Add multi-arch builder pipeline for amd64 + arm64 support

.tekton/plumbing-builder-pull-request.yaml

@@ -30,10 +30,14 @@ spec:
       value: Containerfile
     - name: path-context
       value: builder
+    - name: build-platforms
+      value:
+        - linux/amd64
+        - linux/arm64
   timeouts:
     pipeline: 3h
   taskRunSpecs:
-    - pipelineTaskName: build-container
+    - pipelineTaskName: build-images
       timeout: 3h
       stepSpecs:
         - name: build
@@ -51,5 +55,5 @@ spec:
       secret:
         secretName: '{{ git_auth_secret }}'
   pipelineRef:
-    name: build
+    name: build-multiarch
 status: {}

.tekton/plumbing-builder-push.yaml

@@ -27,10 +27,14 @@ spec:
       value: Containerfile
     - name: path-context
       value: builder
+    - name: build-platforms
+      value:
+        - linux/amd64
+        - linux/arm64
   timeouts:
     pipeline: 3h
   taskRunSpecs:
-    - pipelineTaskName: build-container
+    - pipelineTaskName: build-images
       timeout: 3h
       stepSpecs:
         - name: build
@@ -48,5 +52,5 @@ spec:
       secret:
         secretName: '{{ git_auth_secret }}'
   pipelineRef:
-    name: build
+    name: build-multiarch
 status: {}

builder/Containerfile

@@ -1,7 +1,7 @@
 # default to latest supported policy, x86_64
 ARG BASEIMAGE=registry.access.redhat.com/ubi8/ubi@sha256:8e573e1d76ff27f9e1219b33c114e48b0f7b86f2e6858cd8861e84431c7416e4
 ARG POLICY=manylinux_2_28
-ARG PLATFORM=x86_64
+ARG PLATFORM=
 ARG DEVTOOLSET_ROOTPATH=/opt/rh/gcc-toolset-14/root
 ARG LD_LIBRARY_PATH_ARG=${DEVTOOLSET_ROOTPATH}/usr/lib64:${DEVTOOLSET_ROOTPATH}/usr/lib:${DEVTOOLSET_ROOTPATH}/usr/lib64/dyninst:${DEVTOOLSET_ROOTPATH}/usr/lib/dyninst
 ARG PREPEND_PATH=/usr/local/bin:${DEVTOOLSET_ROOTPATH}/usr/bin:
@@ -146,7 +146,8 @@ FROM build_base AS build_rust
 COPY build_scripts/build-rust.sh /opt/_internal/build_scripts/
 RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     export RUST_VERSION=1.95.0 && \
-    export RUST_HASH=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10 && \
+    export RUST_HASH_x86_64=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10 && \
+    export RUST_HASH_aarch64=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792 && \
     export RUST_DOWNLOAD_URL=https://static.rust-lang.org/rustup/dist && \
     /tmp/cross-compiler/entrypoint /opt/_internal/build_scripts/build-rust.sh
 

builder/build_scripts/build-rust.sh

@@ -13,25 +13,29 @@ source "${MY_DIR}/build_utils.sh"
 
 # Install a more recent Rust
 check_var "${RUST_VERSION}"
-check_var "${RUST_HASH}"
 check_var "${RUST_DOWNLOAD_URL}"
 
 PREFIX=/opt/_internal/rust-${RUST_VERSION}
 
-# Download and verify rustup-init
+# Download and verify rustup-init (per-arch binary with per-arch hash)
 RUSTUP_INIT="rustup-init"
 if [ "${AUDITWHEEL_ARCH}" == "x86_64" ]; then
     RUSTUP_ARCH="x86_64-unknown-linux-gnu"
+    RUST_HASH="${RUST_HASH_x86_64}"
 elif [ "${AUDITWHEEL_ARCH}" == "aarch64" ]; then
     RUSTUP_ARCH="aarch64-unknown-linux-gnu"
+    RUST_HASH="${RUST_HASH_aarch64}"
 elif [ "${AUDITWHEEL_ARCH}" == "i686" ]; then
     RUSTUP_ARCH="i686-unknown-linux-gnu"
+    RUST_HASH="${RUST_HASH_i686}"
 elif [ "${AUDITWHEEL_ARCH}" == "armv7l" ]; then
     RUSTUP_ARCH="armv7-unknown-linux-gnueabihf"
+    RUST_HASH="${RUST_HASH_armv7l}"
 else
     echo "Unsupported architecture: ${AUDITWHEEL_ARCH}"
     exit 1
 fi
+check_var "${RUST_HASH}"
 
 fetch_source "${RUSTUP_INIT}" "${RUST_DOWNLOAD_URL}/${RUSTUP_ARCH}"
 check_sha256sum "${RUSTUP_INIT}" "${RUST_HASH}"

builder/build_scripts/build_utils.sh

@@ -14,6 +14,11 @@ export BASE_POLICY=manylinux
 PACKAGE_MANAGER=dnf
 OS_ID_LIKE=rhel
 
