From 81c9fa421dbcc745a61b42a3e6d67bc7a134ef4a Mon Sep 17 00:00:00 2001
From: Javi Merino <javi.merino@cloud.com>
Date: Tue, 22 Oct 2024 16:55:02 +0100
Subject: [PATCH] CI: Refresh the Debian 12 arm32 cross compile container

Rework the container to user heredocs for readability, derive from
bookworm-slim and use apt-get --no-install-recommends to keep the size down.

Convert it to being a non-root container.  Add checkpolicy as FLASK is an
available build option for arm32 under Randconfig testing.

Rename the CI jobs to debian-12-arm32-* to follow the naming scheme of all the
other CI jobs.

No functional change.

Signed-off-by: Javi Merino <javi.merino@cloud.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
---
 .../build/debian/12-arm64v8-arm32.dockerfile  | 32 +++++++++++++++++++
 .../bookworm-arm64v8-arm32-gcc.dockerfile     | 24 --------------
 automation/gitlab-ci/build.yaml               | 24 +++++++-------
 automation/gitlab-ci/test.yaml                | 14 ++++----
 automation/scripts/containerize               |  2 +-
 5 files changed, 52 insertions(+), 44 deletions(-)
 create mode 100644 automation/build/debian/12-arm64v8-arm32.dockerfile
 delete mode 100644 automation/build/debian/bookworm-arm64v8-arm32-gcc.dockerfile

diff --git a/automation/build/debian/12-arm64v8-arm32.dockerfile b/automation/build/debian/12-arm64v8-arm32.dockerfile
new file mode 100644
index 0000000000..a4d70f1111
--- /dev/null
+++ b/automation/build/debian/12-arm64v8-arm32.dockerfile
@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1
+FROM --platform=linux/arm64/v8 debian:bookworm-slim
+LABEL maintainer.name="The Xen Project"
+LABEL maintainer.email="xen-devel@lists.xenproject.org"
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV CROSS_COMPILE=/usr/bin/arm-linux-gnueabihf-
+
+RUN <<EOF
+#!/bin/bash
+    set -eu
+
+    useradd --create-home user
+
+    apt-get update
+
+    DEPS=(
+        # Xen
+        bison
+        build-essential
+        checkpolicy
+        flex
+        gcc-arm-linux-gnueabihf
+    )
+
+    apt-get --yes --no-install-recommends install "${DEPS[@]}"
+
+    rm -rf /var/lib/apt/lists*
+EOF
+
+USER user
+WORKDIR /build
diff --git a/automation/build/debian/bookworm-arm64v8-arm32-gcc.dockerfile b/automation/build/debian/bookworm-arm64v8-arm32-gcc.dockerfile
deleted file mode 100644
index 95b3f04283..0000000000
--- a/automation/build/debian/bookworm-arm64v8-arm32-gcc.dockerfile
+++ /dev/null
@@ -1,24 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM --platform=linux/arm64/v8 debian:bookworm
-LABEL maintainer.name="The Xen Project" \
-      maintainer.email="xen-devel@lists.xenproject.org"
-
-ENV DEBIAN_FRONTEND=noninteractive
-ENV USER root
-ENV CROSS_COMPILE /usr/bin/arm-linux-gnueabihf-
-
-RUN mkdir /build
-WORKDIR /build
-
-# build depends
-RUN apt-get update && \
-    apt-get --quiet --yes install \
-        build-essential \
-        flex \
-        bison \
-        git \
-        gcc-arm-linux-gnueabihf \
-        && \
-        apt-get autoremove -y && \
-        apt-get clean && \
-        rm -rf /var/lib/apt/lists* /tmp/* /var/tmp/*
diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index 7f5b5938e8..2189ee0b9e 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -360,52 +360,52 @@ debian-13-riscv64-gcc-debug:
 
 # Arm32 cross-build
 
-debian-bookworm-gcc-arm32:
+debian-12-arm32-gcc:
   extends: .gcc-arm32-cross-build
   <<: *build-test
   variables:
-    CONTAINER: debian:bookworm-arm64v8-arm32-gcc
+    CONTAINER: debian:12-arm64v8-arm32
     HYPERVISOR_ONLY: y
 
-debian-bookworm-gcc-arm32-debug:
+debian-12-arm32-gcc-debug:
   extends: .gcc-arm32-cross-build-debug
   <<: *build-test
   variables:
-    CONTAINER: debian:bookworm-arm64v8-arm32-gcc
+    CONTAINER: debian:12-arm64v8-arm32
     HYPERVISOR_ONLY: y
 
-debian-bookworm-gcc-arm32-randconfig:
+debian-12-arm32-gcc-randconfig:
   extends: .gcc-arm32-cross-build
   variables:
-    CONTAINER: debian:bookworm-arm64v8-arm32-gcc
+    CONTAINER: debian:12-arm64v8-arm32
     HYPERVISOR_ONLY: y
     RANDCONFIG: y
 
