neiam /gitgud

Git Gud

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

Fix the CLI package build: trust store on EL9, rustfmt in the image

e5ef8e4 · Gabriel Morell · 2026-09-19 00:12

3 files +26 -6

Message

{commit_body(@commit)}

Files changed

modified .gitignore

+3 −0

@@ -76,3 +76,6 @@ npm-debug.log

76	76	*.jks
77	77	*.keystore
78	78	keystore.pass
	79	+
	80	+# Packages built by cli/Dockerfile, in CI and by hand.
	81	+/cli-dist/

modified cli/Dockerfile

+23 −6

@@ -44,9 +44,12 @@ FROM docker.io/rust:${RUST_VERSION}-trixie AS deb-builder

44	44	# dependency resolution shells out to. Without it the package would
45	45	# declare no libc dependency at all — quietly, which is why the build
46	46	# checks for one before it finishes.
	47	+# The rust images carry a minimal toolchain, so the two components the
	48	+# check step needs are added explicitly rather than assumed.
47	49	RUN apt-get update \
48	50	&& apt-get install -y --no-install-recommends cmake perl pkg-config dpkg-dev \
49	51	&& rm -rf /var/lib/apt/lists/* \
	52	+ && rustup component add rustfmt clippy \
50	53	&& cargo install --locked cargo-deb
51	54
52	55	WORKDIR /src/cli

@@ -104,12 +107,26 @@ ARG RUST_VERSION

104	107	ENV RUSTUP_HOME=/usr/local/rustup \
105	108	CARGO_HOME=/usr/local/cargo \
106	109	PATH=/usr/local/cargo/bin:${PATH}
107		−RUN dnf -y install gcc gcc-c++ make cmake perl \
108		− && dnf clean all \
109		− && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
110		− \| sh -s -- -y --no-modify-path --profile minimal --default-toolchain ${RUST_VERSION} \
111		− && rustc --version && cargo --version \
112		− && cargo install --locked cargo-generate-rpm
	110	+# `ca-certificates` and the extract, because the base image's
	111	+# /etc/pki/tls/certs/ca-bundle.crt is a symlink with nothing behind it
	112	+# until something runs update-ca-trust — curl fails with "error setting
	113	+# certificate file" and dnf, which carries its own trust, doesn't.
	114	+#
	115	+# rustup is downloaded and then run, rather than piped into sh: a
	116	+# pipeline reports the exit status of its LAST command, so a curl that
	117	+# fails hands sh an empty script, sh succeeds, and the build dies three
	118	+# commands later on `rustc: command not found`.
	119	+RUN set -eux; \
	120	+ dnf -y install ca-certificates gcc gcc-c++ make cmake perl; \
	121	+ update-ca-trust extract; \
	122	+ dnf clean all; \
	123	+ curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs -o /tmp/rustup-init.sh; \
	124	+ sh /tmp/rustup-init.sh -y --no-modify-path --profile minimal \
	125	+ --default-toolchain "${RUST_VERSION}"; \
	126	+ rm /tmp/rustup-init.sh; \
	127	+ rustc --version; \
	128	+ cargo --version; \
	129	+ cargo install --locked cargo-generate-rpm
113	130
114	131	WORKDIR /src/cli
115	132

Parents: 1294137