From 78f195be87c5e436b87316d0ddaa0dfbeaf7bf6e Mon Sep 17 00:00:00 2001
From: Pavel Belevich <pbelevich@fb.com>
Date: Fri, 23 Apr 2021 17:56:16 -0400
Subject: [PATCH 1/2] Fix OpenSSL 1.1.1k for manywheel/conda/libtorch

[ghstack-poisoned]
---
 common/install_openssl.sh              |   2 +-
 conda/Dockerfile                       |  26 +++-
 libtorch/ubuntu16.04/Dockerfile        |  17 +++
 manywheel/Dockerfile                   | 175 ++++++++++++++-----------
 manywheel/build_scripts/build.sh       |   8 ++
 manywheel/build_scripts/build_utils.sh |   5 +-
 6 files changed, 145 insertions(+), 88 deletions(-)

diff --git a/common/install_openssl.sh b/common/install_openssl.sh
index ea234d46d..320d79f1f 100644
--- a/common/install_openssl.sh
+++ b/common/install_openssl.sh
@@ -8,6 +8,6 @@ wget -q -O ${OPENSSL}.tar.gz https://www.openssl.org/source/${OPENSSL}.tar.gz
 tar xf ${OPENSSL}.tar.gz
 cd ${OPENSSL}
 ./config -d '-Wl,--enable-new-dtags,-rpath,$(LIBRPATH)'
-make install
+make install_sw # Only install the OpenSSL software components.
 cd ..
 rm -rf ${OPENSSL}
diff --git a/conda/Dockerfile b/conda/Dockerfile
index 7132c2657..325158051 100644
--- a/conda/Dockerfile
+++ b/conda/Dockerfile
@@ -28,11 +28,6 @@ FROM base as patchelf
 ADD ./common/install_patchelf.sh install_patchelf.sh
 RUN bash ./install_patchelf.sh && rm install_patchelf.sh && cp $(which patchelf) /patchelf
 
-FROM base as openssl
-# Install openssl
-ADD ./common/install_openssl.sh install_openssl.sh
-RUN bash ./install_openssl.sh && rm install_openssl.sh
-
 FROM base as conda
 # Install Anaconda
 ADD ./common/install_conda.sh install_conda.sh
@@ -75,6 +70,11 @@ FROM base as mnist
 ADD ./common/install_mnist.sh install_mnist.sh
 RUN bash ./install_mnist.sh
 
+FROM base as openssl
+# Install openssl
+ADD ./common/install_openssl.sh install_openssl.sh
+RUN bash ./install_openssl.sh && rm install_openssl.sh
+
 FROM base as all_cuda
 COPY --from=cuda9.2   /usr/local/cuda-9.2  /usr/local/cuda-9.2
 COPY --from=cuda10.1  /usr/local/cuda-10.1 /usr/local/cuda-10.1
@@ -97,3 +97,19 @@ RUN chmod o+rw /usr/local
 RUN touch /.condarc && \
     chmod o+rw /.condarc && \
     chmod -R o+rw /opt/conda
+
+COPY --from=openssl  /usr/local/lib64/libcrypto.so.1.1       /usr/local/lib64/libcrypto.so.1.1
+COPY --from=openssl  /usr/local/lib64/libssl.so.1.1          /usr/local/lib64/libssl.so.1.1
+COPY --from=openssl  /usr/local/include/openssl/*            /usr/local/include/openssl/
+COPY --from=openssl  /usr/local/lib64/libcrypto.a            /usr/local/lib64/libcrypto.a
+COPY --from=openssl  /usr/local/lib64/libssl.a               /usr/local/lib64/libssl.a
+COPY --from=openssl  /usr/local/lib64/pkgconfig/libcrypto.pc /usr/local/lib64/pkgconfig/libcrypto.pc
+COPY --from=openssl  /usr/local/lib64/pkgconfig/libssl.pc    /usr/local/lib64/pkgconfig/libssl.pc
+COPY --from=openssl  /usr/local/lib64/pkgconfig/openssl.pc   /usr/local/lib64/pkgconfig/openssl.pc
+COPY --from=openssl  /usr/local/lib64/engines-1.1/afalg.so   /usr/local/lib64/engines-1.1/afalg.so
+COPY --from=openssl  /usr/local/lib64/engines-1.1/capi.so    /usr/local/lib64/engines-1.1/capi.so
+COPY --from=openssl  /usr/local/lib64/engines-1.1/padlock.so /usr/local/lib64/engines-1.1/padlock.so
+COPY --from=openssl  /usr/local/bin/openssl                  /usr/local/bin/openssl
+COPY --from=openssl  /usr/local/bin/c_rehash                 /usr/local/bin/c_rehash
+RUN ln -s /usr/local/lib64/libcrypto.so.1.1                  /usr/local/lib64/libcrypto.so
+RUN ln -s /usr/local/lib64/libssl.so.1.1                     /usr/local/lib64/libssl.so
diff --git a/libtorch/ubuntu16.04/Dockerfile b/libtorch/ubuntu16.04/Dockerfile
index d4062b408..58aa70ff0 100644
--- a/libtorch/ubuntu16.04/Dockerfile
+++ b/libtorch/ubuntu16.04/Dockerfile
@@ -10,6 +10,7 @@ ENV LC_ALL en_US.UTF-8
 ENV LANG en_US.UTF-8
 ENV LANGUAGE en_US.UTF-8
 
