coraza-spoa: multi-arch (amd64+arm64) via cross-compile + by-digest index assembly #17

2026-11-12T00:44:33Z

jknapp commented

2026-11-12 00:44:33 +00:00

Task T2 of the WHP multi-arch image plan (docs/arm64/IMAGE-PIPELINE-PLAN.md 4.1/4.4/5).

What

coraza-spoa/Dockerfile: both Go stages --platform=$BUILDPLATFORM; GOOS/GOARCH from TARGETOS/TARGETARCH (CGO was already off). No QEMU. Final distroless stage per target platform.
.gitea/workflows/build-push-coraza.yaml: one job on the trusted x86 runner; amd64 and arm64 pushed BY DIGEST (untagged) to Gitea and GHCR; arm64 step continue-on-error; tag assembled by scripts/assemble-multiarch-index.sh. QEMU setup step removed (not needed). Write credentials stay on this x86 job.
scripts/assemble-multiarch-index.sh (+ test-assemble-multiarch-index.py, 12 offline tests): arm64 is attached only when THIS run's arm64 step outcome is success, its digest is well formed and inspects as arm64; otherwise the tag is amd64-only; a bad amd64 digest publishes nothing.
scripts/e2e-coraza-multiarch.sh: local rehearsal against throwaway registries.

Verified locally (throwaway registries, nothing real touched)

amd64 rootfs and /coraza-spoa sha256 identical to a build of main.
Index from the two digests lists linux/amd64 + linux/arm64 (+ one attestation manifest each), same digest in both registries.
arm64 binary is AArch64 ELF and starts under qemu.
Forced arm64 failure with a stale arm64 digest in hand yields an amd64-only tag.
Provenance attestations survive imagetools create.

NOT verified

The real workflow (Gitea runner, build-push-action outputs: digest output, real Gitea/GHCR auth and untagged-manifest handling) has never run. See the PR comments / task report for a safe first-run plan.

Triggers: build-push-coraza runs on push to main (paths coraza-spoa/**, the workflow, the assemble script) and workflow_dispatch; nothing runs from this branch.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com

🤖 Generated with Claude Code

https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

Task T2 of the WHP multi-arch image plan (docs/arm64/IMAGE-PIPELINE-PLAN.md 4.1/4.4/5). ## What - `coraza-spoa/Dockerfile`: both Go stages `--platform=$BUILDPLATFORM`; `GOOS/GOARCH` from `TARGETOS/TARGETARCH` (CGO was already off). No QEMU. Final distroless stage per target platform. - `.gitea/workflows/build-push-coraza.yaml`: one job on the trusted x86 runner; amd64 and arm64 pushed BY DIGEST (untagged) to Gitea and GHCR; arm64 step `continue-on-error`; tag assembled by `scripts/assemble-multiarch-index.sh`. QEMU setup step removed (not needed). Write credentials stay on this x86 job. - `scripts/assemble-multiarch-index.sh` (+ `test-assemble-multiarch-index.py`, 12 offline tests): arm64 is attached only when THIS run's arm64 step outcome is `success`, its digest is well formed and inspects as arm64; otherwise the tag is amd64-only; a bad amd64 digest publishes nothing. - `scripts/e2e-coraza-multiarch.sh`: local rehearsal against throwaway registries. ## Verified locally (throwaway registries, nothing real touched) - amd64 rootfs and `/coraza-spoa` sha256 identical to a build of main. - Index from the two digests lists linux/amd64 + linux/arm64 (+ one attestation manifest each), same digest in both registries. - arm64 binary is AArch64 ELF and starts under qemu. - Forced arm64 failure with a stale arm64 digest in hand yields an amd64-only tag. - Provenance attestations survive `imagetools create`. ## NOT verified The real workflow (Gitea runner, build-push-action `outputs:` digest output, real Gitea/GHCR auth and untagged-manifest handling) has never run. See the PR comments / task report for a safe first-run plan. Triggers: build-push-coraza runs on push to main (paths coraza-spoa/**, the workflow, the assemble script) and workflow_dispatch; nothing runs from this branch. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

jknapp added 1 commit 2026-11-12 00:44:33 +00:00

coraza-spoa: multi-arch (amd64+arm64) by cross-compiling; push-by-digest + imagetools index a476bb5352

Dockerfile: Go stages pinned to $BUILDPLATFORM, GOOS/GOARCH from TARGETOS/
TARGETARCH (CGO already off); amd64 rootfs/binary byte-identical to before.
Workflow: one trusted x86 job, amd64 + arm64 pushed untagged by digest to both
registries, arm64 continue-on-error, tag assembled by
scripts/assemble-multiarch-index.sh (arm64 only from this run's successful
step; otherwise amd64-only). Offline test + local e2e rehearsal script.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

jknapp merged commit 3616fa409f into main

2026-11-12 01:15:32 +00:00

jknapp deleted branch feat/coraza-spoa-multiarch

2026-11-12 01:15:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/haproxy-manager-base#17