mirror of
https://github.com/Screenly/Anthias.git
synced 2026-07-30 09:15:51 -04:00
2eb16bed0c
* fix(image-builder): silence BuildKit FromPlatformFlagConstDisallowed - Drop the literal --platform on the Qt 5 sysroot stage; a bare FROM already defaults to the armhf target platform for pi2/pi3. - Route the Qt 5 host stage's mandatory amd64 pin through a global QT5_HOST_PLATFORM ARG declared in Dockerfile.viewer.j2, so it stays in scope for the FROM --platform in the included builder template. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(docker-build): attest build provenance for pushed images - Resolve each pushed <short-hash>-<board> image digest and mint keyless Sigstore build-provenance attestations via GitHub OIDC (same mechanism the SBOM workflow uses). - Attest server/viewer/redis on GHCR (hard-fail) and Docker Hub (best-effort, matching publish-latest's soft-fail mirror). - Grant the buildx job id-token: write + attestations: write. Attestations are by digest, so latest-<board> tags and both registries are covered; verify with `gh attestation verify oci://...`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(image-builder): correct stale webview-builder stage description The header's stage layout described webview-builder as running on $BUILDPLATFORM and installing Linaro's gcc-7.4.1 cross-compiler. Both are stale: the stage is pinned to linux/amd64 via QT5_HOST_PLATFORM (and the stage's own comment now explicitly warns that $BUILDPLATFORM would break it on an Apple Silicon host), and Linaro's tarball was dropped for Debian's crossbuild-essential-armhf when releases.linaro.org retired — the Linaro-named path survives only as a symlink shim for the frozen qmake.conf. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>