1# This image was created with the following 2 docker commands: 2#FROM debian:bullseye-slim 3#RUN apt-get update && \ 4# apt-get install -y clang openjdk-11-jdk-headless \ 5# fonts-dejavu-extra fonts-noto-core fonts-noto-cjk \ 6# fonts-noto-color-emoji 7# 8# Then, after seeing what the hash was of the base image and what versions of clang and the JDK 9# were installed, those versions were pinned and the image was rebuilt and pushed to make sure 10# those precise versions were used. This is to reach at least SLSA level 1 in that we know exactly 11# what versions of the binaries are installed on the images we used to build things. 12# 13# Base Image Notes: 14# I would like to be on debian:bookworm, but ran into 15# https://medium.com/nttlabs/ubuntu-21-10-and-fedora-35-do-not-work-on-docker-20-10-9-1cd439d9921 16# so had to go back to bullseye. 17# 18# Package Notes: 19# clang, openjdk: Bazel needs a default C++ compiler and Java runtime, but this will not be used 20# to build Skia code. 21# fonts-dejavu-extra: The default fonts-dejavu-core do not have an italic font 22# fonts-noto-*: Coverage for many gms that test fonts 23# zip: Needed by Bazel to generate a ZIP file under //bazel-testlogs with any undeclared test 24# outputs (used e.g. to recover images produced by GM tests). 25FROM debian@sha256:b46fc4e6813f6cbd9f3f6322c72ab974cc0e75a72ca02730a8861e98999875c7 26 27# Please keep each package in a separate line to facilitate bulk-removing the pinned versions (e.g. 28# with multiple cursors in VSCode or Sublime Text) as instructed in the README.md file. 29RUN apt-get update && \ 30 apt-get install -y \ 31 clang=1:11.0-51+nmu5 \ 32 openjdk-11-jdk-headless=11.0.18+10-1~deb11u1 \ 33 fonts-dejavu-extra=2.37-2 \ 34 fonts-noto-core=20201225-1 \ 35 fonts-noto-cjk=1:20201206-cjk+repack1-1 \ 36 fonts-noto-color-emoji=0~20200916-1 \ 37 zip=3.0-12 38 39ENV JAVA_HOME="/usr/lib/jvm/java-11-openjdk-amd64/" 40