Build standalone binaries

.github/workflows/release.yml

@@ -73,8 +73,26 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           retention-days: 1
-          name: lambda-${{ matrix.targetarch }}
-          path: build/lambda-${{ matrix.targetarch }}.zip
+          name: lambda-linux-${{ matrix.targetarch }}
+          path: build/lambda-linux-${{ matrix.targetarch }}.zip
+
+      - name: Build Standalone Binary
+        uses: docker/build-push-action@v5
+        id: lambda
+        with:
+          context: .
+          file: Dockerfile.binaries
+          push: false
+          build-args: VERSION=${{ env.TRACKING_TAG }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=local,dest=build
+
+      - name: Upload Standalone Binary
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 1
+          name: dims-linux-${{ matrix.targetarch }}
+          path: build/dims-linux-${{ matrix.targetarch }}.zip
 
   manifest:
     needs: [build]
@@ -124,16 +142,26 @@ jobs:
 
       - uses: actions/download-artifact@v4
         with:
-          name: lambda-arm64
+          name: lambda-linux-arm64
+          path: ./build
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: lambda-linux-amd64
+          path: ./build
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dims-linux-arm64
           path: ./build
 
       - uses: actions/download-artifact@v4
         with:
-          name: lambda-amd64
+          name: dims-linux-amd64
           path: ./build
 
       - name: Upload to GitHub Release
-        run: gh release upload "$TAG_NAME" ./build/lambda-*.zip --repo "$GITHUB_REPOSITORY"
+        run: gh release upload "$TAG_NAME" ./build/lambda-*.zip ./build/dims-*.zip --repo "$GITHUB_REPOSITORY"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG_NAME: ${{ github.ref_name }}

Dockerfile

@@ -24,10 +24,17 @@ RUN --mount=type=cache,target=/gomod-cache --mount=type=cache,target=/go-cache \
     go mod download && \
     make static VERSION=${VERSION}
 
-# Generate sbom for go-dims binary
+# Generate sbom for distribution
 RUN sh go-dims/scripts/install-syft.sh && \
-    cd go-dims && \
-    /build/bin/syft file:build/dims -o spdx-json > go-dims.sbom.spdx.json
+    cd go-dims && mkdir -p build/sbom && \
+    /build/bin/syft file:build/dims -o spdx-json > build/sbom/go-dims.sbom.spdx.json && \
+    cp /build/apk.sbom.cdx.json build/sbom/apk.sbom.cdx.json && \
+    cp /usr/local/dims/libpng/sbom.cdx.json build/sbom/libpng.sbom.cdx.json && \
+    cp /usr/local/dims/libwebp/sbom.cdx.json build/sbom/libwebp.sbom.cdx.json && \
+    cp /usr/local/dims/libtiff/sbom.cdx.json build/sbom/libtiff.sbom.cdx.json && \
+    cp /usr/local/dims/glib-2.0/sbom.cdx.json build/sbom/glib-2.0.sbom.cdx.json && \
+    cp /usr/local/dims/libvips/sbom.cdx.json build/sbom/libvips.sbom.cdx.json && \
+    /build/bin/syft dir:build/sbom -o cyclonedx-json > build/sbom.cdx.json
 
 RUN cd go-dims && strip build/dims && upx build/dims
 
@@ -47,14 +54,8 @@ COPY --from=go-dims /build/go-dims/LICENSES /LICENSES
 COPY --from=go-dims /build/go-dims/LICENSE /LICENSE
 COPY --from=go-dims /build/go-dims/NOTICE /NOTICE
 
-# SBOMs
-COPY --from=go-dims /build/go-dims/go-dims.sbom.spdx.json /sbom.spdx.json
-COPY --from=go-dims /build/apk.sbom.cdx.json /sbom/apk.sbom.cdx.json
-COPY --from=go-dims /usr/local/dims/libpng/sbom.cdx.json /sbom/libpng.sbom.cdx.json
-COPY --from=go-dims /usr/local/dims/libwebp/sbom.cdx.json /sbom/libwebp.sbom.cdx.json
-COPY --from=go-dims /usr/local/dims/libtiff/sbom.cdx.json /sbom/libtiff.sbom.cdx.json
-COPY --from=go-dims /usr/local/dims/glib-2.0/sbom.cdx.json /sbom/glib-2.0.sbom.cdx.json
-COPY --from=go-dims /usr/local/dims/libvips/sbom.cdx.json /sbom/libvips.sbom.cdx.json
+# SBOM
+COPY --from=go-dims /build/go-dims/build/sbom.cdx.json /sbom.cdx.json
 
