static: add checksum files for package archives

.github/CODEOWNERS

@@ -4,5 +4,6 @@ pkg/model/*          @docker/ai-models-infra
 pkg/buildx/*         @docker/build
 pkg/agent/*          @docker/ai-agent-team
 pkg/containerd/*     @docker/engine
+pkg/docker/*         @docker/engine
 pkg/docker-cli/*     @docker/engine
 pkg/docker-engine/*  @docker/engine

.github/labeler.yml

@@ -35,11 +35,15 @@ area/pkg/credential-helpers:
 
 area/pkg/docker-cli:
   - changed-files:
-    - any-glob-to-any-file: 'pkg/docker-cli/**'
+    - any-glob-to-any-file:
+      - 'pkg/docker/**'
+      - 'pkg/docker-cli/**'
 
 area/pkg/docker-engine:
   - changed-files:
-    - any-glob-to-any-file: 'pkg/docker-engine/**'
+    - any-glob-to-any-file:
+      - 'pkg/docker/**'
+      - 'pkg/docker-engine/**'
 
 area/pkg/model:
   - changed-files:

.github/workflows/.build.yml

@@ -88,14 +88,15 @@ jobs:
               const includes = [];
               const verifications = [];
               for (const targetName of Object.keys(def.target)) {
-                if (!targetName.startsWith(`pkg-${inpName}-`)) {
-                  continue;
-                }
                 const match = targetName.match(/^pkg-(.+)-([^-]+)$/);
                 if (!match) {
                   throw new Error(`Invalid target name: ${targetName}`);
                 }
+                const pkgName = match[1];
                 const distro = match[2];
+                if (pkgName !== inpName) {
+                  continue;
+                }
                 if (distroFilter.length > 0 && !distroFilter.includes(distro)) {
                   core.info(`Skipping ${targetName} because it doesn't match the input distro filter`);
                   continue;
@@ -358,6 +359,22 @@ jobs:
             * commit: [\`${RUNHCS_COMMIT}\`](${RUNHCS_REPO}/commit/${RUNHCS_COMMIT})
           EOF
           fi
+
+          if [ "$INPUT_NAME" = "docker" ]; then
+            cat >> "/tmp/summary.txt" <<-EOF
+          * cli
+            * repo: ${CLI_REPO}
+            * ref: \`${CLI_REF}\`
+            * version: \`${CLI_VERSION}\`
+            * commit: [\`${CLI_COMMIT}\`](${CLI_REPO}/commit/${CLI_COMMIT})
+          * containerd
+            * repo: ${CONTAINERD_REPO}
+            * version: \`${CONTAINERD_VERSION}\`
+          * runc
+            * repo: ${RUNC_REPO}
+            * version: \`${RUNC_VERSION}\`
+          EOF
+          fi
 
           cat >> "/tmp/summary.txt" <<-EOF
           * packages: \`$(find /tmp/release -type f | wc -l)\` files

.github/workflows/build-docker.yml

@@ -16,6 +16,7 @@ on:
       - '.github/workflows/.build.yml'
       - '.github/workflows/build-docker.yml'
       - 'hack/scripts/**'
+      - 'pkg/docker/**'
       - 'pkg/docker-engine/**'
       - 'pkg/docker-cli/**'
       - 'docker-bake.hcl'
@@ -27,6 +28,7 @@ on:
       - '.github/workflows/.build.yml'
       - '.github/workflows/build-docker.yml'
       - 'hack/scripts/**'
+      - 'pkg/docker/**'
       - 'pkg/docker-engine/**'
       - 'pkg/docker-cli/**'
       - 'docker-bake.hcl'
@@ -47,3 +49,11 @@ jobs:
       id-token: write
     with:
       name: docker-cli
+
+  docker:
+    uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      name: docker

.github/workflows/release-docker.yml

@@ -93,3 +93,22 @@ jobs:
     secrets:
       rh_user: ${{ secrets.RH_USER }}
       rh_pass: ${{ secrets.RH_PASS }}
+
+  docker:
+    if: ${{ inputs.distros == '' || contains(inputs.distros, 'static') }}
+    uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: write # needed to create release and upload artifacts
+      id-token: write # needed to sign attestations
+    with:
+      name: docker
+      release: ${{ inputs.release }}
+      distros: ${{ inputs.distros }}
+      vars: |
+        PKG_REPO=${{ inputs.engine-repo }}
+        PKG_REF=${{ inputs.engine-ref }}
+        CLI_REPO=${{ inputs.cli-repo }}
+        CLI_REF=${{ inputs.cli-ref }}
+        DOCKER_VERSION=${{ inputs.version }}
+      dockerhub_username: docker
+      dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}

docker-bake.hcl

@@ -50,6 +50,7 @@ variable "PKGS_BASE" {
     "compose",
     "containerd",
     "credential-helpers",
+    "docker",
     "docker-cli",
     "docker-engine",
     "model",
@@ -79,6 +80,8 @@ variable "PKG_PLATFORMS_BASE" {
     containerd = ["linux/amd64", "linux/arm/v6", "linux/arm/v7", "linux/arm64", "linux/ppc64le", "linux/s390x", "windows/amd64", "windows/arm64"]
     # https://github.com/docker/docker-credential-helpers/blob/f9d3010165b642df37215b1be945552f2c6f0e3b/docker-bake.hcl#L56-L66
     credential-helpers = ["darwin/amd64", "darwin/arm64", "linux/amd64", "linux/arm/v6", "linux/arm/v7", "linux/arm64", "linux/ppc64le", "linux/s390x", "windows/amd64"]
+    # Combined Docker static archives include Engine and CLI, so this uses the Engine platform set.
+    docker = ["linux/amd64", "linux/arm/v6", "linux/arm/v7", "linux/arm64", "linux/ppc64le", "linux/s390x", "windows/amd64", "windows/arm64"]
     # https://github.com/docker/cli/blob/84038691220e7ba3329a177e4e3357b4ee0e3a52/docker-bake.hcl#L30-L42
     docker-cli = ["darwin/amd64", "darwin/arm64", "linux/386", "linux/amd64", "linux/arm/v6", "linux/arm/v7", "linux/arm64", "linux/ppc64le", "linux/riscv64", "linux/s390x", "windows/amd64", "windows/arm64"]
     # https://github.com/moby/moby/blob/83264918d3e1c61341511e360a7277150b914b3f/docker-bake.hcl#L82-L91
@@ -95,6 +98,13 @@ variable "PKG_PLATFORMS_EXTRA" {
   default = {}
 }
 
+variable "PKG_DISTROS" {
+  description = "Package-specific distro mapping. Packages omitted here build for all DISTROS."
+  default = {
+    docker = ["static"]
+  }
+}
+
 variable "PKG_CONTEXTS_EXTRA" {
   description = "Additional package context mapping to merge from an override bake definition."
   default = {}
@@ -174,6 +184,18 @@ variable "PKG_RPM_RELEASE" {
   default = null
 }
 
+variable "CLI_REPO" {
+  description = "Repository URL of the Docker CLI to build. Only used for the combined Docker static package."
+  default = null
+}
+variable "CLI_REF" {
+  description = "Reference (branch, tag, commit) of the Docker CLI to build. Only used for the combined Docker static package."
+  default = null
+}
+variable "DOCKER_VERSION" {
+  description = "Docker version to use for the combined Docker static package. If empty, the Engine source version is used."
+  default = null
+}
 variable "RUNC_REF" {
   description = "Reference (branch, tag, commit) of runc to build. Only used for containerd package. If not set, defaults to the version specified in containerd's script/setup/runc-version file."
   default = null
@@ -595,6 +617,20 @@ target "_pkg-credential-helpers" {
   }
 }
 
+target "_pkg-docker" {
+  args = {
+    PKG_NAME = PKG_NAME != null && PKG_NAME != "" ? PKG_NAME : "docker"
+    PKG_REPO = PKG_REPO != null && PKG_REPO != "" ? PKG_REPO : "https://github.com/docker/docker.git"
+    PKG_REF = PKG_REF != null && PKG_REF != "" ? PKG_REF : "master"
+    CLI_REPO = CLI_REPO != null && CLI_REPO != "" ? CLI_REPO : "https://github.com/docker/cli.git"
+    CLI_REF = CLI_REF != null && CLI_REF != "" ? CLI_REF : "master"
+    DOCKER_VERSION = DOCKER_VERSION
+    GO_VERSION = GO_VERSION != null && GO_VERSION != "" ? GO_VERSION : "1.26.5" # https://github.com/moby/moby/blob/master/Dockerfile
+    GO_IMAGE_VARIANT = GO_IMAGE_VARIANT != null && GO_IMAGE_VARIANT != "" ? GO_IMAGE_VARIANT : "bookworm"
+    PKG_REMOTE_DOCKERFILE = "Dockerfile"
+  }
+}
+
 target "_pkg-docker-cli" {
   args = {
     PKG_NAME = PKG_NAME != null && PKG_NAME != "" ? PKG_NAME : "docker-ce-cli"
@@ -689,41 +725,53 @@ group "default" {
 }
 