+FROM base as openssl
 # Install openssl
 ADD ./common/install_openssl.sh install_openssl.sh
 RUN bash ./install_openssl.sh && rm install_openssl.sh
@@ -64,3 +65,19 @@ COPY --from=intel /opt/intel /opt/intel
 # Install Anaconda
 COPY --from=conda /opt/conda /opt/conda
 ENV PATH /opt/conda/bin:$PATH
+
+COPY --from=openssl  /usr/local/lib/libcrypto.so.1.1       /usr/local/lib/libcrypto.so.1.1
+COPY --from=openssl  /usr/local/lib/libssl.so.1.1          /usr/local/lib/libssl.so.1.1
+COPY --from=openssl  /usr/local/include/openssl/*          /usr/local/include/openssl/
+COPY --from=openssl  /usr/local/lib/libcrypto.a            /usr/local/lib/libcrypto.a
+COPY --from=openssl  /usr/local/lib/libssl.a               /usr/local/lib/libssl.a
+COPY --from=openssl  /usr/local/lib/pkgconfig/libcrypto.pc /usr/local/lib/pkgconfig/libcrypto.pc
+COPY --from=openssl  /usr/local/lib/pkgconfig/libssl.pc    /usr/local/lib/pkgconfig/libssl.pc
+COPY --from=openssl  /usr/local/lib/pkgconfig/openssl.pc   /usr/local/lib/pkgconfig/openssl.pc
+COPY --from=openssl  /usr/local/lib/engines-1.1/afalg.so   /usr/local/lib/engines-1.1/afalg.so
+COPY --from=openssl  /usr/local/lib/engines-1.1/capi.so    /usr/local/lib/engines-1.1/capi.so
+COPY --from=openssl  /usr/local/lib/engines-1.1/padlock.so /usr/local/lib/engines-1.1/padlock.so
+COPY --from=openssl  /usr/local/bin/openssl                /usr/local/bin/openssl
+COPY --from=openssl  /usr/local/bin/c_rehash               /usr/local/bin/c_rehash
+RUN ln -s /usr/local/lib/libcrypto.so.1.1                  /usr/local/lib/libcrypto.so
+RUN ln -s /usr/local/lib/libssl.so.1.1                     /usr/local/lib/libssl.so
diff --git a/manywheel/Dockerfile b/manywheel/Dockerfile
index c00e5599e..3b90baa97 100644
--- a/manywheel/Dockerfile
+++ b/manywheel/Dockerfile
@@ -44,41 +44,41 @@ RUN rm -rf /opt/python/cp26-cp26mu /opt/_internal/cpython-2.6.9-ucs4
 RUN rm -rf /opt/python/cp33-cp33m /opt/_internal/cpython-3.3.6
 RUN rm -rf /opt/python/cp34-cp34m /opt/_internal/cpython-3.4.6
 