 ENV DIMS_LOG_FORMAT=json
 

Dockerfile.binaries

@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1.7-labs
+
+FROM ghcr.io/beetlebugorg/go-dims:builder AS go-dims
+ARG TARGETARCH
+RUN apk add zip
+COPY --exclude=build . /build/go-dims
+RUN --mount=type=cache,target=/gomod-cache --mount=type=cache,target=/go-cache \
+    cd go-dims && \
+    go env -w GOCACHE=/go-cache && \
+    go env -w GOMODCACHE=/gomod-cache && \
+    go mod download && \
+    make static
+
+# Generate sbom for binary distribution
+RUN sh go-dims/scripts/install-syft.sh && \
+    cd go-dims && mkdir build/sbom && \
+    /build/bin/syft file:build/dims -o spdx-json > build/sbom/go-dims.sbom.spdx.json && \
+    cp /build/apk.sbom.cdx.json build/sbom/apk.sbom.cdx.json && \
+    cp /usr/local/dims/libpng/sbom.cdx.json build/sbom/libpng.sbom.cdx.json && \
+    cp /usr/local/dims/libwebp/sbom.cdx.json build/sbom/libwebp.sbom.cdx.json && \
+    cp /usr/local/dims/libtiff/sbom.cdx.json build/sbom/libtiff.sbom.cdx.json && \
+    cp /usr/local/dims/glib-2.0/sbom.cdx.json build/sbom/glib-2.0.sbom.cdx.json && \
+    cp /usr/local/dims/libvips/sbom.cdx.json build/sbom/libvips.sbom.cdx.json && \
+    /build/bin/syft dir:build/sbom -o cyclonedx-json > build/sbom.cdx.json
+
+RUN cd go-dims && strip build/dims && upx build/dims && \
+    cp NOTICE build/NOTICE && cp LICENSE build/LICENSE && \
+    cd build && zip dims-linux-${TARGETARCH}.zip dims sbom.cdx.json LICENSE NOTICE
+
+FROM scratch AS export
+ARG TARGETARCH
+COPY --from=go-dims /build/go-dims/build/dims-linux-${TARGETARCH}.zip /dims-linux-${TARGETARCH}.zip

Dockerfile.lambda

@@ -9,9 +9,23 @@ RUN --mount=type=cache,target=/gomod-cache --mount=type=cache,target=/go-cache \
     go env -w GOCACHE=/go-cache && \
     go env -w GOMODCACHE=/gomod-cache && \
     go mod download && \
-    make lambda && \
-    mv build/lambda.zip build/lambda-${TARGETARCH}.zip
+    make lambda
+
+RUN sh go-dims/scripts/install-syft.sh && \
+    cd go-dims && mkdir build/sbom && \
+    /build/bin/syft file:build/bootstrap -o spdx-json > build/sbom/go-dims.sbom.spdx.json && \
+    cp /build/apk.sbom.cdx.json build/sbom/apk.sbom.cdx.json && \
+    cp /usr/local/dims/libpng/sbom.cdx.json build/sbom/libpng.sbom.cdx.json && \
+    cp /usr/local/dims/libwebp/sbom.cdx.json build/sbom/libwebp.sbom.cdx.json && \
+    cp /usr/local/dims/libtiff/sbom.cdx.json build/sbom/libtiff.sbom.cdx.json && \
+    cp /usr/local/dims/glib-2.0/sbom.cdx.json build/sbom/glib-2.0.sbom.cdx.json && \
+    cp /usr/local/dims/libvips/sbom.cdx.json build/sbom/libvips.sbom.cdx.json && \
+    /build/bin/syft dir:build/sbom -o cyclonedx-json > build/sbom.cdx.json
+
+RUN cd go-dims && strip build/bootstrap && upx build/bootstrap && \
+    cp NOTICE build/NOTICE && cp LICENSE build/LICENSE && \
+    cd build && zip lambda-linux-${TARGETARCH}.zip bootstrap sbom.cdx.json LICENSE NOTICE
 
 FROM scratch AS export
 ARG TARGETARCH
-COPY --from=go-dims /build/go-dims/build/lambda-${TARGETARCH}.zip /lambda-${TARGETARCH}.zip
+COPY --from=go-dims /build/go-dims/build/lambda-linux-${TARGETARCH}.zip /lambda-linux-${TARGETARCH}.zip

Makefile

@@ -21,12 +21,25 @@ static:
 	go generate ./...
 	go build -o $(BINARY) -ldflags $(STATIC_LDFLAGS) ./cmd/dims
 
+binary-amd64:
+	docker buildx build \
+      --platform linux/amd64 \
+      --build-arg TARGETARCH=amd64 \
+      -f Dockerfile.binaries \
+      --output type=local,dest=build .
+
+binary-arm64:
+	docker buildx build \
+      --platform linux/arm64 \
+      --build-arg TARGETARCH=arm64 \
+      -f Dockerfile.binaries \
+      --output type=local,dest=build .
+
 #-- Lambda targets
 
 lambda:
 	go generate ./...
 	go build -o $(LAMBDA_BINARY) -tags "lambda.norpc lambda" -ldflags $(STATIC_LDFLAGS) ./cmd/dims
-	upx $(BUILD_DIR)/bootstrap
 	cd $(BUILD_DIR) && zip lambda.zip bootstrap
 
 lambda-amd64: