Add support for mariner rootfs build scenarios

[sbomer]

This makes a number of fixes to the rootfs build logic that enables running from a mariner host:

• Require signing keys for ubuntu and alpine packages (this is an attempt to better follow secure supply chain practices).
  • The alpine keys are included with the script.
  • Ubuntu signing keys are expected to be available on the host container.
  • Add a new --skipsigcheck argument that can be used to work around the requirement for signature checking locally if needed.
• Allow building x64 alpine rootfs.
• Fall back on [Use] debootstrap since qemu-debootstrap isn't available in mariner (and is deprecated upstream).
  • This will also create a minimal sysroot when using debootstrap, and force package signature checking.
  • I didn't force signature checking for qemu-debootstrap to avoid breaking existing scenarios.
• Verify checksum of apk-tools download.
• Don't try to install libnuma-dev on xenial arm (the package wasn't available). This is similar to the logic which excludes numactl-dev on alpine 3.13 arm. We will need to decide how to address this dependency when we turn on mariner arm builds, but this change at least allows building a xenial arm sysroot.

Contributes to dotnet/runtime#83428

[sbomer]

@am11 I'd appreciate your eyes on this too (I can't add you directly as a reviewer).

[am11]

Overall LGTM, thanks!

[am11]

nit: if we could avoid adding new files and instead burn keys lines exactly like the official script does: https://github.com/alpinelinux/alpine-chroot-install/blob/6d08f12a8a70dd9b9dc7d997c88aa7789cc03c42/alpine-chroot-install#L85-L133, that would be cleaner. (we already have too many small fragmented files than necessary in this part of the infra).

[am11]

The main consumer of this script is https://github.com/dotnet/dotnet-buildtools-prereqs-docker repo where it will always use the if branch. We should:

• invert this condition because qemu-debootstrap gives deprecation warning and tells us to use debootstrap
• move --keyring option in the conditions above which are missing it (riscv64 and armv6 already define --keyring and expect it to install it on the host)

[sbomer]

I am planning to add new build images in dotnet-buildtools-prereqs-docker based on CBL-mariner, which will use the fall-back. I wanted to minimize changes to the existing build images (which are used for servicing for example), but I will give it a try.

[sbomer]

I have switched this to always use debootstrap with the minbase package set. I locally built all of the dotnet-buildtools-prereqs-docker images which build a rootfs and it seemed to work with the changes in dotnet/dotnet-buildtools-prereqs-docker#829.

For the mariner builds I will do something similar and place the ubuntu keyring at the location that debootstrap expects by default, so no changes to the other cases were needed.

[am11]

I think we must not check in the full gpg key to git repo. As mentioned above, these keys are installed on the intended host system (docker builder layer primarily). The keys in the docker layer https://github.com/dotnet/dotnet-buildtools-prereqs-docker images are installed from Debian/Ubuntu servers, for which -- I believe -- the supply chain has a blanket trust.

[sbomer]

The mariner docker images which I plan to add don't have the ubuntu keyring available. Any suggestions?

[am11]

If we are going to acquire https://src.fedoraproject.org/rpms/debootstrap in mariner's base image, we can also acquire https://src.fedoraproject.org/rpms/debian-keyring and use the keys this package provides. (Debian keys usually work for Ubuntu and vice-versa)

[sbomer]

Changed this to require the debootstrap keyring to be available on the host. It will make this script less convenient to use in a vanilla mariner environment which doesn't have the signing keys available (they are not available in a mariner package either, whereas debootstrap is). To make local development less painful I've added an argument to allow skipping signature checks (which was the default before this change).

[sbomer]

@janvorli PTAL

[am11]

LGTM 👍

[janvorli]

LGTM, thank you!