# syntax=docker/dockerfile:1

FROM --platform=$BUILDPLATFORM centos:7 AS centos-devtoolset

ARG BUILDARCH
ARG DEVTOOLSET

# devtoolset-12 is only in CentOS buildlogs. The rpms are unsigned since they never were
# published to the official CentOS SCL repos.
RUN if [ "${BUILDARCH}" = "arm64" ]; then export BUILDARCH="aarch64"; fi && \
    if [ "${BUILDARCH}" = "amd64" ]; then export BUILDARCH="x86_64"; fi && \
    printf '%s\n' \
    "[${DEVTOOLSET}-build]" \
    "name=${DEVTOOLSET} - Build" \
    "baseurl=https://buildlogs.centos.org/c7-${DEVTOOLSET}.${BUILDARCH}/" \
    "gpgcheck=0" \
    "enabled=1" \
    > /etc/yum.repos.d/${DEVTOOLSET}-build.repo

# mirrorlist is no longer available since CentOS 7 EOL. The software collection
# stuff for arm64 (aarch64) is in /altarch not /centos on vault.centos.org.
# Make the fixup a script as it needs to be run multiple times as installing
# and updating centos-release-scl-rh leaves the old unavailable URLs.
# https://serverfault.com/a/1161847
#
# vault.centos.org is rate limited and starts answering 403 once a build asks
# for too much too quickly, so fan every vault baseurl out over a set of
# mirrors carrying an identical copy of the vault tree.
RUN printf '%s\n' \
    '#!/bin/sh' \
    "sed -e 's/mirror.centos.org/vault.centos.org/g' \\" \
    "    -e 's/^#.*baseurl=http/baseurl=https/g' \\" \
    "    -e 's|^baseurl=http://vault.centos.org|baseurl=https://vault.centos.org|g' \\" \
    "    -e 's/^mirrorlist=http/#mirrorlist=http/g' \\" \
    "    -i /etc/yum.repos.d/*.repo" \
    "if [ \"\$(uname -m)\" = 'aarch64' ]; then" \
    "    sed 's|centos/7/sclo|altarch/7/sclo|g' -i /etc/yum.repos.d/*.repo" \
    'fi' \
    "sed -e 's|^\\(baseurl=https://vault.centos.org/[^ ]*\\).*|\\1|' \\" \
    "    -e 's|^baseurl=https://vault.centos.org/\\(.*\\)|& https://archive.kernel.org/centos-vault/\\1 https://linuxsoft.cern.ch/centos-vault/\\1 https://mirror.nsc.liu.se/centos-store/\\1|' \\" \
    "    -i /etc/yum.repos.d/*.repo" \
    > /tmp/fix-yum-repo-list.sh
RUN chmod 755 /tmp/fix-yum-repo-list.sh && \
    /tmp/fix-yum-repo-list.sh

# Keep downloaded metadata and rpms so the BuildKit cache mounts below can be
# shared between stages, and stop yum expiring metadata that can no longer
# change (CentOS 7 is EOL and the vault trees are frozen).
# Without this, every stage deriving from `base` re-downloads the full repodata
# set, and since BuildKit runs those stages in parallel the burst trips the AWS
# WAF rate limit in front of vault.centos.org, which answers with a 403.
RUN sed -i -e '/^keepcache=/d' -e '/^metadata_expire=/d' /etc/yum.conf && \
    printf '%s\n' 'keepcache=1' 'metadata_expire=never' >> /etc/yum.conf

# Install required dependencies.
RUN --mount=type=cache,id=centos7-yum,target=/var/cache/yum,sharing=locked \
    yum groupinstall -y 'Development Tools' && \
    yum install -y epel-release && \
    yum install -y centos-release-scl-rh && \
    /tmp/fix-yum-repo-list.sh && \
    yum update -y && \
    yum install -y \
    centos-release-scl \
    cmake3 \
    git \
    scl-utils && \
    /tmp/fix-yum-repo-list.sh

# As mentioned above, these packages are unsigned.
RUN --mount=type=cache,id=centos7-yum,target=/var/cache/yum,sharing=locked \
    yum install --nogpgcheck -y \
        ${DEVTOOLSET}-gcc \
        ${DEVTOOLSET}-gcc-c++ \
        ${DEVTOOLSET}-make

## NINJA-BUILD ###################################################################

## ninja-build is required for building boringssl. The version included in CentOS 7 AMR64
## is too old, so we need to build it from source.
FROM --platform=$BUILDPLATFORM centos-devtoolset AS ninja-build

# Install additional required dependencies.
RUN --mount=type=cache,id=centos7-yum,target=/var/cache/yum,sharing=locked \
    yum install -y expat-devel \
        gettext \
        libcurl-devel \
        openssl-devel \
        pcre-devel \
        xmlto \
        zlib-devel

