Use static libraries from built image

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>

Author: Paulo Gomes

.github/actions/run-tests/Dockerfile

@@ -27,6 +27,8 @@ jobs:
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
+      - name: Run tests
+        run: make test
       - name: Setup Kubernetes
         uses: engineerd/setup-kind@v0.5.0
         with:
@@ -36,11 +38,6 @@ jobs:
         uses: fluxcd/pkg/actions/kustomize@main
       - name: Setup Helm
         uses: fluxcd/pkg/actions/helm@main
-      - name: Run tests
-        uses: ./.github/actions/run-tests
-        env:
-          GOROOT:
-          GOPATH: /github/home/go
       - name: Verify
         run: make verify
       - name: Run E2E tests
@@ -59,6 +56,8 @@ jobs:
         uses: actions/setup-go@v2
         with:
           go-version: 1.17.x
+      - name: Run tests
+        run: make test
       - name: Prepare
         id: prep
         run: |

.github/actions/run-tests/action.yml

@@ -2,14 +2,27 @@ ARG BASE_VARIANT=alpine
 ARG GO_VERSION=1.17
 ARG XX_VERSION=1.1.0
 
-ARG LIBGIT2_IMG=ghcr.io/fluxcd/golang-with-libgit2
-ARG LIBGIT2_TAG=libgit2-1.1.1-4
+ARG LIBGIT2_IMG
+ARG LIBGIT2_TAG
 
-FROM --platform=linux/amd64 ${LIBGIT2_IMG}:${LIBGIT2_TAG} as build-amd64
-FROM --platform=linux/arm64 ${LIBGIT2_IMG}:${LIBGIT2_TAG} as build-arm64
-FROM --platform=linux/arm/v7 ${LIBGIT2_IMG}:${LIBGIT2_TAG} as build-armv7
+FROM ${LIBGIT2_IMG}:${LIBGIT2_TAG} AS libgit2-libs
 
-FROM --platform=$BUILDPLATFORM build-$TARGETARCH$TARGETVARIANT AS build
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-${BASE_VARIANT} as gostable
+
+FROM gostable AS go-linux
+
+# Build-base consists of build platform dependencies and xx.
+# These will be used at current arch to yield execute the cross compilations.
+FROM go-${TARGETOS} AS build-base
+
+RUN apk add --no-cache clang lld pkgconfig
+
+COPY --from=xx / /
+
+# build-go-mod can still be cached at build platform architecture.
+FROM build-base as build-go-mod
 
 # Configure workspace
 WORKDIR /workspace
@@ -24,26 +37,35 @@ COPY go.sum go.sum
 # Cache modules
 RUN go mod download
 
-RUN apk add clang lld pkgconfig ca-certificates
+# Build stage install per target platform
+# dependency and effectively cross compile the application.
+FROM build-go-mod as build
 
-# Build the binary
-ENV CGO_ENABLED=1
 ARG TARGETPLATFORM
 
+COPY --from=libgit2-libs /usr/local/ /usr/local/
+
+# Some dependencies have to installed 
+# for the target platform: https://github.com/tonistiigi/xx#go--cgo
 RUN xx-apk add --no-cache \
         musl-dev gcc lld binutils-gold
 