-debian-bookworm-gcc-arm32-debug-staticmem:
+debian-12-arm32-gcc-debug-staticmem:
   extends: .gcc-arm32-cross-build-debug
   <<: *build-test
   variables:
-    CONTAINER: debian:bookworm-arm64v8-arm32-gcc
+    CONTAINER: debian:12-arm64v8-arm32
     HYPERVISOR_ONLY: y
     EXTRA_XEN_CONFIG: |
       CONFIG_EXPERT=y
       CONFIG_UNSUPPORTED=y
       CONFIG_STATIC_MEMORY=y
 
-debian-bookworm-gcc-arm32-debug-earlyprintk:
+debian-12-arm32-gcc-debug-earlyprintk:
   extends: .gcc-arm32-cross-build-debug
   <<: *build-test
   variables:
-    CONTAINER: debian:bookworm-arm64v8-arm32-gcc
+    CONTAINER: debian:12-arm64v8-arm32
     HYPERVISOR_ONLY: y
     EXTRA_XEN_CONFIG: |
       CONFIG_EARLY_UART_CHOICE_PL011=y
       CONFIG_EARLY_UART_BASE_ADDRESS=0x9000000
 
-debian-bookworm-gcc-arm32-debug-mpu:
+debian-12-arm32-gcc-debug-mpu:
   extends: .gcc-arm32-cross-build-debug
   variables:
-    CONTAINER: debian:bookworm-arm64v8-arm32-gcc
+    CONTAINER: debian:12-arm64v8-arm32
     HYPERVISOR_ONLY: y
     EXTRA_XEN_CONFIG: |
       CONFIG_XEN_START_ADDRESS=0x0
diff --git a/automation/gitlab-ci/test.yaml b/automation/gitlab-ci/test.yaml
index 517af17324..e1d6bb5056 100644
--- a/automation/gitlab-ci/test.yaml
+++ b/automation/gitlab-ci/test.yaml
@@ -600,7 +600,7 @@ qemu-smoke-dom0less-arm32-gcc:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32
+    - debian-12-arm32-gcc
 
 qemu-smoke-dom0less-arm32-gcc-debug:
   extends: .qemu-arm32
@@ -608,7 +608,7 @@ qemu-smoke-dom0less-arm32-gcc-debug:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32-debug
+    - debian-12-arm32-gcc-debug
 
 qemu-smoke-dom0less-arm32-gcc-debug-staticmem:
   extends: .qemu-arm32
@@ -616,7 +616,7 @@ qemu-smoke-dom0less-arm32-gcc-debug-staticmem:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh static-mem 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32-debug-staticmem
+    - debian-12-arm32-gcc-debug-staticmem
 
 qemu-smoke-dom0less-arm32-gcc-debug-gzip:
   extends: .qemu-arm32
@@ -624,7 +624,7 @@ qemu-smoke-dom0less-arm32-gcc-debug-gzip:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh gzip 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32-debug
+    - debian-12-arm32-gcc-debug
 
 qemu-smoke-dom0less-arm32-gcc-without-dom0:
   extends: .qemu-arm32
@@ -632,7 +632,7 @@ qemu-smoke-dom0less-arm32-gcc-without-dom0:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh without-dom0 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32
+    - debian-12-arm32-gcc
 
 qemu-smoke-dom0less-arm32-gcc-debug-without-dom0:
   extends: .qemu-arm32
@@ -640,7 +640,7 @@ qemu-smoke-dom0less-arm32-gcc-debug-without-dom0:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh without-dom0 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32-debug
+    - debian-12-arm32-gcc-debug
 
 qemu-smoke-dom0less-arm32-gcc-debug-earlyprintk:
   extends: .qemu-arm32
@@ -648,7 +648,7 @@ qemu-smoke-dom0less-arm32-gcc-debug-earlyprintk:
     - ./automation/scripts/qemu-smoke-dom0less-arm32.sh earlyprintk 2>&1 | tee ${LOGFILE}
   needs:
     - *arm32-test-needs
-    - debian-bookworm-gcc-arm32-debug-earlyprintk
+    - debian-12-arm32-gcc-debug-earlyprintk
 
 qemu-alpine-x86_64-gcc:
   extends: .qemu-x86-64
diff --git a/automation/scripts/containerize b/automation/scripts/containerize
index ad3e237270..ef3b97b655 100755
--- a/automation/scripts/containerize
+++ b/automation/scripts/containerize
@@ -38,7 +38,7 @@ case "_${CONTAINER}" in
     _bookworm|_bookworm-x86_64) CONTAINER="${BASE}/debian:12-x86_64" ;;
     _trixie-x86_64|_) CONTAINER="${BASE}/debian:13-x86_64" ;;
     _bookworm-i386|_bookworm-x86_32) CONTAINER="${BASE}/debian:12-x86_32" ;;
-    _bookworm-arm64v8-arm32-gcc) CONTAINER="${BASE}/debian:bookworm-arm64v8-arm32-gcc" ;;
+    _bookworm-arm64v8-arm32) CONTAINER="${BASE}/debian:12-arm64v8-arm32" ;;
     _bookworm-arm64v8) CONTAINER="${BASE}/debian:bookworm-arm64v8" ;;
     _bookworm-cppcheck) CONTAINER="${BASE}/debian:12-arm64v8-cppcheck" ;;
     _opensuse-leap|_leap) CONTAINER="${BASE}/opensuse:leap-15.6-x86_64" ;;