The WeaveSignal contributors
466b32ab6a
The first public release. What it does: https://weavesignal.top; what changed: CHANGELOG.md.
55 lines
3.3 KiB
Docker
55 lines
3.3 KiB
Docker
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# SPDX-FileCopyrightText: 2026 The WeaveSignal contributors
|
|
#
|
|
# The studio app's Windows installer, cross-built on Linux (ADR-0015, ADR-0076): the GNU target
|
|
# (MinGW-w64) and NSIS from Debian 13. The MSVC target would need Microsoft's SDK and CRT
|
|
# through cargo-xwin, which asks its user to accept Microsoft's licence; the GNU target needs
|
|
# neither. Tauri's installer script needs NSIS 3.09 or later (Ubuntu 22.04 has 3.08, which lacks
|
|
# Win\RestartManager.nsh), so this is not built on the Linux build image. Not signed (ADR-0076).
|
|
#
|
|
# Build: just desktop-windows-image
|
|
# Pinned like the Linux image: rustup and the Tauri CLI's source by SHA-256, the Rust toolchain by
|
|
# version; the bundler's one download (an NSIS plugin) by deploy/desktop/tools.lock. NSIS itself
|
|
# is Debian's package.
|
|
FROM docker.io/library/debian:13
|
|
ARG RUST_VERSION=1.98.1
|
|
ARG TAURI_CLI_VERSION=2.12.4
|
|
ARG TAURI_CLI_SHA256=9966558da94fd1c9485d0d78f12233bea5fd4235826fb78e930fe7a26910b956
|
|
ARG RUSTUP_VERSION=1.29.2
|
|
ARG RUSTUP_INIT_SHA256=5be191e8c70a5007074254cb74d78dbfdd25cd5a61c27de7b8e5410122ec24f4
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
RUSTUP_HOME=/opt/rustup \
|
|
CARGO_HOME=/opt/cargo \
|
|
PATH=/opt/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential ca-certificates curl pkg-config libssl-dev \
|
|
gcc-mingw-w64-x86-64 g++-mingw-w64-x86-64 binutils-mingw-w64-x86-64 nsis \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& makensis -VERSION
|
|
# rustup, pinned: the installer binary of an exact version, checked against its SHA-256, then
|
|
# the workspace's Rust. (Not `curl sh.rustup.rs | sh`, which runs whatever is current.) rustup
|
|
# checks each toolchain component it downloads against the channel manifest's hashes.
|
|
RUN set -eu; [ "$(uname -m)" = x86_64 ] || { echo "this image builds on x86_64 only"; exit 1; }; \
|
|
curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/rustup-init \
|
|
"https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/x86_64-unknown-linux-gnu/rustup-init" \
|
|
&& echo "${RUSTUP_INIT_SHA256} /tmp/rustup-init" | sha256sum -c - \
|
|
&& chmod +x /tmp/rustup-init \
|
|
&& /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain "${RUST_VERSION}" \
|
|
&& rm /tmp/rustup-init \
|
|
&& rustup target add x86_64-pc-windows-gnu
|
|
|
|
# The same Tauri CLI the studio app's package.json pins: its source from crates.io, checked
|
|
# against its SHA-256, built with the lock file inside the crate (--locked), whose own checksums
|
|
# pin every dependency.
|
|
RUN curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/tauri-cli.crate \
|
|
"https://static.crates.io/crates/tauri-cli/tauri-cli-${TAURI_CLI_VERSION}.crate" \
|
|
&& echo "${TAURI_CLI_SHA256} /tmp/tauri-cli.crate" | sha256sum -c - \
|
|
&& tar -xzf /tmp/tauri-cli.crate -C /tmp \
|
|
&& cargo install --locked --path "/tmp/tauri-cli-${TAURI_CLI_VERSION}" \
|
|
&& rm -rf /tmp/tauri-cli* /opt/cargo/registry /opt/cargo/git \
|
|
&& cargo tauri --version
|
|
LABEL org.opencontainers.image.title="weavesignal-desktop-windows-build" \
|
|
org.opencontainers.image.description="WeaveSignal studio app: Windows NSIS cross-build image (Debian 13, MinGW-w64, NSIS, Tauri CLI)" \
|
|
org.opencontainers.image.licenses="AGPL-3.0-only"
|
|
CMD ["cargo", "tauri", "--version"]
|