-# Performance related changes:
-# - Use read-only bind instead of copying go source files.
-# - Cache go packages.
-RUN --mount=target=. \
-    --mount=type=cache,target=/root/.cache/go-build \
-    --mount=type=cache,target=/go/pkg \
-    export LIBRARY_PATH="/usr/local/$(xx-info triple)/lib:/usr/local/$(xx-info triple)/lib64:${LIBRARY_PATH}" && \
+RUN xx-apk add --no-cache musl-utils
+
+WORKDIR /workspace
+
+# Copy source code
+COPY main.go main.go
+COPY controllers/ controllers/
+COPY pkg/ pkg/
+COPY internal/ internal/
+
+ENV CGO_ENABLED=1
+RUN export LIBRARY_PATH="/usr/local/$(xx-info triple):/usr/local/$(xx-info triple)/lib64" && \
     export PKG_CONFIG_PATH="/usr/local/$(xx-info triple)/lib/pkgconfig:/usr/local/$(xx-info triple)/lib64/pkgconfig" && \
-	export FLAGS="$(pkg-config --static --libs --cflags libssh2 openssl libgit2)" && \
-    CGO_LDFLAGS="${FLAGS} -static" \
-	xx-go build \
+    export FLAGS="$(pkg-config --static --libs --cflags libssh2 openssl libgit2)" && \
+    export CGO_LDFLAGS="${FLAGS} -static" && \
+    xx-go build  \
         -ldflags "-s -w" \
         -tags 'netgo,osusergo,static_build' \
         -o /source-controller -trimpath main.go;

.github/workflows/e2e.yaml

@@ -18,33 +18,36 @@ CRD_OPTIONS ?= crd:crdVersions=v1
 # Repository root based on Git metadata
 REPOSITORY_ROOT := $(shell git rev-parse --show-toplevel)
 
-# Libgit2 version
-LIBGIT2_VERSION ?= 1.1.1
-
 # Other dependency versions
 ENVTEST_BIN_VERSION ?= 1.19.2
 
-# libgit2 related magical paths
-# These are used to determine if the target libgit2 version is already available on
-# the system, or where they should be installed to
-SYSTEM_LIBGIT2_VERSION := $(shell pkg-config --modversion libgit2 2>/dev/null)
-LIBGIT2_PATH := $(REPOSITORY_ROOT)/hack/libgit2
+# Caches libgit2 versions per tag, "forcing" rebuild only when needed.
+LIBGIT2_PATH := $(REPOSITORY_ROOT)/build/libgit2/$(LIBGIT2_TAG)
 LIBGIT2_LIB_PATH := $(LIBGIT2_PATH)/lib
-LIBGIT2 := $(LIBGIT2_LIB_PATH)/libgit2.so.$(LIBGIT2_VERSION)
+LIBGIT2_LIB64_PATH := $(LIBGIT2_PATH)/lib64
+LIBGIT2 := $(LIBGIT2_LIB_PATH)/libgit2.a
+MUSL-CC =
 
-ifneq ($(LIBGIT2_VERSION),$(SYSTEM_LIBGIT2_VERSION))
-	LIBGIT2_FORCE ?= 1
-endif
+export CGO_ENABLED=1
+export PKG_CONFIG_PATH=$(LIBGIT2_LIB_PATH)/pkgconfig:$(LIBGIT2_LIB64_PATH)/pkgconfig
+export LD_LIBRARY_PATH=$(LIBGIT2_LIB_PATH):$(LIBGIT2_LIB64_PATH)
+export CGO_CFLAGS=-I$(LIBGIT2_PATH)/include -I$(LIBGIT2_PATH)/include/openssl
 
 ifeq ($(shell uname -s),Darwin)
-	LIBGIT2 := $(LIBGIT2_LIB_PATH)/libgit2.$(LIBGIT2_VERSION).dylib
-	HAS_BREW := $(shell brew --version 2>/dev/null)
-ifdef HAS_BREW
-	HAS_OPENSSL := $(shell brew --prefix openssl@1.1)
-endif
+	export CGO_LDFLAGS=-L$(LIBGIT2_LIB_PATH) -lssh2 -lssl -lcrypto -lgit2
+else
+	export CGO_LDFLAGS=$(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --libs --static --cflags libssh2 openssl libgit2)
 endif
 
