THRIFT-5000: Restore Docker Official Image packaging

.github/workflows/docker.yml

@@ -0,0 +1,70 @@
+name: Docker Official Image
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'docker/**'
+      - '.github/workflows/docker.yml'
+  pull_request:
+    paths:
+      - 'docker/**'
+      - '.github/workflows/docker.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  bashbrew:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
+        with:
+          go-version: stable
+          cache: false
+
+      - name: Install Bashbrew
+        run: |
+          set -eux
+          GOBIN="$PWD/docker/tmp/bin" go install github.com/docker-library/bashbrew/cmd/bashbrew@v0.1.14
+          echo "$PWD/docker/tmp/bin" >> "$GITHUB_PATH"
+
+      - name: Validate Bashbrew manifest
+        run: |
+          set -eux
+          mkdir -p docker/tmp/bashbrew-library
+          (cd docker && GIT_COMMIT="$(git rev-parse HEAD)" ./generate-stackbrew-library.sh) > docker/tmp/bashbrew-library/thrift
+          BASHBREW_LIBRARY="$PWD/docker/tmp/bashbrew-library" bashbrew cat thrift >/dev/null
+          BASHBREW_LIBRARY="$PWD/docker/tmp/bashbrew-library" bashbrew list --build-order --uniq thrift >/dev/null
+
+  docker:
+    name: Docker (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-22.04
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - name: Verify Docker Buildx
+        run: docker buildx version
+
+      - name: Build and test Docker images
+        timeout-minutes: 90
+        run: docker/test.sh

doc/ReleaseManagement.md

@@ -370,6 +370,20 @@ Voting on the development mailing list provides additional benefits (wisdom from
 
 1. Update the web site content to include the new release. The repository is located at https://github.com/apache/thrift-website and there are plenty of instructions how to update both staging and live web site. With regard to the release, its actually quite simple: check out the main branch and edit two lines in _config.yml, then commit. The build bot will update staging. After checking everything is right, simply fast-forward "asf-site" to "asf-staging" and push, then production site will automatically get updated as well
 
+1. Update the Docker Official Image packaging. Docker images are convenience artifacts built from the voted ASF source release; they are not ASF release artifacts and must not block the source release announcement if Docker Library review is delayed. Submit Docker updates only after the vote has passed, release artifacts have been promoted, and the web site/download page has been updated.
+
+    The Docker Official Image library tracks the two latest full Apache Thrift releases. Initial restored Docker image maintenance starts with the current release only; older releases are not backfilled. `latest` and unqualified OS aliases move according to the newest retained release and the explicit base metadata in `docker/versions.json`.
+
+    ```bash
+    thrift$ cd docker
+    thrift/docker$ ./update.sh 1.0.0
+    thrift/docker$ ./test.sh --all-platforms
+    ```
+
+    `update.sh` records archive.apache.org source URLs so retained Docker tags remain rebuildable; if the archive has not synced yet, wait and rerun it. Commit and push the Docker packaging update to Apache Thrift before generating the Docker Library manifest. Then run `./generate-official-images-library.sh /path/to/official-images/library/thrift` from `thrift/docker`; Docker Library manifests are generated artifacts and are not checked into this repository.
+
+    See [`docker/README.md`](../docker/README.md) for the detailed Docker Official Images workflow. Include Docker image availability in the announcement only if the Docker tags have already landed; otherwise follow up after Docker Official Images publishes them.
+
 1. Make an announcement on the dev@ and user@ mailing lists of the release.  There's no template to follow, but you can point folks to the official web site at https://thrift.apache.org, and to the GitHub site at https://github.org/apache.thrift.
 
 ### Post-Release

docker/.dockerignore

@@ -0,0 +1 @@
+tmp/

docker/.gitignore

@@ -0,0 +1 @@
+/tmp/

docker/0.22.0/Dockerfile

@@ -0,0 +1,78 @@
+FROM debian:trixie AS builder
+
+ARG THRIFT_VERSION=0.22.0
+ARG THRIFT_SOURCE_URL=https://archive.apache.org/dist/thrift/0.22.0/thrift-0.22.0.tar.gz
+ARG THRIFT_SOURCE_SHA256=794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5
+ARG THRIFT_SOURCE_SIGNER=8CD87F186F06E958EFCA963D76BD340FC4B75865
+
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		bison \
+		ca-certificates \
+		cmake \
+		curl \
+		flex \
+		g++ \
+		gnupg \
+		make \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src
+
+RUN set -eux; \
+	curl -fsSL -o thrift.tar.gz "$THRIFT_SOURCE_URL"; \
+	curl -fsSL -o thrift.tar.gz.asc "$THRIFT_SOURCE_URL.asc"; \
+	curl -fsSL -o thrift-KEYS https://downloads.apache.org/thrift/KEYS; \
+	echo "$THRIFT_SOURCE_SHA256 *thrift.tar.gz" | sha256sum -c -; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	gpg --batch --import thrift-KEYS; \
+	gpg --batch --status-fd 1 --verify thrift.tar.gz.asc thrift.tar.gz > gpg.status; \
+	grep -F "[GNUPG:] VALIDSIG $THRIFT_SOURCE_SIGNER " gpg.status; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"; \
+	mkdir thrift; \
+	tar -xzf thrift.tar.gz -C thrift --strip-components=1; \
+	rm thrift.tar.gz thrift.tar.gz.asc thrift-KEYS gpg.status
+
+RUN set -eux; \
+	cmake -S thrift -B build \
+		-DCMAKE_BUILD_TYPE=Release \
+		-DBUILD_COMPILER=ON \
+		-DBUILD_LIBRARIES=OFF \
+		-DBUILD_TESTING=OFF \
+		-DBUILD_TUTORIALS=OFF; \
+	cmake --build build --target thrift-compiler -j "$(nproc)"; \
+	cmake --install build --prefix /opt/thrift
+
+FROM debian:trixie-slim
+
+ARG THRIFT_VERSION=0.22.0
+
+LABEL org.opencontainers.image.title="Apache Thrift Compiler" \
+	org.opencontainers.image.version="$THRIFT_VERSION" \
+	org.opencontainers.image.source="https://github.com/apache/thrift" \
+	org.opencontainers.image.url="https://thrift.apache.org/" \
+	org.opencontainers.image.licenses="Apache-2.0"
+
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends libstdc++6; \
+	rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /opt/thrift/bin/thrift /usr/local/bin/thrift
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY tests/smoke.thrift /tmp/smoke.thrift
+
+RUN set -eux; \
+	thrift --version | grep -F "$THRIFT_VERSION"; \
+	mkdir -p /tmp/smoke-out; \
+	thrift --gen json -o /tmp/smoke-out /tmp/smoke.thrift; \
+	find /tmp/smoke-out -type f | grep -q .; \
+	rm -rf /tmp/smoke.thrift /tmp/smoke-out
+
+WORKDIR /data
+
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["thrift"]

docker/0.22.0/Dockerfile.alpine

@@ -0,0 +1,74 @@
+FROM alpine:3.23 AS builder
+
+ARG THRIFT_VERSION=0.22.0
+ARG THRIFT_SOURCE_URL=https://archive.apache.org/dist/thrift/0.22.0/thrift-0.22.0.tar.gz
+ARG THRIFT_SOURCE_SHA256=794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5
+ARG THRIFT_SOURCE_SIGNER=8CD87F186F06E958EFCA963D76BD340FC4B75865
+
+RUN set -eux; \
+	apk add --no-cache \
+		bison \
+		build-base \
+		ca-certificates \
+		cmake \
+		curl \
+		flex \
+		gnupg \
+	; \
+	update-ca-certificates
+
+WORKDIR /usr/src
+
+RUN set -eux; \
+	curl -fsSL -o thrift.tar.gz "$THRIFT_SOURCE_URL"; \
+	curl -fsSL -o thrift.tar.gz.asc "$THRIFT_SOURCE_URL.asc"; \
+	curl -fsSL -o thrift-KEYS https://downloads.apache.org/thrift/KEYS; \
+	echo "$THRIFT_SOURCE_SHA256 *thrift.tar.gz" | sha256sum -c -; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	gpg --batch --import thrift-KEYS; \
+	gpg --batch --status-fd 1 --verify thrift.tar.gz.asc thrift.tar.gz > gpg.status; \
+	grep -F "[GNUPG:] VALIDSIG $THRIFT_SOURCE_SIGNER " gpg.status; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"; \
+	mkdir thrift; \
+	tar -xzf thrift.tar.gz -C thrift --strip-components=1; \
+	rm thrift.tar.gz thrift.tar.gz.asc thrift-KEYS gpg.status
+
+RUN set -eux; \
+	cmake -S thrift -B build \
+		-DCMAKE_BUILD_TYPE=Release \
+		-DBUILD_COMPILER=ON \
+		-DBUILD_LIBRARIES=OFF \
+		-DBUILD_TESTING=OFF \
+		-DBUILD_TUTORIALS=OFF; \
+	cmake --build build --target thrift-compiler -j "$(nproc)"; \
+	cmake --install build --prefix /opt/thrift
+
+FROM alpine:3.23
+
+ARG THRIFT_VERSION=0.22.0
+
+LABEL org.opencontainers.image.title="Apache Thrift Compiler" \
+	org.opencontainers.image.version="$THRIFT_VERSION" \
+	org.opencontainers.image.source="https://github.com/apache/thrift" \
+	org.opencontainers.image.url="https://thrift.apache.org/" \
+	org.opencontainers.image.licenses="Apache-2.0"
+
+RUN set -eux; \
+	apk add --no-cache libstdc++
+
+COPY --from=builder /opt/thrift/bin/thrift /usr/local/bin/thrift
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY tests/smoke.thrift /tmp/smoke.thrift
+
+RUN set -eux; \
+	thrift --version | grep -F "$THRIFT_VERSION"; \
+	mkdir -p /tmp/smoke-out; \
+	thrift --gen json -o /tmp/smoke-out /tmp/smoke.thrift; \
+	find /tmp/smoke-out -type f | grep -q .; \
+	rm -rf /tmp/smoke.thrift /tmp/smoke-out
+
+WORKDIR /data
+
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["thrift"]