-FROM base as cuda
-ARG BASE_CUDA_VERSION=10.1
-# Install CUDA
-ADD ./common/install_cuda.sh install_cuda.sh
-RUN bash ./install_cuda.sh ${BASE_CUDA_VERSION} && rm install_cuda.sh
-
-FROM base as intel
-# MKL
-ADD ./common/install_mkl.sh install_mkl.sh
-RUN bash ./install_mkl.sh && rm install_mkl.sh
-
-# EPEL for cmake
-FROM base as patchelf
-# Install patchelf
-ADD ./common/install_patchelf.sh install_patchelf.sh
-RUN bash ./install_patchelf.sh && rm install_patchelf.sh
-RUN cp $(which patchelf) /patchelf
-
-FROM base as magma
-ARG BASE_CUDA_VERSION=10.1
-# Install magma
-ADD ./common/install_magma.sh install_magma.sh
-RUN bash ./install_magma.sh ${BASE_CUDA_VERSION} && rm install_magma.sh
-
-FROM base as jni
-# Install java jni header
-ADD ./common/install_jni.sh install_jni.sh
-ADD ./java/jni.h jni.h
-RUN bash ./install_jni.sh && rm install_jni.sh
-
-FROM base as libpng
-# Install libpng
-ADD ./common/install_libpng.sh install_libpng.sh
-RUN bash ./install_libpng.sh && rm install_libpng.sh
-
+# FROM base as cuda
+# ARG BASE_CUDA_VERSION=10.1
+# # Install CUDA
+# ADD ./common/install_cuda.sh install_cuda.sh
+# RUN bash ./install_cuda.sh ${BASE_CUDA_VERSION} && rm install_cuda.sh
+#
+# FROM base as intel
+# # MKL
+# ADD ./common/install_mkl.sh install_mkl.sh
+# RUN bash ./install_mkl.sh && rm install_mkl.sh
+#
+# # EPEL for cmake
+# FROM base as patchelf
+# # Install patchelf
+# ADD ./common/install_patchelf.sh install_patchelf.sh
+# RUN bash ./install_patchelf.sh && rm install_patchelf.sh
+# RUN cp $(which patchelf) /patchelf
+#
+# FROM base as magma
+# ARG BASE_CUDA_VERSION=10.1
+# # Install magma
+# ADD ./common/install_magma.sh install_magma.sh
+# RUN bash ./install_magma.sh ${BASE_CUDA_VERSION} && rm install_magma.sh
+#
+# FROM base as jni
+# # Install java jni header
+# ADD ./common/install_jni.sh install_jni.sh
+# ADD ./java/jni.h jni.h
+# RUN bash ./install_jni.sh && rm install_jni.sh
+#
+# FROM base as libpng
+# # Install libpng
+# ADD ./common/install_libpng.sh install_libpng.sh
+# RUN bash ./install_libpng.sh && rm install_libpng.sh
+#
 FROM ${GPU_IMAGE} as common
 ENV LC_ALL en_US.UTF-8
 ENV LANG en_US.UTF-8
@@ -108,48 +108,63 @@ RUN yum install -y \
 RUN yum swap -y git git224-core
 
 ENV SSL_CERT_FILE=/opt/_internal/certs.pem
-COPY --from=python   /opt/python                           /opt/python
-COPY --from=python   /opt/_internal                        /opt/_internal
-COPY --from=python   /opt/python/cp36-cp36m/bin/auditwheel /usr/local/bin/auditwheel
-COPY --from=intel    /opt/intel                            /opt/intel
-COPY --from=patchelf /usr/local/bin/patchelf               /usr/local/bin/patchelf
-COPY --from=jni      /usr/local/include/jni.h              /usr/local/include/jni.h
-COPY --from=libpng   /usr/local/bin/png*                   /usr/local/bin/
-COPY --from=libpng   /usr/local/bin/libpng*                /usr/local/bin/
-COPY --from=libpng   /usr/local/include/png*               /usr/local/include/
-COPY --from=libpng   /usr/local/include/libpng*            /usr/local/include/
-COPY --from=libpng   /usr/local/lib/libpng*                /usr/local/lib/
-COPY --from=libpng   /usr/local/lib/pkgconfig              /usr/local/lib/pkgconfig
-
-FROM common as cpu_final
-ARG BASE_CUDA_VERSION=10.1
-RUN yum install -y yum-utils centos-release-scl
-RUN yum-config-manager --enable rhel-server-rhscl-7-rpms
-RUN yum install -y devtoolset-7-gcc devtoolset-7-gcc-c++ devtoolset-7-gcc-gfortran devtoolset-7-binutils
-ENV PATH=/opt/rh/devtoolset-7/root/usr/bin:$PATH
-ENV LD_LIBRARY_PATH=/opt/rh/devtoolset-7/root/usr/lib64:/opt/rh/devtoolset-7/root/usr/lib:$LD_LIBRARY_PATH
-
-# cmake
-RUN yum install -y cmake3 && \
-    ln -s /usr/bin/cmake3 /usr/bin/cmake
-
-FROM cpu_final as cuda_final
-RUN rm -rf /usr/local/cuda-${BASE_CUDA_VERSION}
-COPY --from=cuda     /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
-COPY --from=magma    /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
-
-# Install LLVM version
-COPY --from=pytorch/llvm:9.0.1 /opt/llvm /opt/llvm
-
-FROM common as rocm_final
-ARG ROCM_VERSION=3.7
-# Install ROCm
-ADD ./common/install_rocm.sh install_rocm.sh
-RUN bash ./install_rocm.sh ${ROCM_VERSION} && rm install_rocm.sh
-# cmake is already installed inside the rocm base image, but both 2 and 3 exist
-# cmake3 is needed for the later MIOpen custom build, so that step is last.
-RUN yum install -y cmake3 && \
-    rm -f /usr/bin/cmake && \
-    ln -s /usr/bin/cmake3 /usr/bin/cmake
-ADD ./common/install_miopen.sh install_miopen.sh
-RUN bash ./install_miopen.sh ${ROCM_VERSION} && rm install_miopen.sh
+COPY --from=python  /usr/local/lib64/libcrypto.so.1.1     /usr/local/lib64/libcrypto.so.1.1
+COPY --from=python  /usr/local/lib64/libssl.so.1.1        /usr/local/lib64/libssl.so.1.1
+COPY --from=python  /usr/local/include/openssl/*          /usr/local/include/openssl/
+COPY --from=python  /usr/local/lib64/libcrypto.a          /usr/local/lib64/libcrypto.a
+COPY --from=python  /usr/local/lib64/libssl.a             /usr/local/lib64/libssl.a
+COPY --from=python  /usr/local/lib64/pkgconfig/libcrypto.pc /usr/local/lib64/pkgconfig/libcrypto.pc
+COPY --from=python  /usr/local/lib64/pkgconfig/libssl.pc  /usr/local/lib64/pkgconfig/libssl.pc
+COPY --from=python  /usr/local/lib64/pkgconfig/openssl.pc /usr/local/lib64/pkgconfig/openssl.pc
+COPY --from=python  /usr/local/lib64/engines-1.1/afalg.so /usr/local/lib64/engines-1.1/afalg.so