+# Auto-detect architecture when not explicitly set (multi-arch builds)
+: "${AUDITWHEEL_ARCH:=$(uname -m)}"
+AUDITWHEEL_PLAT="${AUDITWHEEL_POLICY}_${AUDITWHEEL_ARCH}"
+export AUDITWHEEL_ARCH AUDITWHEEL_PLAT
+
 function check_var {
 	if [ -z "$1" ]; then
 		echo "required variable not defined"

builder/manylinux-entrypoint

@@ -2,6 +2,11 @@
 
 set -eu
 
+# Auto-detect architecture when not explicitly set (multi-arch builds)
+: "${AUDITWHEEL_ARCH:=$(uname -m)}"
+AUDITWHEEL_PLAT="${AUDITWHEEL_POLICY}_${AUDITWHEEL_ARCH}"
+export AUDITWHEEL_ARCH AUDITWHEEL_PLAT
+
 if [ "${AUDITWHEEL_ARCH}" == "i686" ] && [ "$(uname -m)" == "x86_64" ]; then
 	linux32 "$@"
 elif [ "${AUDITWHEEL_ARCH}" == "armv7l" ] && [ "$(uname -m)" != "armv7l" ]; then

builder/scripts/build-wheels

@@ -83,6 +83,10 @@ if [ "${DEBUG:-}" = "1" ]; then
     set -x
 fi
 
+# Auto-detect architecture for wheel platform matching
+: "${AUDITWHEEL_ARCH:=$(uname -m)}"
+NATIVE_WHL_GLOB="linux_${AUDITWHEEL_ARCH}"
+
 # Logging function with timestamp
 log() {
     echo "[$(date --utc -Ins)] $1" >&2
@@ -169,18 +173,18 @@ for PACKAGE in "${PACKAGES[@]}"; do
     # check for manylinux wheels
     log "Checking for manylinux wheels in need of auditwheel repair"
 
-    if [ -n "$(find wheels-repo/downloads -name '*linux_x86_64.whl' | head -1)" ]; then
+    if [ -n "$(find wheels-repo/downloads -name "*${NATIVE_WHL_GLOB}.whl" | head -1)" ]; then
         log manylinux wheels have been found, auditwheel step required
 
         # Extract shared libraries from wheels so auditwheel can find
         # wheel-internal libs (e.g. pyre's libjournal.so) during repair.
         wheel_libs_dir=$(mktemp -d)
-        for whl in wheels-repo/downloads/*linux_x86_64.whl; do
+        for whl in wheels-repo/downloads/*${NATIVE_WHL_GLOB}.whl; do
             unzip -joq "$whl" '*.so' '*.so.*' -d "$wheel_libs_dir" 2>/dev/null || true
         done
         export LD_LIBRARY_PATH="${wheel_libs_dir}${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
 
-        auditwheel repair wheels-repo/downloads/*linux_x86_64.whl -w wheels-repo/downloads
+        auditwheel repair wheels-repo/downloads/*${NATIVE_WHL_GLOB}.whl -w wheels-repo/downloads
         rm -rf "$wheel_libs_dir"
 
         # auditwheel >= 6.5 embeds CycloneDX SBOMs in repaired wheels by default.
@@ -217,7 +221,7 @@ for PACKAGE in "${PACKAGES[@]}"; do
     # Patch Fromager SBOMs with PURL identifying the wheel and its origin index.
     # Must run after auditwheel repair since the final filename isn't known until then.
     log "Patching Fromager SBOMs: adding PURL and renaming to redhat.spdx.json"
-    # Only patch pure-python and manylinux wheels (skip original linux_x86_64
+    # Only patch pure-python and manylinux wheels (skip original native linux
     # wheels since auditwheel already produced their manylinux replacements).
     for whl in wheels-repo/downloads/*none-any.whl wheels-repo/downloads/*manylinux*.whl; do
         [ -f "$whl" ] || continue