containers: add build images and the Build Images workflow

.gitattributes

@@ -0,0 +1,3 @@
+# Scripts and Dockerfiles run inside Linux containers, keep LF also in Windows checkouts
+*.sh text eol=lf
+Dockerfile text eol=lf

.github/workflows/build-images.yml

@@ -0,0 +1,87 @@
+name: "Build Images"
+
+# Builds the packaging containers in containers/ and pushes them to
+# ghcr.io/vectorgrp/sil-kit-pkg/<name>. Pull requests only build.
+# release/packages.json pins the images by digest; the digest of each push is
+# written to the job summary.
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "containers/**"
+      - ".github/workflows/build-images.yml"
+  push:
+    branches: [main]
+    paths:
+      - "containers/**"
+      - ".github/workflows/build-images.yml"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.runs_on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { name: ubuntu-2004, runs_on: ubuntu-latest }
+          - { name: ubuntu-2204, runs_on: ubuntu-22.04-arm }
+          - { name: centos-7, runs_on: ubuntu-latest }
+          - { name: alma-8, runs_on: ubuntu-latest }
+          - { name: fedora-40, runs_on: ubuntu-latest }
+    env:
+      IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.name }}
+      PUSH: ${{ github.event_name != 'pull_request' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Log in to ghcr.io
+        if: env.PUSH == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=raw,value=main,enable={{is_default_branch}}
+            type=sha,prefix=sha-
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: containers/${{ matrix.name }}
+          build-contexts: |
+            utils=containers/utils
+          push: ${{ env.PUSH == 'true' }}
+          load: ${{ env.PUSH != 'true' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Smoke test
+        if: matrix.name != 'fedora-40'
+        run: |
+          ref="${{ env.IMAGE }}@${{ steps.build.outputs.digest }}"
+          [ "$PUSH" = "true" ] || ref="$(echo '${{ steps.meta.outputs.tags }}' | head -n1)"
+          docker run --rm "$ref" sh -c 'cmake --version && ninja --version && ${CXX:-g++} --version && python3 --version'
+
+      - name: Summary
+        if: env.PUSH == 'true'
+        run: |
+          echo "\`${{ env.IMAGE }}@${{ steps.build.outputs.digest }}\`" >> "$GITHUB_STEP_SUMMARY"

containers/alma-8/Dockerfile

@@ -0,0 +1,46 @@
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Build image for the AlmaLinux 8 (el8) tarball.
+# Toolchain: gcc-toolset-12 (gcc 12). Binaries built with it only need the system
+# libstdc++ of el8, the newer parts are linked statically by the toolset.
+# The base image is pinned by digest. AlmaLinux 8.10 repositories still receive
+# updates, so the installed versions are recorded in /etc/sil-kit-pkg-image-packages.txt;
+# reproducibility of the packages comes from pinning this image by digest.
+
+# almalinux:8
+FROM docker.io/library/almalinux@sha256:8b469a3a78515e8a18ea8fc727e6a3679e1d0c5ba6f58d5b30be3d0d9b86cffe
+
+ARG CMAKE_VERSION=4.3.4
+
+ENV LC_ALL=C.UTF-8
+ENV LANG=C.UTF-8
+
+COPY --from=utils install-cmake.sh /tmp/install-cmake.sh
+
+RUN dnf install -y dnf-plugins-core \
+&&  dnf config-manager --set-enabled powertools \
+&&  dnf install -y \
+      binutils \
+      file \
+      gcc-toolset-12-binutils \
+      gcc-toolset-12-dwz \
+      gcc-toolset-12-gcc \
+      gcc-toolset-12-gcc-c++ \
+      git \
+      make \
+      ninja-build \
+      python39 \
+      tar \
+      unzip \
+      which \
+      xz \
+&&  sh /tmp/install-cmake.sh \
+&&  rpm -qa --qf '%{NAME} %{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /etc/sil-kit-pkg-image-packages.txt \
+&&  dnf clean all \
+&&  rm -rf /var/cache/dnf /tmp/install-cmake.sh
+
+ENV PATH="/opt/rh/gcc-toolset-12/root/usr/bin:/opt/cmake/bin:${PATH}"
+ENV CC=/opt/rh/gcc-toolset-12/root/usr/bin/gcc
+ENV CXX=/opt/rh/gcc-toolset-12/root/usr/bin/g++