+COPY --from=python  /usr/local/lib64/engines-1.1/capi.so  /usr/local/lib64/engines-1.1/capi.so
+COPY --from=python  /usr/local/lib64/engines-1.1/padlock.so /usr/local/lib64/engines-1.1/padlock.so
+COPY --from=python  /usr/local/bin/openssl                /usr/local/bin/openssl
+COPY --from=python  /usr/local/bin/c_rehash               /usr/local/bin/c_rehash
+RUN ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/local/lib64/libcrypto.so
+RUN ln -s /usr/local/lib64/libssl.so.1.1 /usr/local/lib64/libssl.so
+# COPY --from=python   /opt/python                           /opt/python
+# COPY --from=python   /opt/_internal                        /opt/_internal
+# COPY --from=python   /opt/python/cp36-cp36m/bin/auditwheel /usr/local/bin/auditwheel
+# COPY --from=intel    /opt/intel                            /opt/intel
+# COPY --from=patchelf /usr/local/bin/patchelf               /usr/local/bin/patchelf
+# COPY --from=jni      /usr/local/include/jni.h              /usr/local/include/jni.h
+# COPY --from=libpng   /usr/local/bin/png*                   /usr/local/bin/
+# COPY --from=libpng   /usr/local/bin/libpng*                /usr/local/bin/
+# COPY --from=libpng   /usr/local/include/png*               /usr/local/include/
+# COPY --from=libpng   /usr/local/include/libpng*            /usr/local/include/
+# COPY --from=libpng   /usr/local/lib/libpng*                /usr/local/lib/
+# COPY --from=libpng   /usr/local/lib/pkgconfig              /usr/local/lib/pkgconfig
+#
+# FROM common as cpu_final
+# ARG BASE_CUDA_VERSION=10.1
+# RUN yum install -y yum-utils centos-release-scl
+# RUN yum-config-manager --enable rhel-server-rhscl-7-rpms
+# RUN yum install -y devtoolset-7-gcc devtoolset-7-gcc-c++ devtoolset-7-gcc-gfortran devtoolset-7-binutils
+# ENV PATH=/opt/rh/devtoolset-7/root/usr/bin:$PATH
+# ENV LD_LIBRARY_PATH=/opt/rh/devtoolset-7/root/usr/lib64:/opt/rh/devtoolset-7/root/usr/lib:$LD_LIBRARY_PATH
+#
+# # cmake
+# RUN yum install -y cmake3 && \
+#     ln -s /usr/bin/cmake3 /usr/bin/cmake
+#
+# FROM cpu_final as cuda_final
+# RUN rm -rf /usr/local/cuda-${BASE_CUDA_VERSION}
+# COPY --from=cuda     /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
+# COPY --from=magma    /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
+#
+# # Install LLVM version
+# COPY --from=pytorch/llvm:9.0.1 /opt/llvm /opt/llvm
+#
+# FROM common as rocm_final
+# ARG ROCM_VERSION=3.7
+# # Install ROCm
+# ADD ./common/install_rocm.sh install_rocm.sh
+# RUN bash ./install_rocm.sh ${ROCM_VERSION} && rm install_rocm.sh
+# # cmake is already installed inside the rocm base image, but both 2 and 3 exist
+# # cmake3 is needed for the later MIOpen custom build, so that step is last.
+# RUN yum install -y cmake3 && \
+#     rm -f /usr/bin/cmake && \
+#     ln -s /usr/bin/cmake3 /usr/bin/cmake
+# ADD ./common/install_miopen.sh install_miopen.sh
+# RUN bash ./install_miopen.sh ${ROCM_VERSION} && rm install_miopen.sh
diff --git a/manywheel/build_scripts/build.sh b/manywheel/build_scripts/build.sh
index cc84e1221..9cb467dbb 100644
--- a/manywheel/build_scripts/build.sh
+++ b/manywheel/build_scripts/build.sh
@@ -7,6 +7,10 @@ set -ex
 # Python versions to be installed in /opt/$VERSION_NO
 CPYTHON_VERSIONS=${CPYTHON_VERSIONS:-"3.6.6 3.7.5 3.8.1 3.9.0"}
 