 
+ifeq ($(shell uname -s),Linux)
+	MUSL-PREFIX=$(REPOSITORY_ROOT)/build/musl/$(shell uname -m)-linux-musl-native/bin/$(shell uname -m)-linux-musl
+	MUSL-CC=$(MUSL-PREFIX)-gcc
+	export CC=$(MUSL-PREFIX)-gcc
+	export CXX=$(MUSL-PREFIX)-g++
+	export AR=$(MUSL-PREFIX)-ar
+endif
+
 # API (doc) generation utilities
 CONTROLLER_GEN_VERSION ?= v0.7.0
 GEN_API_REF_DOCS_VERSION ?= v0.3.0
@@ -56,59 +59,32 @@ else
 GOBIN=$(shell go env GOBIN)
 endif
 
-ifeq ($(strip ${PKG_CONFIG_PATH}),)
-	MAKE_PKG_CONFIG_PATH = $(LIBGIT2_LIB_PATH)/pkgconfig
-else
-	MAKE_PKG_CONFIG_PATH = ${PKG_CONFIG_PATH}:$(LIBGIT2_LIB_PATH)/pkgconfig
-endif
-
-ifdef HAS_OPENSSL
-	MAKE_PKG_CONFIG_PATH := $(MAKE_PKG_CONFIG_PATH):$(HAS_OPENSSL)/lib/pkgconfig
-endif
 
 # Architecture to use envtest with
+ifeq ($(shell uname -m),x86_64)
 ENVTEST_ARCH ?= amd64
+else
+ENVTEST_ARCH ?= arm64
+endif
 
 all: build
 
 build: $(LIBGIT2) ## Build manager binary
-ifeq ($(shell uname -s),Darwin)
-	PKG_CONFIG_PATH=$(MAKE_PKG_CONFIG_PATH) \
-	CGO_LDFLAGS="-Wl,-rpath,$(LIBGIT2_LIB_PATH)" \
 	go build -o bin/manager main.go
-else
-	PKG_CONFIG_PATH=$(MAKE_PKG_CONFIG_PATH) \
-	go build -o bin/manager main.go
-endif
 
 KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)"
 test: $(LIBGIT2) install-envtest test-api  ## Run tests
-ifeq ($(shell uname -s),Darwin)
-	LD_LIBRARY_PATH=$(LIBGIT2_LIB_PATH) \
-	PKG_CONFIG_PATH=$(MAKE_PKG_CONFIG_PATH) \
-	CGO_LDFLAGS="-Wl,-rpath,$(LIBGIT2_LIB_PATH)" \
 	KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) \
-	go test ./... -coverprofile cover.out
-else
-	LD_LIBRARY_PATH=$(LIBGIT2_LIB_PATH) \
-	PKG_CONFIG_PATH=$(MAKE_PKG_CONFIG_PATH) \
-	KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) \
-	go test ./... -coverprofile cover.out
-endif
+	go test ./... \
+		-ldflags "-s -w" \
+		-coverprofile cover.out \
+	 	-tags 'netgo,osusergo,static_build'
 
 test-api: ## Run api tests
 	cd api; go test ./... -coverprofile cover.out
 
 run: $(LIBGIT2) generate fmt vet manifests  ## Run against the configured Kubernetes cluster in ~/.kube/config
-ifeq ($(shell uname -s),Darwin)
-	LD_LIBRARY_PATH=$(LIBGIT2_LIB_PATH) \
-	CGO_LDFLAGS="-Wl,-rpath,$(LIBGIT2_LIB_PATH)" \
 	go run ./main.go
-else
-	LD_LIBRARY_PATH=$(LIBGIT2_LIB_PATH) \
-	go run ./main.go
-endif
-
 
 install: manifests  ## Install CRDs into a cluster
 	kustomize build config/crd | kubectl apply -f -
@@ -142,16 +118,8 @@ fmt:  ## Run go fmt against code
 	cd api; go fmt ./...
 