 target "pkg" {
-  name = "pkg-${pkg}-${distro}"
-  description = "Build ${pkg} package for ${distro}"
-  inherits = ["_common", "_distro-${distro}", "_pkg-${pkg}"]
+  name = "pkg-${item.pkg}-${item.distro}"
+  description = "Build ${item.pkg} package for ${item.distro}"
+  inherits = ["_common", "_distro-${item.distro}", "_pkg-${item.pkg}"]
   matrix = {
-    pkg = PKGS
-    distro = DISTROS
-  }
-  context = pkgContext(pkg)
+    item = flatten([
+      for pkg in PKGS : [
+        for distro in lookup(PKG_DISTROS, pkg, DISTROS) : {
+          pkg = pkg
+          distro = distro
+        }
+      ]
+    ])
+  }
+  context = pkgContext(item.pkg)
   contexts = {
     scripts = "./hack/scripts"
   }
-  output = ["type=local,dest=./bin/pkg/${pkg}/${distro}"]
+  output = ["type=local,dest=./bin/pkg/${item.pkg}/${item.distro}"]
   # BAKE_LOCAL_PLATFORM is a built-in var returning the current platform's
   # default platform specification: https://docs.docker.com/build/customize/bake/file-definition/#built-in-variables
-  platforms = LOCAL_PLATFORM != null ? [BAKE_LOCAL_PLATFORM] : distroPlatforms(distro, pkg)
-  secret = distroSecrets(distro)
+  platforms = LOCAL_PLATFORM != null ? [BAKE_LOCAL_PLATFORM] : distroPlatforms(item.distro, item.pkg)
+  secret = distroSecrets(item.distro)
   attest = [
     "type=sbom",
     "type=provenance,mode=max"
   ]
 }
 
 target "verify" {
-  name = "verify-${pkg}-${distro}"
-  description = "Verify ${pkg} package for ${distro}"
-  inherits = ["_common", "_distro-${distro}", "_pkg-${pkg}"]
+  name = "verify-${item.pkg}-${item.distro}"
+  description = "Verify ${item.pkg} package for ${item.distro}"
+  inherits = ["_common", "_distro-${item.distro}", "_pkg-${item.pkg}"]
   matrix = {
-    pkg = PKGS
-    distro = DISTROS
-  }
-  context = pkgContext(pkg)
+    item = flatten([
+      for pkg in PKGS : [
+        for distro in lookup(PKG_DISTROS, pkg, DISTROS) : {
+          pkg = pkg
+          distro = distro
+        }
+      ]
+    ])
+  }
+  context = pkgContext(item.pkg)
   dockerfile = "verify.Dockerfile"
   contexts = {
     scripts = "./hack/scripts"
-    bin = "./bin/pkg/${pkg}/${distro}"
+    bin = "./bin/pkg/${item.pkg}/${item.distro}"
   }
   no-cache = true
   output = ["type=cacheonly"]

pkg/agent/scripts/pkg-static-build.sh

@@ -76,15 +76,22 @@ for pkgname in *; do
     cp "${pkgname}"/* ${SRCDIR}/LICENSE ${SRCDIR}/README.md "$workdir/${pkgname}/"
   )
   if [ "$(xx-info os)" = "windows" ]; then
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip"
     (
       set -x
       cd "$workdir"
-      zip -r "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip" "${pkgname}"
+      zip -r "$pkgfile" "${pkgname}"
     )
   else
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz"
     (
       set -x
-      tar -czf "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz" -C "$workdir" "${pkgname}"
+      tar -czf "$pkgfile" -C "$workdir" "${pkgname}"
     )
   fi
+  (
+    set -x
+    cd "$pkgoutput"
+    sha256sum "${pkgfile##*/}" > "${pkgfile##*/}.sha256"
+  )
 done