+# openssl version to build, with expected sha256 hash of .tar.gz
+# archive
+OPENSSL_ROOT=openssl-1.1.1k
+OPENSSL_HASH=892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5
 DEVTOOLS_HASH=a8ebeb4bed624700f727179e6ef771dafe47651131a00a78b342251415646acc
 PATCHELF_HASH=d9afdff4baeacfbc64861454f368b7f2c15c44d245293f7587bbf726bfe722fb
 CURL_ROOT=curl-7.49.1
@@ -36,6 +40,10 @@ build_autoconf $AUTOCONF_ROOT $AUTOCONF_HASH
 autoconf --version
 
 # Compile the latest Python releases.
+# (In order to have a proper SSL module, Python is compiled
+# against a recent openssl [see env vars above], which is linked
+# statically. We delete openssl afterwards.)
+build_openssl $OPENSSL_ROOT $OPENSSL_HASH
 mkdir -p /opt/python
 build_cpythons $CPYTHON_VERSIONS
 
diff --git a/manywheel/build_scripts/build_utils.sh b/manywheel/build_scripts/build_utils.sh
index e957addfb..9f730666b 100755
--- a/manywheel/build_scripts/build_utils.sh
+++ b/manywheel/build_scripts/build_utils.sh
@@ -2,6 +2,7 @@
 # Helper utilities for build
 
 PYTHON_DOWNLOAD_URL=https://www.python.org/ftp/python
+OPENSSL_DOWNLOAD_URL=https://www.openssl.org/source/
 # Ditto the curl sources
 CURL_DOWNLOAD_URL=http://curl.askapache.com/download
 
@@ -90,8 +91,8 @@ function build_cpythons {
 
 
 function do_openssl_build {
-    ./config -d '-Wl,--enable-new-dtags,-rpath,$(LIBRPATH)' > /dev/null
-    make install > /dev/null
+    ./config no-ssl2 no-shared -fPIC --prefix=/usr/local/ssl > /dev/null
+    make install_sw > /dev/null # Only install the OpenSSL software components.
 }
 
 

From 20fafaf545cd518532af67f38e4fd177f7452562 Mon Sep 17 00:00:00 2001
From: Pavel Belevich <pbelevich@fb.com>
Date: Fri, 23 Apr 2021 17:57:51 -0400
Subject: [PATCH 2/2] Update on "Fix OpenSSL 1.1.1k for
 manywheel/conda/libtorch"

[ghstack-poisoned]
---
 manywheel/Dockerfile | 160 +++++++++++++++++++++----------------------
 1 file changed, 80 insertions(+), 80 deletions(-)

diff --git a/manywheel/Dockerfile b/manywheel/Dockerfile
index 3b90baa97..c76729a08 100644
--- a/manywheel/Dockerfile
+++ b/manywheel/Dockerfile
@@ -44,41 +44,41 @@ RUN rm -rf /opt/python/cp26-cp26mu /opt/_internal/cpython-2.6.9-ucs4
 RUN rm -rf /opt/python/cp33-cp33m /opt/_internal/cpython-3.3.6
 RUN rm -rf /opt/python/cp34-cp34m /opt/_internal/cpython-3.4.6
 
