archetech / archon / 33271007751

87%

push

github

perf(ci): Cross-compile the Rust gatekeeper instead of emulating it (#960)

* perf(ci): Cross-compile the Rust gatekeeper instead of emulating it

Building this image for arm64 took 59 minutes of a 63-minute publish --
a Rust release build executed instruction by instruction through QEMU,
while the other 26 images finished inside that window (#957). Nothing in
it needs to run as the target architecture; only the output does.

The builder stage now pins to $BUILDPLATFORM and cross-compiles, so cargo
runs natively and emits an aarch64 binary. Only the runtime stage is the
target architecture, and it copies a binary rather than compiling one.

Two things had to be true for this to be tractable, and both were worth
checking before starting. The TLS stack is rustls rather than OpenSSL, so
there is no openssl-sys to cross-build. But several dependencies do
compile C -- rusqlite is `bundled`, and rustls pulls in ring -- so a C
cross-toolchain is needed alongside the Rust target.

The libc headers are a separate package from the compiler, and
--no-install-recommends does not pull them in. Without them the build
fails inside ring with `bits/libc-header-start.h: No such file or
directory`, which reads like a missing header and is actually a missing
sysroot: the cross gcc is selected correctly, invoked correctly, and then
falls through to the host's /usr/include.

Verified locally as far as the dependency tree allowed -- ring compiles,
and the build reaches mongodb and reqwest -- but a cold cross-compile of
this tree outlasts a convenient local timeout, and a laptop is not the
runner anyway.

So the change verifies itself: a CI job cross-compiles this image for
arm64 on every push. Nothing else in CI builds for a foreign
architecture, which is why the QEMU omission in #956 passed 42 checks.
No scan and no load on that leg, since both need the image in the local
daemon and a foreign-architecture build cannot provide it.

* docs: Make the comments describe the cod... (continued)

3881 of 4464 branches covered (86.94%)

Branch coverage included in aggregate %.

8527 of 8952 relevant lines covered (95.25%)

717.63 hits per line