Test build for #2110

.obs/workflows.yml

@@ -237,6 +237,10 @@ staging_build:
         source_project: home:defolos:BCI:CR:SLE-15-SP6
         source_package: spack-image
         target_project: home:defolos:BCI:CR:SLE-15-SP6:Staging
+    - branch_package:
+        source_project: home:defolos:BCI:CR:SLE-15-SP6
+        source_package: stunnel-image
+        target_project: home:defolos:BCI:CR:SLE-15-SP6:Staging
   filters:
     event: pull_request
 
@@ -431,6 +435,9 @@ refresh_devel_BCI:
     - trigger_services:
         project: devel:BCI:SLE-15-SP6
         package: spack-image
+    - trigger_services:
+        project: devel:BCI:SLE-15-SP6
+        package: stunnel-image
   filters:
     event: push
     branches:

stunnel-image/Dockerfile

@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: MIT
+
+#     Copyright (c) 2024 SUSE LLC
+
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon.
+
+# The content of THIS FILE IS AUTOGENERATED and should not be manually modified.
+# It is maintained by the BCI team and generated by
+# https://github.com/SUSE/BCI-dockerfile-generator
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+# You can contact the BCI team via https://github.com/SUSE/bci/discussions
+
+#!UseOBSRepositories
+#!ExclusiveArch: aarch64 x86_64
+#!BuildTag: containers/stunnel:%%stunnel_re%%-%RELEASE%
+#!BuildTag: containers/stunnel:%%stunnel_re%%
+#!BuildTag: containers/stunnel:5
+#!BuildTag: containers/stunnel:latest
+#!ForceMultiVersion
+#!BuildName: containers-stunnel-5
+#!BuildVersion: %%stunnel_re%%
+#!BuildRelease: 35
+FROM registry.suse.com/bci/bci-micro:15.6 AS target
+FROM bci/bci-base:15.6 AS builder
+COPY --from=target / /target
+
+RUN set -euo pipefail; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends stunnel; \
+    zypper -n clean; \
+    rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
+# sanity check that the version from the tag is equal to the version of stunnel that we expect
+RUN set -euo pipefail; \
+    [ "$(rpm --root /target -q --qf '%{version}' stunnel | \
+    cut -d '.' -f -1)" = "5" ]
+FROM registry.suse.com/bci/bci-micro:15.6
+COPY --from=builder /target /
+# Define labels according to https://en.opensuse.org/Building_derived_containers
+# labelprefix=com.suse.application.stunnel
+LABEL org.opencontainers.image.authors=""
+LABEL org.opencontainers.image.title="Stunnel"
+LABEL org.opencontainers.image.description="Stunnel container based on the SLE Base Container Image."
+LABEL org.opencontainers.image.version="%%stunnel_re%%"
+LABEL org.opencontainers.image.url="https://apps.rancher.io/applications/stunnel"
+LABEL org.opencontainers.image.created="%BUILDTIME%"
+LABEL org.opencontainers.image.vendor="SUSE LLC"
+LABEL org.opencontainers.image.source="%SOURCEURL%"
+LABEL org.opencontainers.image.ref.name="%%stunnel_re%%-%RELEASE%"
+LABEL org.opensuse.reference="dp.apps.rancher.io/containers/stunnel:%%stunnel_re%%-%RELEASE%"
+LABEL org.openbuildservice.disturl="%DISTURL%"
+LABEL com.suse.supportlevel="techpreview"
+LABEL com.suse.eula="sle-eula"
+LABEL com.suse.lifecycle-url="https://www.suse.com/lifecycle#suse-linux-enterprise-server-15"
+LABEL com.suse.release-stage="released"
+# endlabelprefix
+LABEL org.opencontainers.image.base.name="%BASE_REFNAME%"
+LABEL org.opencontainers.image.base.digest="%BASE_DIGEST%"
+LABEL io.artifacthub.package.readme-url="%SOURCEURL%/README.md"
+COPY entrypoint.sh /usr/local/bin/
+COPY stunnel.conf /etc/stunnel/stunnel.conf
+RUN set -euo pipefail; chmod 0755 /usr/local/bin/entrypoint.sh;     chown --recursive stunnel /etc/stunnel
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["/usr/sbin/stunnel"]
+USER stunnel