-# FROM base as cuda
-# ARG BASE_CUDA_VERSION=10.1
-# # Install CUDA
-# ADD ./common/install_cuda.sh install_cuda.sh
-# RUN bash ./install_cuda.sh ${BASE_CUDA_VERSION} && rm install_cuda.sh
-#
-# FROM base as intel
-# # MKL
-# ADD ./common/install_mkl.sh install_mkl.sh
-# RUN bash ./install_mkl.sh && rm install_mkl.sh
-#
-# # EPEL for cmake
-# FROM base as patchelf
-# # Install patchelf
-# ADD ./common/install_patchelf.sh install_patchelf.sh
-# RUN bash ./install_patchelf.sh && rm install_patchelf.sh
-# RUN cp $(which patchelf) /patchelf
-#
-# FROM base as magma
-# ARG BASE_CUDA_VERSION=10.1
-# # Install magma
-# ADD ./common/install_magma.sh install_magma.sh
-# RUN bash ./install_magma.sh ${BASE_CUDA_VERSION} && rm install_magma.sh
-#
-# FROM base as jni
-# # Install java jni header
-# ADD ./common/install_jni.sh install_jni.sh
-# ADD ./java/jni.h jni.h
-# RUN bash ./install_jni.sh && rm install_jni.sh
-#
-# FROM base as libpng
-# # Install libpng
-# ADD ./common/install_libpng.sh install_libpng.sh
-# RUN bash ./install_libpng.sh && rm install_libpng.sh
-#
+FROM base as cuda
+ARG BASE_CUDA_VERSION=10.1
+# Install CUDA
+ADD ./common/install_cuda.sh install_cuda.sh
+RUN bash ./install_cuda.sh ${BASE_CUDA_VERSION} && rm install_cuda.sh
+
+FROM base as intel
+# MKL
+ADD ./common/install_mkl.sh install_mkl.sh
+RUN bash ./install_mkl.sh && rm install_mkl.sh
+
+# EPEL for cmake
+FROM base as patchelf
+# Install patchelf
+ADD ./common/install_patchelf.sh install_patchelf.sh
+RUN bash ./install_patchelf.sh && rm install_patchelf.sh
+RUN cp $(which patchelf) /patchelf
+
+FROM base as magma
+ARG BASE_CUDA_VERSION=10.1
+# Install magma
+ADD ./common/install_magma.sh install_magma.sh
+RUN bash ./install_magma.sh ${BASE_CUDA_VERSION} && rm install_magma.sh
+
+FROM base as jni
+# Install java jni header
+ADD ./common/install_jni.sh install_jni.sh
+ADD ./java/jni.h jni.h
+RUN bash ./install_jni.sh && rm install_jni.sh
+
+FROM base as libpng
+# Install libpng
+ADD ./common/install_libpng.sh install_libpng.sh
+RUN bash ./install_libpng.sh && rm install_libpng.sh
+
 FROM ${GPU_IMAGE} as common
 ENV LC_ALL en_US.UTF-8
 ENV LANG en_US.UTF-8
@@ -123,48 +123,48 @@ COPY --from=python  /usr/local/bin/openssl                /usr/local/bin/openssl
 COPY --from=python  /usr/local/bin/c_rehash               /usr/local/bin/c_rehash
 RUN ln -s /usr/local/lib64/libcrypto.so.1.1 /usr/local/lib64/libcrypto.so
 RUN ln -s /usr/local/lib64/libssl.so.1.1 /usr/local/lib64/libssl.so
-# COPY --from=python   /opt/python                           /opt/python
-# COPY --from=python   /opt/_internal                        /opt/_internal
-# COPY --from=python   /opt/python/cp36-cp36m/bin/auditwheel /usr/local/bin/auditwheel
-# COPY --from=intel    /opt/intel                            /opt/intel
-# COPY --from=patchelf /usr/local/bin/patchelf               /usr/local/bin/patchelf
-# COPY --from=jni      /usr/local/include/jni.h              /usr/local/include/jni.h
-# COPY --from=libpng   /usr/local/bin/png*                   /usr/local/bin/
-# COPY --from=libpng   /usr/local/bin/libpng*                /usr/local/bin/
-# COPY --from=libpng   /usr/local/include/png*               /usr/local/include/
-# COPY --from=libpng   /usr/local/include/libpng*            /usr/local/include/
-# COPY --from=libpng   /usr/local/lib/libpng*                /usr/local/lib/
-# COPY --from=libpng   /usr/local/lib/pkgconfig              /usr/local/lib/pkgconfig
-#
-# FROM common as cpu_final
-# ARG BASE_CUDA_VERSION=10.1
-# RUN yum install -y yum-utils centos-release-scl
-# RUN yum-config-manager --enable rhel-server-rhscl-7-rpms
