From f30e3fdc4e4ed5e1e6397ca757dbb2ce9dca6810 Mon Sep 17 00:00:00 2001 From: Torsten Wierschin Date: Wed, 4 Nov 2026 15:43:50 +0000 Subject: [PATCH] Adds external deps split task --- ...rfile-ubuntu26-qt6_anpassung_tp.dockerfile | 199 ++++++++++++++++++ ...plit-external-dependencies-ci-cd.prompt.md | 157 ++++++++++++++ 2 files changed, 356 insertions(+) create mode 100755 prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile create mode 100644 prompts/split-external-dependencies-ci-cd.prompt.md diff --git a/prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile b/prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile new file mode 100755 index 000000000..cacd7f018 --- /dev/null +++ b/prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile @@ -0,0 +1,199 @@ +# DOCKERFILE SPEC FOR BUILD Container with Qt6 +# Based on Ubuntu 26.04 with aqtinstall for Qt6 installation + +FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04 + +ARG RME_USERPASS=ctc +ARG RME_ADMINSRV=10.198.80.75 +ARG RME_PROJECT=guez + + +# TEMP Proxy Config, must be working Air-gapped in the Future +ARG http_proxy="http://10.198.80.130:3128" +ARG no_proxy="localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158" +ARG HTTP_PROXY=${http_proxy} +ARG https_proxy=${http_proxy} +ARG HTTPS_PROXY=${http_proxy} +ARG NO_PROXY=${no_proxy} + +# 1. Pip Konfiguration +ENV PIP_INDEX_URL="http://remote-repo.sl.defence-elec.de:8081/repository/proxypipy/" \ + PIP_TRUSTED_HOST="remote-repo.sl.defence-elec.de" \ + PYTHONUNBUFFERED=1 \ + PIP_NO_CACHE_DIR=1 \ + PYTHONDONTWRITEBYTECODE=1 + +# 2. QT Konfiguration +ENV QT_VERSION=6.10.2 \ + QT_ARCH=linux_gcc_64 \ + QT_BASE_DIR=/opt/Qt \ + QT_ROOT=/opt/Qt/6.10.2/gcc_64 + +#3. OS und PATH Konfiguration +ENV DEBIAN_FRONTEND=noninteractive \ + LANG=C.UTF-8 \ + LC_ALL=C.UTF-8 \ + Qt6_ROOT=${QT_ROOT} \ + CMAKE_PREFIX_PATH=/usr/local:${QT_ROOT} \ + LD_LIBRARY_PATH=${QT_ROOT}/lib \ + PATH=${QT_ROOT}/bin:$PATH + +LABEL Author='Thore Poggenburg (updated for Qt6 on Ubuntu 26.04)' +LABEL PROJECT=${RME_PROJECT} + + +# Shell global auf Bash mit sicheren Pipes umstellen +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +# Originale Repositories durch Nexus Proxies ersetzen +RUN echo : > /etc/apt/sources.list && \ + echo -e "Types: deb\n\ +URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu\n\ +Suites: resolute resolute-updates resolute-backports\n\ +Components: main restricted universe multiverse\n\ +Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n\ +\n\ +Types: deb\n\ +URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security\n\ +Suites: resolute-security\n\ +Components: main restricted universe multiverse\n\ +Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" > /etc/apt/sources.list.d/ubuntu.sources + + +# Create users (install openssl first for password hashing) +RUN apt-get update && apt-get install -y openssl \ + && groupadd ctc -g 1445 || true \ + && groupadd rme -g 1001 || true \ + && useradd -d /shd/CTC/TOOLS -u 1445 -g ctc -m -p $(openssl passwd -5 ${RME_USERPASS}) ctc || true \ + && useradd -d /home/rme -u 1001 -g rme -m -p $(openssl passwd -5 ${RME_USERPASS}) rme || true \ + && rm -rf /var/lib/apt/lists/* + +RUN curl -fsSL http://${RME_ADMINSRV}/rme/deb_and_rpm_signage_key.pub --output /etc/apt/keyrings/deb_and_rpm_signage_key.asc \ + && curl -fsSL http://${RME_ADMINSRV}/rme/SL-Netz.crt --output /usr/local/share/ca-certificates/SL-Netz.crt \ + && update-ca-certificates + +WORKDIR /app + +# Install base development tools and Qt6 dependencies +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + ca-certificates \ + git \ + cmake \ + ninja-build \ + clang \ + build-essential \ + gnupg \ + curl \ + jq \ + openssh-client \ + pkg-config \ + libgl1-mesa-dev \ + libxkbcommon-x11-0 \ + libfontconfig1 \ + libdbus-1-3 \ + libpulse0 \ + libxcb-glx0 \ + libxcb-cursor0 \ + libpq-dev \ + libbz2-dev \ + libpoppler-dev \ + libpoppler-qt6-dev \ + libboost-dev \ + libgeographiclib-dev \ + libbotan-3-dev \ + libssl-dev \ + libxml2-dev \ + libicu-dev \ + libqt6svg6-dev \ + unzip \ + python3 \ + python3-venv \ + python3-pip \ + && ln -sf /usr/bin/python3 /usr/local/bin/python3 \ + && ln -sf /usr/bin/python3 /usr/local/bin/python \ + && rm -rf /var/lib/apt/lists/* + +# Setup Python virtual environment and install aqtinstall +RUN python3 -m venv /opt/venv \ + && /opt/venv/bin/pip install --upgrade pip setuptools wheel \ + && /opt/venv/bin/pip install aqtinstall + +# Install Qt6 via aqtinstall with required modules +# Note: Qt6Location requires Qt6Positioning as dependency +RUN set -eux; \ + mkdir -p "${QT_BASE_DIR}" \ + && /opt/venv/bin/python -m aqt install-qt linux desktop "${QT_VERSION}" "${QT_ARCH}" \ + -m qtmultimedia qtserialport qtimageformats qtwebsockets qtpdf qtwebview qtlocation qtpositioning qt5compat \ + --outputdir "${QT_BASE_DIR}" \ + && test -f "${QT_ROOT}/lib/cmake/Qt6/Qt6Config.cmake" + +# ArcGIS Maps SDK for Qt will be mounted at runtime if needed: +# docker run -v /path/to/ArcGIS:/opt/ArcGIS ... +# Set ARCGIS_SDK_ROOT for discovery (will be used if mounted) +ENV ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0 + +# Build and install Log4Qt from source (Qt6 support) +RUN set -eux; \ + cd /tmp && \ + git clone --depth 1 --branch v2.0.0 https://github.com/MEONMedical/Log4Qt.git && \ + cd Log4Qt && \ + mkdir build && cd build && \ + cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_PREFIX_PATH="${QT_ROOT}" .. && \ + cmake --build . -j$(nproc) && \ + cmake --install . && \ + cd /tmp && rm -rf Log4Qt + +# Build and install Grantlee from source (Qt6 support) +# Note: Ubuntu grantlee5-devel is Qt5-based, so we build Qt6-compatible version from master branch +RUN set -eux; \ + cd /tmp && \ + git clone --depth 1 https://github.com/steveire/grantlee.git && \ + cd grantlee && \ + mkdir build && cd build && \ + cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_PREFIX_PATH="${QT_ROOT}" -DGRANTLEE_BUILD_WITH_QT6=ON .. && \ + cmake --build . -j$(nproc) && \ + cmake --install . && \ + cd /tmp && rm -rf grantlee + +# Build and install KDReports from source (Qt6 support) +RUN set -eux; \ + cd /tmp && \ + git clone --depth 1 --branch kdreports-2.3.0 https://github.com/KDAB/KDReports.git && \ + cd KDReports && \ + mkdir build && cd build && \ + cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_PREFIX_PATH="${QT_ROOT}" -DKDReports_QT6=ON .. && \ + cmake --build . -j$(nproc) && \ + cmake --install . && \ + cd /tmp && rm -rf KDReports + +# Install GoogleTest +RUN apt-get update \ + && apt-get install -y --no-install-recommends libgtest-dev libgmock-dev \ + && rm -rf /var/lib/apt/lists/* + +# Add RPM/rpmbuild tools for make_rpm.py +# Note: Ubuntu uses different package names than openSUSE/Fedora +# - rpm: provides rpmbuild command and basic infrastructure +# - rpmdevtools is NOT available on Ubuntu, we create directory structure manually +RUN apt-get update \ + && apt-get install -y --no-install-recommends rpm \ + && rm -rf /var/lib/apt/lists/* + +# Setup rpmbuild directory structure (normally done by rpmdev-setuptree on Fedora/openSUSE) +RUN mkdir -p /shd/CTC/TOOLS/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS} \ + && chown -R ctc:ctc /shd/CTC/TOOLS/rpmbuild + +# RTI Connext DDS (proprietary) should be mounted at runtime: +# docker run -v /path/to/rti:/opt/RTI ... +# Set DDS_PATH for RTI discovery (will be used if RTI is mounted) +ENV DDS_PATH=/opt/RTI + +# Cleanup +RUN apt-get clean \ + && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* + +USER ctc +WORKDIR /shd/CTC/TOOLS + +CMD ["/bin/bash"] \ No newline at end of file diff --git a/prompts/split-external-dependencies-ci-cd.prompt.md b/prompts/split-external-dependencies-ci-cd.prompt.md new file mode 100644 index 000000000..9566c8f22 --- /dev/null +++ b/prompts/split-external-dependencies-ci-cd.prompt.md @@ -0,0 +1,157 @@ +# Reproducible External Dependency and Container Pipelines + +This is an implementation task. Work autonomously, keep changes focused, and do not modify unrelated files. The goal is to inventory every external resource used by the Docker build script and create independently versioned, reproducible CI/CD pipelines for those resources and the build