containers/centos-7/Dockerfile

@@ -0,0 +1,54 @@
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Build image for the CentOS 7 (el7) tarball.
+# CentOS 7 is EOL: all repositories point to vault.centos.org, which no longer changes.
+# Toolchain: devtoolset-11 (gcc 11). Binaries built with it only need the system
+# libstdc++ of CentOS 7, the newer parts are linked statically by the toolset.
+# Python: rh-python38, the packaging scripts need Python 3.7 or newer.
+
+# centos:7
+FROM docker.io/library/centos@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4
+
+ARG CMAKE_VERSION=4.3.4
+ARG NINJA_VERSION=1.13.2
+
+ENV LC_ALL=en_US.UTF-8
+ENV LANG=en_US.UTF-8
+
+COPY --from=utils install-cmake.sh /tmp/install-cmake.sh
+COPY --from=utils install-ninja.sh /tmp/install-ninja.sh
+
+RUN sed -i -e 's/^mirrorlist=/#mirrorlist=/' \
+           -e 's|^#\?baseurl=http://mirror.centos.org/centos/\$releasever|baseurl=https://vault.centos.org/7.9.2009|' \
+           /etc/yum.repos.d/CentOS-*.repo \
+&&  yum install -y centos-release-scl \
+&&  sed -i -e 's/^mirrorlist=/#mirrorlist=/' \
+           -e 's|^#\?\s*baseurl=http://mirror.centos.org/centos/7/sclo/|baseurl=https://vault.centos.org/7.9.2009/sclo/|' \
+           /etc/yum.repos.d/CentOS-SCLo-*.repo \
+&&  yum install -y \
+      binutils \
+      curl \
+      devtoolset-11-binutils \
+      devtoolset-11-dwz \
+      devtoolset-11-gcc \
+      devtoolset-11-gcc-c++ \
+      file \
+      git \
+      make \
+      rh-python38-python \
+      tar \
+      unzip \
+      which \
+      xz \
+&&  sh /tmp/install-cmake.sh \
+&&  sh /tmp/install-ninja.sh \
+&&  rpm -qa --qf '%{NAME} %{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /etc/sil-kit-pkg-image-packages.txt \
+&&  yum clean all \
+&&  rm -rf /var/cache/yum /tmp/install-*.sh
+
+ENV PATH="/opt/rh/devtoolset-11/root/usr/bin:/opt/rh/rh-python38/root/usr/bin:/opt/cmake/bin:${PATH}"
+ENV LD_LIBRARY_PATH="/opt/rh/devtoolset-11/root/usr/lib64:/opt/rh/devtoolset-11/root/usr/lib:/opt/rh/rh-python38/root/usr/lib64"
+ENV CC=/opt/rh/devtoolset-11/root/usr/bin/gcc
+ENV CXX=/opt/rh/devtoolset-11/root/usr/bin/g++

containers/fedora-40/Dockerfile

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Build image for the AlmaLinux 9 (el9) rpm, built with fedpkg/mock.
+# Taken over from sil-kit-docker-build containers/packaging-fedora.
+# mock needs the container to run with --privileged.
+
+# fedora:40
+FROM docker.io/library/fedora@sha256:3c86d25fef9d2001712bc3d9b091fc40cf04be4767e48f1aa3b785bf58d300ed
+
+RUN dnf -y install \
+      fedora-packager \
+      fedora-review \
+      git \
+&&  rpm -qa --qf '%{NAME} %{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /etc/sil-kit-pkg-image-packages.txt \
+&&  dnf clean all
+
+# Link the AlmaLinux 9 + EPEL mock config as epel-9
+RUN mkdir -p ~/.config/mock \
+&&  ln -sf /etc/mock/alma+epel-9-x86_64.cfg ~/.config/mock/epel-9-x86_64.cfg