 vet: $(LIBGIT2)	## Run go vet against code
-ifeq ($(shell uname -s),Darwin)
-	PKG_CONFIG_PATH=$(MAKE_PKG_CONFIG_PATH) \
-	CGO_LDFLAGS="-Wl,-rpath,$(LIBGIT2_LIB_PATH)" \
-	go vet ./...
-	cd api; go vet ./...
-else
-	PKG_CONFIG_PATH=$(MAKE_PKG_CONFIG_PATH) \
 	go vet ./...
 	cd api; go vet ./...
-endif
 
 generate: controller-gen  ## Generate API code
 	cd api; $(CONTROLLER_GEN) object:headerFile="../hack/boilerplate.go.txt" paths="./..."
@@ -192,14 +160,12 @@ install-envtest: setup-envtest ## Download envtest binaries locally.
 
 libgit2: $(LIBGIT2)  ## Detect or download libgit2 library
 
-$(LIBGIT2):
-ifeq (1, $(LIBGIT2_FORCE))
-	@{ \
-	set -e; \
-	mkdir -p $(LIBGIT2_PATH); \
-	curl -sL https://raw.githubusercontent.com/fluxcd/golang-with-libgit2/$(LIBGIT2_TAG)/hack/Makefile -o $(LIBGIT2_PATH)/Makefile; \
-	INSTALL_PREFIX=$(LIBGIT2_PATH) make -C $(LIBGIT2_PATH) libgit2; \
-	}
+$(LIBGIT2): $(MUSL-CC)
+	IMG=$(LIBGIT2_IMG) TAG=$(LIBGIT2_TAG) ./hack/install-libraries.sh
+
+$(MUSL-CC):
+ifneq ($(shell uname -s),Darwin)
+	./hack/download-musl.sh
 endif
 
 .PHONY: help

Dockerfile

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+set -eoux pipefail
+
+MUSL_X86_64_FILENAME=x86_64-linux-musl-native.tgz
+MUSL_X86_64_SHA512=44d441ad9aa11a06feddf3daa4c9f53ad7d9ca37af1f5a61379aca07793703d179410cea723c1b7fca94c4de19a321228bdb3656bc5cbdb5e3bea8e2d6dac6c7
+MUSL_AARCH64_FILENAME=aarch64-linux-musl-native.tgz
+MUSL_AARCH64_SHA512=16d544e09845c9dbba50f29e0cb04dd661e17eb63c56acad6a67fd2a78aa7596b792477c7177d3cd56d408a27dc291a90507df882f2b099c0f25511ce08fd3b5
+
+MUSL_FILENAME="${MUSL_X86_64_FILENAME}"
+MUSL_SHA512="${MUSL_X86_64_SHA512}"
+if [ "$(uname -m)" = "arm64" ] || [ "$(uname -m)" = "aarch64" ]; then
+    MUSL_FILENAME="${MUSL_AARCH64_FILENAME}"
+    MUSL_SHA512="${MUSL_AARCH64_SHA512}"
+fi
+
+MUSL_AARCH64_URL="https://more.musl.cc/11.2.1/x86_64-linux-musl/${MUSL_FILENAME}"
+
+ROOT_DIR="$(git rev-parse --show-toplevel)"
+MUSL_DIR="${ROOT_DIR}/build/musl"
+
+if [ ! -f "${MUSL_DIR}/bin" ]; then
+    TARGET_FILE="${MUSL_DIR}/${MUSL_FILENAME}"
+    mkdir -p "${MUSL_DIR}"
+
+    echo "${MUSL_SHA512}  ${TARGET_FILE}"
+    curl -o "${TARGET_FILE}" -LO "${MUSL_AARCH64_URL}"
+    if ! echo "${MUSL_SHA512}  ${TARGET_FILE}" | sha512sum --check; then
+        echo "Checksum failed for ${MUSL_FILENAME}."
+        rm -rf "${MUSL_DIR}"
+        exit 1
+    fi
+
+    tar xzf "${TARGET_FILE}" -C "${MUSL_DIR}"
+    rm "${TARGET_FILE}"
+fi