pkg/agent/verify.Dockerfile

@@ -108,6 +108,8 @@ RUN --mount=from=bin,target=/build <<EOT
   for package in $(find $dir -type f -name '*.tgz'); do
     (
       set -x
+      cd "${package%/*}"
+      sha256sum -c "${package##*/}.sha256"
       tar zxvf $package -C /usr/bin --strip-components=1
     )
   done

pkg/buildx/scripts/pkg-static-build.sh

@@ -73,15 +73,22 @@ for pkgname in *; do
     cp "${pkgname}"/* ${SRCDIR}/LICENSE ${SRCDIR}/README.md "$workdir/${pkgname}/"
   )
   if [ "$(xx-info os)" = "windows" ]; then
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip"
     (
       set -x
       cd "$workdir"
-      zip -r "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip" "${pkgname}"
+      zip -r "$pkgfile" "${pkgname}"
     )
   else
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz"
     (
       set -x
-      tar -czf "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz" -C "$workdir" "${pkgname}"
+      tar -czf "$pkgfile" -C "$workdir" "${pkgname}"
     )
   fi
+  (
+    set -x
+    cd "$pkgoutput"
+    sha256sum "${pkgfile##*/}" > "${pkgfile##*/}.sha256"
+  )
 done

pkg/buildx/verify.Dockerfile

@@ -108,6 +108,8 @@ RUN --mount=from=bin,target=/build <<EOT
   for package in $(find $dir -type f -name '*.tgz'); do
     (
       set -x
+      cd "${package%/*}"
+      sha256sum -c "${package##*/}.sha256"
       tar zxvf $package -C /usr/bin --strip-components=1
     )
   done

pkg/compose/scripts/pkg-static-build.sh

@@ -78,15 +78,22 @@ for pkgname in *; do
     cp "${pkgname}"/* ${SRCDIR}/LICENSE ${SRCDIR}/README.md "$workdir/${pkgname}/"
   )
   if [ "$(xx-info os)" = "windows" ]; then
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip"
     (
       set -x
       cd "$workdir"
-      zip -r "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip" "${pkgname}"
+      zip -r "$pkgfile" "${pkgname}"
     )
   else
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz"
     (
       set -x
-      tar -czf "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz" -C "$workdir" "${pkgname}"
+      tar -czf "$pkgfile" -C "$workdir" "${pkgname}"
     )
   fi
+  (
+    set -x
+    cd "$pkgoutput"
+    sha256sum "${pkgfile##*/}" > "${pkgfile##*/}.sha256"
+  )
 done

pkg/compose/verify.Dockerfile

@@ -108,6 +108,8 @@ RUN --mount=from=bin,target=/build <<EOT
   for package in $(find $dir -type f -name '*.tgz'); do
     (
       set -x
+      cd "${package%/*}"
+      sha256sum -c "${package##*/}.sha256"
       tar zxvf $package -C /usr/bin --strip-components=1
     )
   done

pkg/containerd/scripts/pkg-static-build.sh

@@ -132,15 +132,22 @@ for pkgname in *; do
     fi
   )
   if [ "$(xx-info os)" = "windows" ]; then
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip"
     (
       set -x
       cd "$workdir"
-      zip -r "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.zip" "${pkgname}"
+      zip -r "$pkgfile" "${pkgname}"
     )
   else
+    pkgfile="${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz"
     (
       set -x
-      tar -czf "${pkgoutput}/${pkgname}_${GENVER_VERSION#v}.tgz" -C "$workdir" "${pkgname}"
+      tar -czf "$pkgfile" -C "$workdir" "${pkgname}"
     )
   fi
+  (
+    set -x
+    cd "$pkgoutput"
+    sha256sum "${pkgfile##*/}" > "${pkgfile##*/}.sha256"
+  )
 done

pkg/containerd/verify.Dockerfile

@@ -112,6 +112,8 @@ RUN --mount=from=bin,target=/build <<EOT
   for package in $(find $dir -type f -name '*.tgz'); do
     (
       set -x
+      cd "${package%/*}"
+      sha256sum -c "${package##*/}.sha256"
       tar zxvf $package -C /usr/bin --strip-components=1
     )
   done