# mno-outline-atomics flag is needed to make the build works on ARM64 docker.
RUN git clone --depth=1 https://github.com/Kitware/CMake.git -b v3.28.1 && \
    cd CMake && \
    [ "$(git rev-parse HEAD)" = '1eed682d7cca9bb2c2b0709a6c3202a3b08613b2' ] && \
    scl enable ${DEVTOOLSET} "if [ "${BUILDARCH}" = "arm64" ]; then export CFLAGS=-mno-outline-atomics; fi &&  ./bootstrap --parallel="$(nproc)" && make -j"$(nproc)" && make install"

ENV PATH="/opt/cmake/bin:$PATH"

RUN git clone --depth=1 https://github.com/ninja-build/ninja.git -b v1.11.1 && \
    cd ninja && \
    [ "$(git rev-parse HEAD)" = 'a524bf3f6bacd1b4ad85d719eed2737d8562f27a' ] && \
    scl enable ${DEVTOOLSET} "cmake -Bbuild-cmake && \
    cmake --build build-cmake -j"$(nproc)" && \
    cmake --build build-cmake --target  install"

# Use just created devtool image with newer GCC and Cmake
FROM --platform=$BUILDPLATFORM centos-devtoolset as clang12

ARG DEVTOOLSET

# Compile Clang 12.0.0 from source. It is needed to create BoringSSL and BPF files.
# CentOS 7 doesn't provide it as a package unfortunately.
# This version of Clang is explicitly required for FIPS compliance when building BoringSSL.
# For more information please refer to the section 12. Guidance and Secure Operation of:
# TODO(reed) -- fill in URL
# LLVM_INCLUDE_BENCHMARKS must be off, otherwise compilation fails,
# CLANG_BUILD_TOOLS must be on, it builds clang binary,
# LLVM_BUILD_TOOLS must be on, it builds llvm-strip binary.
# the rest is disabled to speedup the compilation.
RUN git clone --branch llvmorg-12.0.0 --depth=1 https://github.com/llvm/llvm-project.git && \
    cd llvm-project/ && \
    [ "$(git rev-parse HEAD)" = 'd28af7c654d8db0b68c175db5ce212d74fb5e9bc' ] && \
    mkdir build && cd build/ && \
    scl enable ${DEVTOOLSET} 'bash -c "cmake3 \
    -DCMAKE_BUILD_TYPE=Release \
    -DCMAKE_INSTALL_PREFIX=/opt/llvm \
    -DLLVM_ENABLE_PROJECTS=clang \
    -DLLVM_BUILD_TOOLS=ON \
    -G \"Unix Makefiles\" ../llvm && \
    make -j$(grep -c processor /proc/cpuinfo) install-llvm-strip install-clang-format install-clang install-clang-resource-headers install-libclang"' && \
    cd ../.. && \
    rm -rf llvm-project

# Build custom packages with -fPIC for use with other dependencies.
FROM centos-devtoolset as custom-packages

# Create mockbuild user/group for building.
RUN useradd --user-group --create-home --shell=/bin/bash mockbuild

# Recompile and install libelf with -fPIC.
RUN mkdir -p /opt/custom-packages && cd /opt && \
    yumdownloader --source elfutils-libelf-devel-static && \
    yum-builddep -y elfutils-libelf-devel-static && \
    export DIST=$(rpm -qp --queryformat '%{RELEASE}' elfutils-*.src.rpm | cut -d '.' -f 2) && \
    rpmbuild --rebuild --nocheck --define "optflags `rpm -E %{optflags}` -fPIC" --define "dist .${DIST}" elfutils-*.src.rpm && \
    if [ "${BUILDARCH}" = "arm64" ]; then export BUILDARCH="aarch64"; fi && \
    cp /root/rpmbuild/RPMS/${BUILDARCH}/elfutils-libelf-devel-static-*${DIST}.${BUILDARCH}.rpm /opt/custom-packages/

# Recompile and install zlib with -fPIC.
RUN mkdir -p /opt/custom-packages && cd /opt && \
    yumdownloader --source zlib-static && \
    yum-builddep -y zlib-static && \
    export DIST=$(rpm -qp --queryformat '%{RELEASE}' zlib-*.src.rpm | cut -d '.' -f 2) && \
    rpmbuild --rebuild --define "optflags `rpm -E %{optflags}` -fPIC" --define "dist .${DIST}" zlib-*.src.rpm && \
    if [ "${BUILDARCH}" = "arm64" ]; then export BUILDARCH="aarch64"; fi && \
    cp /root/rpmbuild/RPMS/${BUILDARCH}/zlib-static-*${DIST}.${BUILDARCH}.rpm /opt/custom-packages/

# Create the final image with Clang and custom builds only. We're using this Docker image as a tar.gz
# mainly because we want to keep our artifacts on GitHub, and GH doesn't support blobs, only Docker images.
FROM scratch AS buildbox-centos7-assets

# Copy Clang into the final image.
COPY --from=clang12 /opt/llvm /opt/llvm/

# Copy ninja into the final image.
COPY --from=ninja-build /usr/local/bin/ninja /usr/local/bin/ninja

# Copy custom packages into the final image.
COPY --from=custom-packages /opt/custom-packages /opt/custom-packages/