containers/ubuntu-2004/Dockerfile

@@ -0,0 +1,61 @@
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Build image for the Ubuntu 20.04 packages (.deb and .tar.gz).
+# Package list follows ptv/docker-images dockerfiles/sil-kit-build/ubuntu-2004.
+# The base image is pinned by digest and apt reads from a fixed snapshot.ubuntu.com
+# timestamp, so a rebuild of this image installs the same package versions.
+
+# ubuntu:20.04
+FROM docker.io/library/ubuntu@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214
+
+ARG UBUNTU_SNAPSHOT=20261020T000000Z
+ARG CMAKE_VERSION=4.3.4
+
+ENV LC_ALL=C.UTF-8
+ENV LANG=C.UTF-8
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY --from=utils install-cmake.sh /tmp/install-cmake.sh
+
+# snapshot.ubuntu.com is served over https only, so ca-certificates comes from the
+# regular archive first. The snapshot service has no ubuntu-ports (arm64): there apt
+# reads the regular ports archive and the image digest pins the result.
+RUN apt-get update \
+&&  apt-get install --no-install-recommends --no-install-suggests -y ca-certificates \
+&&  sed -i -E \
+        -e "s#http://(archive|security)\.ubuntu\.com/ubuntu/?#https://snapshot.ubuntu.com/ubuntu/${UBUNTU_SNAPSHOT}/#" \
+        /etc/apt/sources.list \
+&&  apt-get update \
+&&  apt-get install --no-install-recommends --no-install-suggests -y \
+      binutils \
+      build-essential \
+      ca-certificates \
+      clang \
+      curl \
+      debhelper \
+      devscripts \
+      dh-make \
+      dpkg-dev \
+      doxygen \
+      dwz \
+      g++ \
+      gcc \
+      git \
+      gpg-agent \
+      locales \
+      ninja-build \
+      python3 \
+      python3-pip \
+      python3-venv \
+      software-properties-common \
+      tzdata \
+      wget \
+      zip \
+&&  sh /tmp/install-cmake.sh \
+&&  dpkg-query -W -f '${Package} ${Version}\n' > /etc/sil-kit-pkg-image-packages.txt \
+&&  apt-get clean \
+&&  rm -rf /var/lib/apt/lists/* /tmp/install-cmake.sh
+
+ENV PATH="/opt/cmake/bin:${PATH}"

