v8.6: julia_publish: install aws-kms-pkcs11 for KMS-backed docs deploy (#289)

The julia-publish pipeline's publish_all step gains a docs-deploy phase that
pushes the built HTML docs to docs.julialang.org over SSH, signing with a
deploy key whose private half lives only in AWS KMS. SSH reaches the key
through the aws-kms-pkcs11 PKCS#11 provider, which this image previously
lacked. Install the upstream prebuilt, statically-linked module (v0.0.17,
ubuntu24.04 build -- matches Debian trixie's OpenSSL 3) at the standard
p11-kit module path, pin its sha256, and verify all NEEDED libraries resolve
(its only out-of-image runtime dependency is libjson-c5).

Co-authored-by: Keno Fischer <Keno@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

v8.5

What's Changed

• Add package_linux_mmtk image w/ Rust toolchain by @topolarity in #288

New Contributors

• @topolarity made their first contribution in #288

Full Changelog: v8.4...v8.5

v8.4

What's Changed

• Bump julia-actions/setup-julia from 2 to 3 in the all-github-actions group across 1 directory by @dependabot[bot] in #283
• Remove the buildkite agent from the rootfs. by @maleadt in #287

New Contributors

• @maleadt made their first contribution in #287

Full Changelog: v8.3...v8.4

v8.3: Add a single unix image for all-OS code signing (#286)

* Add julia_publish rootfs image for the release publish toolchain

The julia-publish pipeline's publish_all step (re)signs and (re)packages
the per-platform Julia release artifacts, but currently runs on a bare
agent and fails with 'aws: command not found'. This image carries the
full toolchain it needs: AWS CLI v2, python3, p7zip-full (7z),
hfsprogs + Mozilla's libdmg-hfsplus (dmg/hfsplus/mkfshfs) for the macOS
.dmg, wine64 + a JRE for the Inno Setup .exe compiler, and jsign for
Authenticode signing via Azure Trusted Signing.

x86_64 only, since publish_all runs only on linux/x86_64.

Refs: JuliaCI/julia-buildkite#544

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: build libdmg-hfsplus in build/ subdir, locate binaries by name

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: harden the Wine/Inno Setup install + hard-fail

Headless Wine prefix init in a debootstrap chroot is flaky; make it
deterministic and fail loudly instead of shipping a silently-broken
image:
- WINEDLLOVERRIDES="mscoree,mshtml=" disables Wine's Mono/Gecko
  first-run downloads (Inno Setup needs neither; the prompt otherwise
  hangs headlessly / fetches over the network).
- wineserver -w blocks on the async `wineboot --init` before the
  installer runs.
- the build now HARD-FAILS (exit 1) if ISCC.exe is missing or doesn't
  run under Wine (runs `ISCC.exe /?` and greps its banner), replacing
  the previous `set +e`/`|| true` soft warning.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: drop hfsprogs (gone from trixie); use libdmg-hfsplus mkfshfs

The image build failed in CI: 'Package hfsprogs has no installation
candidate' -- hfsprogs (mkfs.hfsplus) was removed from Debian after
bullseye. The image already builds libdmg-hfsplus's own mkfshfs, so use
that for HFS+ creation and drop the hfsprogs apt package. Smoke checks
now verify mkfshfs/hfsplus/dmg are on PATH.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: install JRE as a Temurin tarball (openjdk .deb fails in chroot)

Second CI failure: openjdk-21-jre-headless post-install (default-jre-
headless -> ca-certificates-java) fails to configure in the debootstrap
chroot -- ca-certificates-java needs a working JVM at configure time,
which a minimal chroot doesn't provide. Drop default-jre-headless from
apt and install a self-contained Temurin JRE 21 tarball (no dpkg hooks),
symlinked to /usr/local/bin/java for jsign. (ISCC.exe runs under Wine,
not the JVM, so Java is only needed by jsign.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: build newfs_hfs from diskdev_cmds (libdmg-hfsplus has no mkfs)

mozilla/libdmg-hfsplus builds only the 'dmg' and 'hfsplus' tools -- it has
no HFS+ *creation* tool, so the image build was failing on a non-existent
'mkfshfs' binary. Create the filesystem with newfs_hfs (the 'mkfs.hfsplus'
from Apple's diskdev_cmds, which Debian shipped as hfsprogs before dropping
it after bullseye), built from the same pinned Fedora-hosted tarball Mozilla
uses for Firefox DMGs. Only the newfs_hfs target is built (with gcc; the
top-level Makefile's clang/-fblocks is only needed for fsck_hfs). Adds
uuid-dev for <uuid/uuid.h>. build_dmg.sh now defaults MKFSHFS_TOOL=newfs_hfs.

