feat(golang): use prebuild go and validate checksums (#2963)

containerbase · Jul 22, 2024 · 60ada9a · 60ada9a
1 parent 9187e25
commit 60ada9a
Show file tree

Hide file tree

Showing 2 changed files with 67 additions and 14 deletions.
diff --git a/docs/custom-registries.md b/docs/custom-registries.md
@@ -197,11 +197,21 @@ https://github.com/gleam-lang/gleam/releases/download/v0.34.1/gleam-v0.34.1-x86_
 
 Go releases are downloaded from:
 
+- `https://github.com/containerbase/golang-prebuild/releases`
 - `https://dl.google.com/go/`
+- `https://go.dev/dl/?mode=json&include=all`
+
+The second url is used as fallback for older versions.
+The third url is used to find the checksums.
 
 Samples:
 
 ```txt
+https://github.com/containerbase/golang-prebuild/releases/download/1.22.5/golang-1.22.5-x86_64.tar.xz.sha512
+https://github.com/containerbase/golang-prebuild/releases/download/1.22.5/golang-1.22.5-x86_64.tar.xz
+https://github.com/containerbase/golang-prebuild/releases/download/1.22.5/golang-1.22.5-aarch64.tar.xz.sha512
+https://github.com/containerbase/golang-prebuild/releases/download/1.22.5/golang-1.22.5-aarch64.tar.xz
+https://go.dev/dl/?mode=json&include=all
 https://dl.google.com/go/go1.21.6.linux-arm64.tar.gz
 https://dl.google.com/go/go1.17.5.linux-amd64.tar.gz
 ```

diff --git a/src/usr/local/containerbase/tools/v2/golang.sh b/src/usr/local/containerbase/tools/v2/golang.sh
@@ -19,10 +19,15 @@ function prepare_tool() {
 }
 
 function install_tool () {
-  local versioned_tool_path
+  local arch=${ARCHITECTURE}
+  local base_url
+  local checksum_file
+  local expected_checksum
   local file
-  local arch=linux-amd64
-  local GOLANG_FILE_VERSION
+  local fversion
+  local name=${TOOL_NAME}
+  local version=${TOOL_VERSION}
+  local versioned_tool_path
 
   if [[ ! -d "$(find_tool_path)" ]]; then
     if [[ $(is_root) -ne 0 ]]; then
@@ -32,20 +37,58 @@ function install_tool () {
     prepare_tool
   fi
 
-  # fix version, only for go 1.20 and below
-  GOLANG_FILE_VERSION=${TOOL_VERSION}
-  if [[ ($MAJOR -lt 1 || ($MAJOR -eq 1 && $MINOR -lt 21)) && "${PATCH}" == "0" ]]; then
-    GOLANG_FILE_VERSION="${MAJOR}.${MINOR}"
-  fi
+  base_url="https://github.com/containerbase/${name}-prebuild/releases/download"
 
-  if [[ "$(uname -p)" = "aarch64" ]]; then
-    arch=linux-arm64
-  fi
+  # not all releases are copied to github
+  checksum_exists=$(file_exists "${base_url}/${version}/${name}-${version}-${arch}.tar.xz.sha512")
+  if [[ "${checksum_exists}" == "200" ]]; then
+    checksum_file=$(get_from_url "${base_url}/${version}/${name}-${version}-${arch}.tar.xz.sha512")
+    # get checksum from file
+    expected_checksum=$(cat "${checksum_file}")
+    # download file
+    file=$(get_from_url \
+      "${base_url}/${version}/${name}-${version}-${arch}.tar.xz" \
+      "${name}-${version}-${arch}.tar.xz" \
+      "${expected_checksum}" \
+      sha512sum
+      )
+    if [[ -z "$file" ]]; then
+      echo "Download failed" >&2
+      exit 1;
+    fi
+    bsdtar -C "$(find_tool_path)" -xf "${file}"
+  else
+
+    # fix version, only for go 1.20 and below
+    fversion=${TOOL_VERSION}
+    if [[ ($MAJOR -lt 1 || ($MAJOR -eq 1 && $MINOR -lt 21)) && "${PATCH}" == "0" ]]; then
+      fversion="${MAJOR}.${MINOR}"
+    fi
+
+    if [[ "${arch}" = "aarch64" ]]; then
+      arch=arm64
+    else
+      arch=amd64
+    fi
 
-  file=$(get_from_url "https://dl.google.com/go/go${GOLANG_FILE_VERSION}.${arch}.tar.gz")
+    now=$(date +%Y%m%d%H) # cache for one hour
+    checksum_file=$(get_from_url "https://go.dev/dl/?mode=json&include=all&_=${now}" "go-versions.${now}.json")
+    expected_checksum="$(jq -r ".[] | select(.version == \"go${fversion}\") | .files[] | select(.os == \"linux\" and .arch == \"${arch}\") | .sha256" < "${checksum_file}")"
 
-  versioned_tool_path=$(create_versioned_tool_path)
-  tar --strip 1 -C "${versioned_tool_path}" -xf "${file}"
+    file=$(get_from_url \
+      "https://dl.google.com/go/go${fversion}.linux-${arch}.tar.gz" \
+      "${name}-${version}-${arch}.tar.gz" \
+      "${expected_checksum}" \
+      sha256sum
+      )
+
+    if [[ -z "$file" ]]; then
+      echo "Download failed" >&2
+      exit 1;
+    fi
+    versioned_tool_path=$(create_versioned_tool_path)
+    bsdtar --strip 1 -C "${versioned_tool_path}" -xf "${file}"
+  fi
 }
 
 function link_tool () {