Adds CI CD with deb for external deps

2026-11-06 18:15:17 +00:00
1 parent 03d48b76e4
commit 7373cb8d73
@@ -0,0 +1,168 @@
+# External Dependencies CI/CD Pipelines
+
+This directory contains CI/CD pipelines for 8 external dependencies required for the Legatus project in air-gapped environments.
+
+## Overview
+
+| Dependency | Version | License Type | Pipeline Status |
+|------------|---------|--------------|-----------------|
+| AVS | 1.0.0 | Contract-based (lifetime) | ✅ Complete |
+| ArcGIS | 300.0.0 | Embedded ini-file licenses (lifetime) | ✅ Complete |
+| BuildingModels | 1.0.0 | Proprietary | ✅ Complete |
+| GeographicLib | 1.52 | MIT | ✅ Complete |
+| Schusstafel | 1.0.0 | Proprietary | ✅ Complete |
+| dtEntity | 1.0.0 | Open Source | ✅ Complete |
+| RTI Connext DDS | 7.7.0 | Commercial license file (lifetime) | ✅ Complete |
+| tmsif | 1.0.0 | Contract-based (lifetime) | ✅ Complete |
+
+## Directory Structure
+
+```
+external-dependencies/
+├── avs/                    # AVS dependency pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── arcgis/                 # ArcGIS Runtime SDK pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── buildingmodels/         # BuildingModels dependency pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── geographiclib/          # GeographicLib dependency pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── schusstafel/            # Schusstafel dependency pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── dtentity/               # dtEntity game engine pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── rti-connext-dds/        # RTI Connext DDS pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── tmsif/                  # TMSIF dependency pipeline
+│   ├── Dockerfile
+│   └── Jenkinsfile
+├── scripts/
+│   ├── generate-sbom.sh    # SBOM generation script
+│   ├── download-all-dependencies.sh
+│   ├── download-deb-packages.sh
+│   └── verify-offline-cache.sh
+├── offline-cache/          # Downloaded packages (excluded from git)
+├── DEPENDENCIES-INVENTORY.md
+├── AIRGAP-SUMMARY.md
+└── README.md
+```
+
+## License Handling
+
+### RTI Connext DDS (File-Based)
+- **License File:** `rti_license.dat` (repository root)
+- **Type:** FlexLM commercial license
+- **Handling:** 
+  - License file copied into container during build
+  - `RTI_LICENSE_FILE` environment variable set
+  - Jenkinsfile copies license from repository root to build context
+- **Location in Container:** `/opt/rti_license.dat`
+
+### AVS (Contract-Based)
+- **Type:** Lifetime license contract
+- **Handling:** No license file required
+- **Notes:** License managed at contract level, not file-based
+
+### ArcGIS (Embedded Ini-File Licenses)
+- **Type:** Map-specific embedded licenses
+- **Handling:** Licenses embedded in 19 `.ini` files
+- **Location:** `Lts/Viewer/SituationMap/Map/*.ini`
+- **Notes:** Licenses travel with map configuration files
+
+### tmsif (Contract-Based)
+- **Type:** Lifetime license contract
+- **Handling:** No license file required
+- **Notes:** License managed at contract level, not file-based
+
+### Other Dependencies
+- **BuildingModels, Schusstafel:** Proprietary, contract-based
+- **GeographicLib:** MIT license (open source)
+- **dtEntity:** Open source
+
+## Air-Gapped Environment Configuration
+
+All Dockerfiles include:
+- Internal Nexus repository: `remote-repo.sl.defence-elec.de:8081`
+- Proxy configuration: `http://10.198.80.130:3128`
+- Harbor registry: `harbor.sl.defence-elec.de/proxydockerhub`
+- Internal CA certificates
+- User creation (ctc, rme)
+
+## SBOM Generation
+
+All pipelines generate:
+- CycloneDX SBOM (`sbom.json`)
+- SLSA provenance (`provenance.json`)
+- License report (`licenses.txt`)
+
+SBOM files are stored in `sbom/` subdirectory for each dependency.
+
+## Usage
+
+### Building a Specific Dependency
+
+```bash
+cd external-dependencies/<dependency-name>
+docker build -t <image-name>:<version> .
+```
+
+### Running Jenkins Pipeline
+
+1. Ensure offline cache is available at `/opt/offline-cache/`
+2. Configure Harbor credentials in Jenkins
+3. Run pipeline from respective Jenkinsfile
+
+### Offline Installation
+
+For air-gapped environments:
+1. Run `scripts/download-all-dependencies.sh` in connected environment
+2. Transfer `offline-cache/` via secure media (encrypted USB)
+3. Mount offline cache in Jenkins container
+4. Pipelines will use cached packages
+
+## Verification
+
+Each pipeline includes verification stage:
+- AVS: Checks `/opt/AVS/` directory
+- ArcGIS: Verifies SDK installation and directory structure
+- RTI: Validates license file and environment variable
+- Others: Verify installation directories and basic functionality
+
+## Troubleshooting
+
+### License Issues (RTI)
+- Ensure `rti_license.dat` is in repository root
+- Check `RTI_LICENSE_FILE` environment variable in container
+- Verify license server connectivity (if using network license)
+
+### Offline Cache Issues
+- Verify cache structure: `qt6/`, `src/`, `deb/`
+- Check file permissions in mounted volumes
+- Ensure all required packages are downloaded
+
+### Build Failures
+- Check proxy configuration in Dockerfile
+- Verify internal repository accessibility
+- Review CA certificate installation
+
+## Security Considerations
+
+- License files (e.g., `rti_license.dat`) excluded from git via `.gitignore`
+- Offline cache (2.3GB) excluded from version control
+- Transfer sensitive files via encrypted media only
+- Harbor credentials managed via Jenkins credentials store
+- All containers run as non-root user (ctc)
+
+## Related Documentation
+
+- `DEPENDENCIES-INVENTORY.md` - Complete dependency inventory
+- `AIRGAP-SUMMARY.md` - Air-gapped environment adaptation details
+- `offline-cache/README.md` - Offline cache structure and usage
+- `scripts/README.md` - Script documentation