Also temporarily trims the CI matrix to julia_publish.x86_64 only, to avoid
burning resources on the other ~36 images while iterating; revert before merge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: fix Temurin java via wrapper (libjli.so resolution)

A bare symlink of the java binary fails at runtime with 'libjli.so: cannot
open shared object file' -- the launcher resolves libjli.so relative to
argv[0]'s directory (/usr/local/lib) rather than its real install dir.
Use a stable /opt/temurin symlink + a wrapper that execs java by its real
path so libjli.so resolves correctly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: set LD_LIBRARY_PATH in java wrapper (chroot has no /proc)

The real cause of the 'libjli.so: cannot open' failure is that the java
launcher locates its bundled libjli.so/libjvm.so via an $ORIGIN-relative
RPATH, and glibc derives $ORIGIN from /proc/self/exe -- but the debootstrap
build chroot mounts no /proc, so $ORIGIN expansion fails and the libraries
are never found (independent of symlink vs real-path invocation). Set
LD_LIBRARY_PATH=/opt/temurin/lib:/opt/temurin/lib/server in the wrapper so
the libs resolve by absolute path. Validated under dash with the Temurin 21
JRE both with LD_LIBRARY_PATH unset and preset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: mount /proc,/dev/pts,/dev/shm for Wine prefix init

Wine's preloader reads /proc/self/maps and Wine needs ptys + shared memory,
but the bare 'sudo chroot' build environment mounts none of these, so the
Inno Setup prefix init failed with 'wine: could not load ntdll.so'. Mount
/proc, /dev/pts and /dev/shm just for the Wine step, with a trap that kills
wineserver and unmounts them on exit so they never leak into the image
tarball. (Wine runs fine as root here -- the prior run reached the preloader,
not a root refusal.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* julia_publish: install 32-bit Wine (wine32:i386) for Inno Setup WoW64

Inno Setup's installer and ISCC.exe are 32-bit Windows apps. With only
wine64, the win64 prefix's C:\windows\syswow64 is unpopulated and the
installer dies with 'failed to load syswow64\ntdll.dll error c0000135'
(DLL_NOT_FOUND). Enable the i386 architecture and install wine32:i386
(pulls libwine:i386 + wine32-preloader) so WoW64 can run the 32-bit PE.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Revert temporary CI matrix trim (restore all images)

The matrix was trimmed to only julia_publish.x86_64 during bring-up to avoid
rebuilding the other ~36 images on each iteration. julia_publish now builds
green, so restore the full matrix; the only remaining diff vs main is the one
added julia_publish.x86_64 entry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Keno Fischer <Keno@users.noreply.github.com>

v8.2

Install the AWS CLI in the package_linux, llvm_passes and tester_linu…

v8.1

What's Changed

• Windows: In the Windows Dockerfile, change the workdir; also, run Windows CI on the correct Windows version (Windows 2022) by @DilumAluthge in #273
• Windows CI: Make sure that the Docker daemon is running by @DilumAluthge in #278
• Set up the Kodiak automerge bot on this repo by @DilumAluthge in #279
• CI: Update the Windows CI setup to support building on multiple Windows versions in the future by @DilumAluthge in #277
• Bump the all-github-actions group across 1 directory with 3 updates by @dependabot[bot] in #272
• Windows (package-i686): Make 7-Zip overwrite files, and use a different 7-Zip by @DilumAluthge in #276
• CI: Run the helper job on Ubuntu by @DilumAluthge in #274
• Windows: Install correct CMake by @Keno in #264

New Contributors

• @Keno made their first contribution in #264

Full Changelog

Full Changelog: v8.0...v8.1

v8.0

What's Changed

• Remove zlib from llvm_passes image by @Zentrik in #263
• Try alternate way of installing vcredist by @staticfloat in #265
• Upgrade default debian release from bullseye to bookworm by @fredrikekre in #267

Full Changelog: v7.11...v8.0

v7.11

What's Changed

• Multiple CI changes: (1) Build ARM64 Linux images on native runners (instead of QEMU), (2) set up Dependabot, and (3) update multiple actions by @DilumAluthge in #261
• Bump the all-github-actions group with 2 updates by @dependabot in #262
• Windows: Git longpaths by @adienes in #260

New Contributors

• @dependabot made their first contribution in #262
• @adienes made their first contribution in #260

Full Changelog: v7.10...v7.11

v7.10

What's Changed

• Add Trusted Signing dlib by @staticfloat in #258

Full Changelog: v7.9...v7.10

v7.9

What's Changed

• Install .NET framework by @staticfloat in #257

Full Changelog: v7.8...v7.9