stunnel-image/README.md

@@ -0,0 +1,80 @@
+# Stunnel Container Image
+
+![Support Level](https://img.shields.io/badge/Support_Level-techpreview-blue)[![SLSA](https://img.shields.io/badge/SLSA_(v1.0)-Build_L3-Green)](https://documentation.suse.com/sbp/server-linux/html/SBP-SLSA4/)
+[![Provenance: Available](https://img.shields.io/badge/Provenance-Available-Green)](https://documentation.suse.com/container/all/html/Container-guide/index.html#container-verify)
+
+
+## Description
+
+Stunnel is an open-source multi-platform application that provides a universal
+TLS/SSL tunneling service.
+
+
+## How to use this image
+
+By default, the Stunnel container image launches `stunnel` using a minimal
+configuration file that specifies the following:
+- run in foreground
+- load further configuration files from `/etc/stunnel/conf.d`
+
+Custom configuration files must be placed into the directory
+`/etc/stunnel/conf.d`.
+
+The container entry point configures TLS/SSL automatically by setting the key
+and certificate to the values of the environment variables `STUNNEL_KEY` and
+`STUNNEL_CERT`. If one of the environment variables is unset, then the
+entrypoint defaults to `/etc/stunnel/stunnel.key` for `STUNNEL_KEY` and
+`/etc/stunnel/stunnel.pem` for `STUNNEL_CERT`.
+
+The entrypoint can set up a single service via environment variables, so that the
+user doesn't have to write and mount their own configuration file. This can be
+specified via the environment variables `STUNNEL_SERVICE_NAME`, `STUNNEL_ACCEPT` and
+`STUNNEL_CONNECT`:
+
+- `STUNNEL_SERVICE_NAME`: name or otherwise unique identifier of the service
+  (used for documentation purpose only)
+
+- `STUNNEL_ACCEPT`: address on which new connections should be accepted. It can be
+  either a hostname and a port number or just a port number (in which case, localhost is
+  assumed to be the host)
+
+- `STUNNEL_CONNECT`: address on which the unencrypted service is listening and
+  to which stunnel connects. It can be either a hostname and port number or just a
+  port number (in which case, localhost is assumed to be the host)
+
+
+For example, to create an SSL endpoint for a webserver listening on port `8000`
+on localhost, run the following command:
+
+```bash
+podman run --rm -d \
+    -p 8443:8443 \
+    -e STUNNEL_SERVICE_NAME=webserver \
+    -e STUNNEL_ACCEPT=0.0.0.0:8443 \
+    -e STUNNEL_CONNECT=0.0.0.0:8000 \
+    -v=path/to/server.pem:/etc/stunnel/stunnel.pem:Z \
+    -v=path/to/server.crt:/etc/stunnel/stunnel.crt:Z \
+    dp.apps.rancher.io/containers/stunnel:5
+```
+
+
+### Pitfalls
+
+The Stunnel container image is configured to launch `stunnel` as the `stunnel`
+user. But by default, files mounted into a running container belong to the `root` user. Set the file permissions of mounted files accordingly, so that
+non-owners and non-group members can read them.
+
+Stunnel's `inetd` mode is not supported in the container image, and it does not ship a package manager for installing any services.
+
+
+## Licensing
+
+`SPDX-License-Identifier: MIT`
+
+This documentation and the build recipe are licensed as MIT.
+The container itself contains various software components under various open source licenses listed in the associated
+Software Bill of Materials (SBOM).
+
+This image is a tech preview. Do not use it for production.
+Your feedback is welcome.
+Please report any issues to the [SUSE Bugzilla](https://bugzilla.suse.com/enter_bug.cgi?product=SUSE%20Linux%20Enterprise%20Base%20Container%20Images).

stunnel-image/_service

@@ -0,0 +1,9 @@
+<services>
+  <service mode="buildtime" name="docker_label_helper"/>
+  <service mode="buildtime" name="kiwi_metainfo_helper"/>
+  <service mode="buildtime" name="replace_using_package_version">
+    <param name="file">Dockerfile</param>
+    <param name="regex">%%stunnel_re%%</param>
+    <param name="package">stunnel</param>
+  </service>
+</services>

stunnel-image/entrypoint.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -eo pipefail
+
+STUNNEL_CERT="${STUNNEL_CERT:-/etc/stunnel/stunnel.pem}"
+STUNNEL_KEY="${STUNNEL_KEY:-/etc/stunnel/stunnel.key}"
+
+if [[ -n ${STUNNEL_DEBUG} ]]; then
+    echo "debug = ${STUNNEL_DEBUG}" > /etc/stunnel/conf.d/000debug.conf
+fi
+
+conf="/etc/stunnel/conf.d/container-ssl.conf"
+echo "cert = ${STUNNEL_CERT}" > $conf
+echo "key = ${STUNNEL_KEY}" >> $conf
+
+
+if [[ -n "${STUNNEL_SERVICE_NAME}" ]] && [[ -n "${STUNNEL_ACCEPT}" ]] && [[ -n "${STUNNEL_CONNECT}" ]]; then
+    conf="/etc/stunnel/conf.d/container.conf"
+    echo "[${STUNNEL_SERVICE_NAME}]" > $conf
+    echo "accept = ${STUNNEL_ACCEPT}" >> $conf
+    echo "connect = ${STUNNEL_CONNECT}" >> $conf
+fi
+
+exec "$@"

stunnel-image/stunnel-image.changes

@@ -0,0 +1,4 @@
+-------------------------------------------------------------------
+Fri Dec 06 08:47:51 UTC 2024 - SUSE Update Bot <[email protected]>
+
+- First version of the Stunnel 5 BCI

stunnel-image/stunnel.conf

@@ -0,0 +1,2 @@
+foreground = yes
+include = /etc/stunnel/conf.d