software: sketch out how to produce the built-in firmware in a more d…

…ifferently reproducible way

software/deploy-firmware.sh

@@ -1,53 +1,28 @@
-#!/bin/sh
+#!/bin/bash
+
+set -eo pipefail
 
 # This script is provided to ensure builds of firmware included in the repository are byte for byte
 # reproducible regardless of the host OS or the packages installed.
 #
 # Using this script is not a requirement to work on the firmware; installation instructions for
 # the prerequisites for a selection of operating systems are included in the documentation.
 
-BASE_IMAGE=debian:bookworm-slim
-
-if [ -z "${DOCKER}" ]; then
-    exec docker run \
-        --volume $(dirname $(dirname $(readlink -f $0))):/glasgow \
-        --workdir /glasgow \
-        --env DOCKER=1 \
-        --env UID=$(id -u) \
-        --env GID=$(id -g) \
-        --rm ${BASE_IMAGE} \
-        software/deploy-firmware.sh
+TOPDIR=$(dirname $(dirname $(readlink -f $0)))
+
+# We always want to have a matching container version for any given
+# historical version of firmware, so we either pull a container from the
+# GitHub container registry -- or, we build it locally.
+GITVER=$(git describe --always --dirty --exclude='*' --abbrev=7)
+IMAGE_NAME=glasgow/firmware-build:g$GITVER
+
+if [ -z "$(docker images -q $IMAGE_NAME)" ]; then
+	echo "no Docker image named $IMAGE_NAME -- building it (did you mean to docker pull it first, if you are trying to reproduce a build from CI?)"
+	docker build -t $IMAGE_NAME "$TOPDIR/software/docker"
+	if ! [ -z "$WE_ARE_IN_CI" ]; then
+		# docker push it to ghcr.io with creds that are stored...
+		true
+	fi
 fi
 
-set -ex
-
-# Install dependencies.
-apt-get update -qq
-apt-get install -qq --no-install-recommends git make sdcc
-
-# Any commands that create new files in the host mount must be invoked with the caller UID/GID, or
-# else the created files will be owned by root. We can't use `docker run --user` because then
-# apt-get would not be able to install packages.
-#
-# Create a user and a group with the UID/GID of the caller.
-groupadd --gid ${GID} caller
-useradd --uid ${UID} --gid ${GID} caller
-
-# Do the work.
-su caller - <<END
-
-# Display dependency versions.
-sdcc --version
-
-# Clean all build products; they may have been built using a different compiler.
-make -C vendor/libfx2/firmware/library clean
-make -C firmware clean
-
-# Build the artifact.
-make -C vendor/libfx2/firmware/library all MODELS=medium
-make -C firmware all
-
-# Deploy the artifact.
-cp firmware/glasgow.ihex software/glasgow/device/firmware.ihex
-
-END
+exec docker run --rm --user $(id -u) -v "$TOPDIR:/work" --rm $IMAGE_NAME

software/docker/Dockerfile

@@ -0,0 +1,7 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends git make sdcc
+RUN sdcc --version
+COPY build.sh /build.sh
+WORKDIR /work
+CMD /build.sh

software/docker/build.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -eo pipefail
+cd /work
+
+set -x
+
+sdcc --version
+
+# Clean all build products; they may have been built using a different compiler.
+make -C vendor/libfx2/firmware/library clean
+make -C firmware clean
+
+# Build the artifact.
+make -C vendor/libfx2/firmware/library all MODELS=medium
+make -C firmware all
+
+# Deploy the artifact.
+cp firmware/glasgow.ihex software/glasgow/device/firmware.ihex