v4.4.54

Release notes

Changes

• Added TFCPS_CodeUnitSpecific_Flutter_Functions.run_visual_regression_tests_in_container, which runs the visual-regression-tests of a flutter-codeunit (flutter test --tags visual-regression --run-skipped <folder>, optionally with --update-goldens) in a sibling-container of the SCBuilder-image so that the rendered images and their baselines are reproducible independently of the host. Like __build_linux_in_container and TFCPS_VisualRegressionTests it shares the codeunit with the sibling-container via --volumes-from instead of a bind-mount when it already runs inside a container (for example a scbuildcodeunits -c-run): a bind-mount of a path of the build-container would otherwise be resolved by the forwarded host-daemon to an empty directory, which made flutter abort with Expected to find project root in current working directory..
• Added the TrustedRootCA-mechanism, which lets a containerized build (scbuildcodeunits -c, scbuildcodeunitsc) trust additional root-CA-certificates - needed when a build pulls dependencies from a privately hosted registry (for example an internally hosted gitlab-nuget-source) whose certificate-chain is not publicly rooted. A CA is declared via one of three environment-variables on the host, where <name> becomes the filename inside the container's trust-store and must stay unique across the three forms:
  • TrustedRootCA_<name>_Path - absolute path to a PEM-file on the host; it is mounted read-only into the container.
  • TrustedRootCA_<name>_Content - inline PEM-content.
  • TrustedRootCA_<name>_ContentBase64 - inline PEM-content, base64-encoded (intended for CI-secret-stores which can not carry multiline values).
    TFCPS_CodeUnit_BuildCodeUnits.__collect_trusted_root_ca_arguments resolves these on the host and adds the resulting -v-/-e-arguments to the docker run-command of the build-container; the inline-forms are passed through the docker-client's own environment (not through argv), so their value never lands in the process-list. Fail-fast is applied on the host: a missing _Path-file or a file without the -----BEGIN CERTIFICATE------header aborts before the container is started. The actual installation happens in SCBuilder/EntryPoint.sh (updated in the matching SCBuilder-release), which writes the certificates into /usr/local/share/ca-certificates/ and runs update-ca-certificates once before any build-step, and the SSL_CERT_FILE/REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE/PIP_CERT/NODE_EXTRA_CA_CERTS-environment-variables are set to the system-bundle so that tools which carry their own bundle (python-requests, pip, curl, node) honor the injection too. The JVM is covered by ca-certificates-java installed in the Dockerfile of SCBuilder.
• Added the sctrustedrootcatobase64-CLI (ScriptCollection.Executables.TrustedRootCAToBase64), which reads a PEM-file and prints its content as a single base64-string; the output is intended as the value of a TrustedRootCA_<name>_ContentBase64-environment-variable for CI-pipelines whose secret-store can not carry multiline values.
• Added the sctrustedrootcas-CLI (ScriptCollection.Executables.ShowTrustedRootCAs), which lists the certificates currently installed in /usr/local/share/ca-certificates/. Intended to be run inside a build-container to verify that the TrustedRootCA-injection worked.