-# RUN yum install -y devtoolset-7-gcc devtoolset-7-gcc-c++ devtoolset-7-gcc-gfortran devtoolset-7-binutils
-# ENV PATH=/opt/rh/devtoolset-7/root/usr/bin:$PATH
-# ENV LD_LIBRARY_PATH=/opt/rh/devtoolset-7/root/usr/lib64:/opt/rh/devtoolset-7/root/usr/lib:$LD_LIBRARY_PATH
-#
-# # cmake
-# RUN yum install -y cmake3 && \
-#     ln -s /usr/bin/cmake3 /usr/bin/cmake
-#
-# FROM cpu_final as cuda_final
-# RUN rm -rf /usr/local/cuda-${BASE_CUDA_VERSION}
-# COPY --from=cuda     /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
-# COPY --from=magma    /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
-#
-# # Install LLVM version
-# COPY --from=pytorch/llvm:9.0.1 /opt/llvm /opt/llvm
-#
-# FROM common as rocm_final
-# ARG ROCM_VERSION=3.7
-# # Install ROCm
-# ADD ./common/install_rocm.sh install_rocm.sh
-# RUN bash ./install_rocm.sh ${ROCM_VERSION} && rm install_rocm.sh
-# # cmake is already installed inside the rocm base image, but both 2 and 3 exist
-# # cmake3 is needed for the later MIOpen custom build, so that step is last.
-# RUN yum install -y cmake3 && \
-#     rm -f /usr/bin/cmake && \
-#     ln -s /usr/bin/cmake3 /usr/bin/cmake
-# ADD ./common/install_miopen.sh install_miopen.sh
-# RUN bash ./install_miopen.sh ${ROCM_VERSION} && rm install_miopen.sh
+COPY --from=python   /opt/python                           /opt/python
+COPY --from=python   /opt/_internal                        /opt/_internal
+COPY --from=python   /opt/python/cp36-cp36m/bin/auditwheel /usr/local/bin/auditwheel
+COPY --from=intel    /opt/intel                            /opt/intel
+COPY --from=patchelf /usr/local/bin/patchelf               /usr/local/bin/patchelf
+COPY --from=jni      /usr/local/include/jni.h              /usr/local/include/jni.h
+COPY --from=libpng   /usr/local/bin/png*                   /usr/local/bin/
+COPY --from=libpng   /usr/local/bin/libpng*                /usr/local/bin/
+COPY --from=libpng   /usr/local/include/png*               /usr/local/include/
+COPY --from=libpng   /usr/local/include/libpng*            /usr/local/include/
+COPY --from=libpng   /usr/local/lib/libpng*                /usr/local/lib/
+COPY --from=libpng   /usr/local/lib/pkgconfig              /usr/local/lib/pkgconfig
+
+FROM common as cpu_final
+ARG BASE_CUDA_VERSION=10.1
+RUN yum install -y yum-utils centos-release-scl
+RUN yum-config-manager --enable rhel-server-rhscl-7-rpms
+RUN yum install -y devtoolset-7-gcc devtoolset-7-gcc-c++ devtoolset-7-gcc-gfortran devtoolset-7-binutils
+ENV PATH=/opt/rh/devtoolset-7/root/usr/bin:$PATH
+ENV LD_LIBRARY_PATH=/opt/rh/devtoolset-7/root/usr/lib64:/opt/rh/devtoolset-7/root/usr/lib:$LD_LIBRARY_PATH
+
+# cmake
+RUN yum install -y cmake3 && \
+    ln -s /usr/bin/cmake3 /usr/bin/cmake
+
+FROM cpu_final as cuda_final
+RUN rm -rf /usr/local/cuda-${BASE_CUDA_VERSION}
+COPY --from=cuda     /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
+COPY --from=magma    /usr/local/cuda-${BASE_CUDA_VERSION}  /usr/local/cuda-${BASE_CUDA_VERSION}
+
+# Install LLVM version
+COPY --from=pytorch/llvm:9.0.1 /opt/llvm /opt/llvm
+
+FROM common as rocm_final
+ARG ROCM_VERSION=3.7
+# Install ROCm
+ADD ./common/install_rocm.sh install_rocm.sh
+RUN bash ./install_rocm.sh ${ROCM_VERSION} && rm install_rocm.sh
+# cmake is already installed inside the rocm base image, but both 2 and 3 exist
+# cmake3 is needed for the later MIOpen custom build, so that step is last.
+RUN yum install -y cmake3 && \
+    rm -f /usr/bin/cmake && \
+    ln -s /usr/bin/cmake3 /usr/bin/cmake
+ADD ./common/install_miopen.sh install_miopen.sh
+RUN bash ./install_miopen.sh ${ROCM_VERSION} && rm install_miopen.sh