containers/ubuntu-2204/Dockerfile

@@ -0,0 +1,61 @@
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Build image for the Ubuntu 22.04 packages (arm64 .deb, built natively on an arm64 runner).
+# Package list follows ptv/docker-images dockerfiles/sil-kit-build/ubuntu-2204.
+# The base image is pinned by digest and apt reads from a fixed snapshot.ubuntu.com
+# timestamp, so a rebuild of this image installs the same package versions.
+
+# ubuntu:22.04
+FROM docker.io/library/ubuntu@sha256:e0f80c829509ef4df9e76bd8944eb7b8ec25cbb379b112a7f9448b2c77a77c9b
+
+ARG UBUNTU_SNAPSHOT=20261020T000000Z
+ARG CMAKE_VERSION=4.3.4
+
+ENV LC_ALL=C.UTF-8
+ENV LANG=C.UTF-8
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY --from=utils install-cmake.sh /tmp/install-cmake.sh
+
+# snapshot.ubuntu.com is served over https only, so ca-certificates comes from the
+# regular archive first. The snapshot service has no ubuntu-ports (arm64): there apt
+# reads the regular ports archive and the image digest pins the result.
+RUN apt-get update \
+&&  apt-get install --no-install-recommends --no-install-suggests -y ca-certificates \
+&&  sed -i -E \
+        -e "s#http://(archive|security)\.ubuntu\.com/ubuntu/?#https://snapshot.ubuntu.com/ubuntu/${UBUNTU_SNAPSHOT}/#" \
+        /etc/apt/sources.list \
+&&  apt-get update \
+&&  apt-get install --no-install-recommends --no-install-suggests -y \
+      binutils \
+      build-essential \
+      ca-certificates \
+      clang \
+      curl \
+      debhelper \
+      devscripts \
+      dh-make \
+      dpkg-dev \
+      doxygen \
+      dwz \
+      g++ \
+      gcc \
+      git \
+      gpg-agent \
+      locales \
+      ninja-build \
+      python3 \
+      python3-pip \
+      python3-venv \
+      software-properties-common \
+      tzdata \
+      wget \
+      zip \
+&&  sh /tmp/install-cmake.sh \
+&&  dpkg-query -W -f '${Package} ${Version}\n' > /etc/sil-kit-pkg-image-packages.txt \
+&&  apt-get clean \
+&&  rm -rf /var/lib/apt/lists/* /tmp/install-cmake.sh
+
+ENV PATH="/opt/cmake/bin:${PATH}"

containers/utils/install-cmake.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Install the official Kitware CMake binary release into /opt/cmake-<version>-linux-<arch>
+# and link it as /opt/cmake. The archive is verified against the sha256 recorded below.
+set -eu
+
+CMAKE_VERSION="${CMAKE_VERSION:-4.3.4}"
+arch="$(uname -m)"
+
+case "${CMAKE_VERSION}-${arch}" in
+    4.3.4-x86_64)  sha256="ca6f08ccbd5e6b0a9068d33317d0d1aff7278d08cccaed4529b8fbead7942a68" ;;
+    4.3.4-aarch64) sha256="56a8014a8f28b8ff9cbe2c6fa8beebc028ac5b1987195d122b847fb486dc5282" ;;
+    *) echo "no sha256 known for cmake ${CMAKE_VERSION} on ${arch}" >&2; exit 2 ;;
+esac
+
+name="cmake-${CMAKE_VERSION}-linux-${arch}"
+url="https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}/${name}.tar.gz"
+
+cd /tmp
+curl -fsSL -o "${name}.tar.gz" "${url}"
+echo "${sha256}  ${name}.tar.gz" | sha256sum -c -
+tar -xzf "${name}.tar.gz" -C /opt
+rm -f "${name}.tar.gz"
+ln -sfn "/opt/${name}" /opt/cmake
+/opt/cmake/bin/cmake --version

containers/utils/install-ninja.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH
+#
+# SPDX-License-Identifier: MIT
+#
+# Install ninja from the official PyPI wheel (manylinux2014, runs on glibc 2.17).
+# The release binary on GitHub needs GLIBCXX_3.4.21 and does not run on CentOS 7.
+set -eu
+
+NINJA_VERSION="${NINJA_VERSION:-1.13.2}"
+
+case "${NINJA_VERSION}-$(uname -m)" in
+    1.13.2-x86_64) sha256="65a24341b5ac09fcadcc37082660be40a94174e51a937fabf6e2cae26225fa2c" ;;
+    *) echo "no sha256 known for ninja ${NINJA_VERSION} on $(uname -m)" >&2; exit 2 ;;
+esac
+
+wheel="ninja-${NINJA_VERSION}-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl"
+
+cd /tmp
+curl -fsSL -o "${wheel}" "https://files.pythonhosted.org/packages/py3/n/ninja/${wheel}"
+echo "${sha256}  ${wheel}" | sha256sum -c -
+unzip -o -j "${wheel}" "ninja-${NINJA_VERSION}.data/scripts/ninja" -d /usr/local/bin
+chmod 0755 /usr/local/bin/ninja
+rm -f "${wheel}"
+ninja --version