a stable /opt/temurin symlink + a wrapper that execs java by its real path so libjli.so resolves correctly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The real cause of the 'libjli.so: cannot open' failure is that the java launcher locates its bundled libjli.so/libjvm.so via an $ORIGIN-relative RPATH, and glibc derives $ORIGIN from /proc/self/exe -- but the debootstrap build chroot mounts no /proc, so $ORIGIN expansion fails and the libraries are never found (independent of symlink vs real-path invocation). Set LD_LIBRARY_PATH=/opt/temurin/lib:/opt/temurin/lib/server in the wrapper so the libs resolve by absolute path. Validated under dash with the Temurin 21 JRE both with LD_LIBRARY_PATH unset and preset. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wine's preloader reads /proc/self/maps and Wine needs ptys + shared memory, but the bare 'sudo chroot' build environment mounts none of these, so the Inno Setup prefix init failed with 'wine: could not load ntdll.so'. Mount /proc, /dev/pts and /dev/shm just for the Wine step, with a trap that kills wineserver and unmounts them on exit so they never leak into the image tarball. (Wine runs fine as root here -- the prior run reached the preloader, not a root refusal.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Inno Setup's installer and ISCC.exe are 32-bit Windows apps. With only wine64, the win64 prefix's C:\windows\syswow64 is unpopulated and the installer dies with 'failed to load syswow64\ntdll.dll error c0000135' (DLL_NOT_FOUND). Enable the i386 architecture and install wine32:i386 (pulls libwine:i386 + wine32-preloader) so WoW64 can run the 32-bit PE. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The matrix was trimmed to only julia_publish.x86_64 during bring-up to avoid rebuilding the other ~36 images on each iteration. julia_publish now builds green, so restore the full matrix; the only remaining diff vs main is the one added julia_publish.x86_64 entry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Keno
changed the title
DilumAluthge
approved these changes
Jun 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.