docker/0.23.0/Dockerfile

@@ -0,0 +1,78 @@
+FROM debian:trixie AS builder
+
+ARG THRIFT_VERSION=0.23.0
+ARG THRIFT_SOURCE_URL=https://archive.apache.org/dist/thrift/0.23.0/thrift-0.23.0.tar.gz
+ARG THRIFT_SOURCE_SHA256=1859d932d2ae1f13d16c5a196931208c116310a5ff50f2bfd11d3db03be8f46f
+ARG THRIFT_SOURCE_SIGNER=8CD87F186F06E958EFCA963D76BD340FC4B75865
+
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends \
+		bison \
+		ca-certificates \
+		cmake \
+		curl \
+		flex \
+		g++ \
+		gnupg \
+		make \
+	; \
+	rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src
+
+RUN set -eux; \
+	curl -fsSL -o thrift.tar.gz "$THRIFT_SOURCE_URL"; \
+	curl -fsSL -o thrift.tar.gz.asc "$THRIFT_SOURCE_URL.asc"; \
+	curl -fsSL -o thrift-KEYS https://downloads.apache.org/thrift/KEYS; \
+	echo "$THRIFT_SOURCE_SHA256 *thrift.tar.gz" | sha256sum -c -; \
+	export GNUPGHOME="$(mktemp -d)"; \
+	gpg --batch --import thrift-KEYS; \
+	gpg --batch --status-fd 1 --verify thrift.tar.gz.asc thrift.tar.gz > gpg.status; \
+	grep -F "[GNUPG:] VALIDSIG $THRIFT_SOURCE_SIGNER " gpg.status; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"; \
+	mkdir thrift; \
+	tar -xzf thrift.tar.gz -C thrift --strip-components=1; \
+	rm thrift.tar.gz thrift.tar.gz.asc thrift-KEYS gpg.status
+
+RUN set -eux; \
+	cmake -S thrift -B build \
+		-DCMAKE_BUILD_TYPE=Release \
+		-DBUILD_COMPILER=ON \
+		-DBUILD_LIBRARIES=OFF \
+		-DBUILD_TESTING=OFF \
+		-DBUILD_TUTORIALS=OFF; \
+	cmake --build build --target thrift-compiler -j "$(nproc)"; \
+	cmake --install build --prefix /opt/thrift
+
+FROM debian:trixie-slim
+
+ARG THRIFT_VERSION=0.23.0
+
+LABEL org.opencontainers.image.title="Apache Thrift Compiler" \
+	org.opencontainers.image.version="$THRIFT_VERSION" \
+	org.opencontainers.image.source="https://github.com/apache/thrift" \
+	org.opencontainers.image.url="https://thrift.apache.org/" \
+	org.opencontainers.image.licenses="Apache-2.0"
+
+RUN set -eux; \
+	apt-get update; \
+	apt-get install -y --no-install-recommends libstdc++6; \
+	rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /opt/thrift/bin/thrift /usr/local/bin/thrift
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY tests/smoke.thrift /tmp/smoke.thrift
+
+RUN set -eux; \
+	thrift --version | grep -F "$THRIFT_VERSION"; \
+	mkdir -p /tmp/smoke-out; \
+	thrift --gen json -o /tmp/smoke-out /tmp/smoke.thrift; \
+	find /tmp/smoke-out -type f | grep -q .; \
+	rm -rf /tmp/smoke.thrift /tmp/smoke-out
+
+WORKDIR /data
+
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["thrift"]