container. + +## Fixed scope + +Work only on branch: + +`feature/regression-arcgis300-symbology-migration` + +If this branch does not exist in a checkout, create it from that repository's current default branch before editing. Do not silently substitute another branch. + +Use these repository files as the source of truth: + +- Build/install behavior: `./qt-migration-legatus/qt6-after/qt6-migrated-legatus/new_docker_build.sh` +- Prompt organization and section style: `./prompts/verify-legatus-qt6-migration.prompt.md` +- Container Dockerfile baseline: the Qt6/Ubuntu 26.04 Dockerfile supplied in the task context + +The supplied Dockerfile `./prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile` is a reference attachment, not an executable host-side build script. Do not attempt to execute it directly on the Copilot host. + +## Required investigation + +Before changing files: + +1. Read the complete `new_docker_build.sh` and trace every resource it installs or downloads, including resources generated through variables, helper functions, Dockerfile heredocs, `apt`, `pip`/`aqtinstall`, Git clones, and runtime downloads. +2. Verify actual versions, tags/branches/commits, URLs, checksums/signatures, build flags, licenses, and transitive dependencies from repository evidence and upstream metadata. Do not infer a pinned version from a shallow clone or a moving branch such as `master`. +3. Inventory all resources in a table and classify each as: + - OS/base image or Dockerfile-provided resource + - Ubuntu/Nexus APT binary package + - upstream binary/artifact (including Qt installed with `aqtinstall`) + - built from source + - proprietary/runtime-mounted or otherwise unavailable +4. Record the current installation method, version/pin status, license/distribution constraints, and proposed artifact/package and pipeline for each resource. Include Log4Qt, Grantlee, KDReports, GoogleTest/GoogleMock, Qt and every other resource found; do not limit the inventory to these examples. +5. Inspect existing repository folder conventions, CI conventions, Dockerfiles, package repository configuration, and available signing/publishing mechanisms before choosing paths or inventing configuration. + +If the attachment or an upstream resource cannot be examined, state the exact limitation and do not claim a complete inventory. + +## Dependency folders and packaging + +Keep downloaded, non-source-built dependencies in separate, clearly named folders by origin and package, following existing repository conventions where possible. If no suitable convention exists, use a layout equivalent to: + +- `external-dependencies/downloads/apt//` +- `external-dependencies/downloads/upstream//` +- `external-dependencies/source//` only for source-build inputs + +Do not put source-build inputs in the binary-download folders. Store versioned source archives or immutable Git references, checksums, license notices, and provenance manifests with the corresponding package. + +Create one independently versioned pipeline per external package/resource, with its own uniquely named Dockerfile and Jenkinsfile. Each pipeline must: + +- produce a version-pinned `.deb` (or, where technically or legally impossible, a documented equivalent artifact without pretending it is a `.deb`); +- publish to the organization's `external_rpms` package repository using existing repository conventions; +- make package versions, source revisions, build arguments, checksums, and resulting artifact names explicit; +- support rebuilding one dependency without rebuilding unrelated dependencies; +- emit an SBOM and provenance/build manifest, and preserve the source/license notices; +- pin all transitive build inputs where practical and fail on checksum, signature, or version mismatches; +- avoid embedding credentials in files, logs, images, or artifacts; use configured Jenkins credentials and existing approved repository endpoints. + +Qt is the explicit exception to compiling upstream code: install the specified Qt version/modules as upstream Qt binaries using `aqtinstall` from Qt online sources. Do not build Qt from source. Make the resulting Qt binaries and their provenance available for approved air-gapped use, using the repository's permitted packaging/artifact mechanism. Check Qt and module redistribution terms first; if redistribution into `.deb` or the internal repository is not permitted or cannot be verified, stop that packaging step and report the exact constraint and an approved alternative needed. Do not bypass licensing. + +For Ubuntu APT packages that are not built from source, preserve the original pinned `.deb` and metadata in the separate package download folder; do not recompile or silently repackage upstream binaries. Use the existing approved Ubuntu/Nexus source configuration and publish/mirror artifacts according to the existing `external_rpms` repository format. If the requested per-package `.deb`/pipeline model conflicts with the package's origin, license, or repository format, document the conflict and do not fabricate an artifact. + +## Build container and Jenkins pipelines + +Create a separate build-container Dockerfile and Jenkinsfile, distinct from the per-dependency pipelines. Follow the supplied Dockerfile as the baseline while applying these requirements: + +- Use Ubuntu `26.04` only. Prefer the approved internal Harbor mirror for the base image; do not silently fall back to another Ubuntu release. +- Preserve the Qt version/modules and project-specific environment needed by `new_docker_build.sh`, but consume the produced internal packages/artifacts instead of rebuilding or downloading unpinned dependencies in the container. +- Configure the Ubuntu/Nexus APT sources using the repository's approved pattern. Do not use an untrusted key or disable signature verification. +- Set `ARG no_proxy` so it contains the exact required entry `__.__sl.defence-elec.de`; do not replace it with a broader or differently spelled domain. Preserve required local/internal exclusions from the supplied baseline as appropriate. +- Use the supplied proxy values only as build-time configuration; do not bake credentials or secrets into the image. +- Keep proprietary RTI and ArcGIS SDKs mounted at runtime when required; do not commit, package, or copy proprietary SDK/license files into the image. +- Set Log4Qt telnet logging to `OFF` explicitly in its build configuration. +- Pin Grantlee and every other source-built dependency to a verified immutable version/tag/commit; never use an unpinned `master` branch. +- Configure DNS to `10.199.101.35` and `10.199.101.158` only when DNS resolution fails in the container, using the supported Docker/Jenkins configuration rather than hard-coding a host-wide DNS change. +- Create the container Jenkins pipeline following this structure and adapt the repository URL, branch, and paths to the actual checkout. Use the requested feature branch, not `main`, unless repository policy requires a documented equivalent: + +```groovy +node { + def app + stage('Clone Repo') { + git branch: 'feature/regression-arcgis300-symbology-migration', url: '' + } + stage('Build Container') { + app = docker.build( + 'buildcontainer/ubuntu_26_04_qt6', + '-f Dockerfile-ubuntu26-qt6.dockerfile .' + ) + } + stage('Push Container') { + docker.withRegistry('https://harbor.sl.defence-elec.de', 'harbor-robot') { + app.push("${env.BUILD_ID}") + app.push('latest') + } + } +} +``` + +Use existing credential IDs and registry policy; do not add credentials to source. Do not push an image unless the user/repository's normal CI authorization permits it. + +## `new_docker_build.sh` integration + +The current script must be inspected for the actual state of its options; do not assume an option exists merely because it is requested here. Add `--docker-mount-root PATH` if it is absent, with `/root` as the default. The option must: + +- be parsed consistently with the script's existing options and documented in `--help`; +- accept and validate a container mount destination, defaulting to `/root`; +- be passed to the container invocation and used for the intended dependency/artifact workspace mount without changing unrelated mounts; +- preserve current script behavior when omitted; +- fail explicitly on invalid input or a missing required host directory instead of silently falling back. + +Use the option with its default `/root` in the documented build/pipeline invocation. Add or update focused tests for argument parsing and mount construction if the repository has a test mechanism for this script. + +## Reproducibility, supply chain, and safety + +- Pin the Ubuntu base-image digest where the approved registry supports it, and record the upstream image and digest. +- Record exact source URL, immutable version/revision, retrieval timestamp, checksum/signature verification, license, build toolchain, build flags, and output checksum for each artifact. +- Generate an SBOM for each package and the final container; use existing tools/formats if configured, otherwise choose a standard format and document the choice. +- Ensure the build can use the internal artifact/package repository without depending on public internet access after approved artifacts have been mirrored. +- Do not silently continue after failed downloads, package installation, signature checks, builds, SBOM generation, or publishing. +- Keep repository credentials and signing keys in Jenkins secrets; never print them or commit them. +- Do not execute builds on the Copilot host. Run validation only in the supported Docker/Jenkins environment. If that environment is unavailable, perform static checks and report the exact unexecuted validations. + +## Verification + +1. Verify the inventory covers every external install/download path in the complete script, including both prebuilt-image and runtime-install paths. +2. Verify each package has an isolated version/pipeline definition, unique Dockerfile/Jenkinsfile names, pinned inputs, and a documented output. +3. Verify APT downloads and upstream binary artifacts are in separate per-package folders and source-build inputs are kept separate. +4. Verify the container build consumes the produced packages, uses Ubuntu 26.04, includes the required `no_proxy` token, and disables Log4Qt telnet logging. +5. Verify the script's `--docker-mount-root` default, help text, argument validation, and resulting Docker mount. +6. Run available static validation, shell checks, Dockerfile/Jenkinsfile validation, package/SBOM checks, and pipeline tests in the supported environment. Do not report a pipeline as tested if it was only inspected. +7. Verify no secrets, proprietary SDKs, licenses, or unapproved binaries were added to the repository. + +## Success criteria + +The task is complete only when: + +- every external resource used by the script is inventoried and classified; +- each package/resource has a separate, reproducible, versioned CI/CD pipeline and its own Dockerfile/Jenkinsfile, or a specific documented license/technical blocker; +- deliverable packages/artifacts and SBOM/provenance are suitable for controlled internal and approved air-gapped distribution; +- the build-container pipeline is independent and follows the supplied Ubuntu 26.04 Qt6 template; +- `new_docker_build.sh` supports `--docker-mount-root` with default `/root` and the option is verified; +- all checks actually run are reported accurately, with unavailable checks and blockers stated plainly. + +## Final report + +Provide a factual report containing: + +- status: `COMPLETE`, `PARTIALLY COMPLETE`, or `BLOCKED`; +- branch and changed files; +- the dependency inventory, including version/pin and source/build method; +- each package's pipeline, Dockerfile/Jenkinsfile, output artifact, repository destination, SBOM/provenance status, and verification result; +- build-container image name, Ubuntu base/digest, Jenkins pipeline result, and push status; +- `--docker-mount-root` behavior and test result; +- Qt license/distribution handling and any unresolved approval; +- commands/checks run, results, and exact skipped checks or blockers; +- remaining supply-chain, reproducibility, or air-gap risks. + +Do not claim full reproducibility, air-gapped readiness, successful publishing, or complete validation without concrete evidence.