rbe-tebako 0.15.0

data/lib/tebako/stripper.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+# Copyright (c) 2024-2025 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+require "fileutils"
+require "find"
+
+require_relative "packager/patch_helpers"
+
+# Tebako - an executable packager
+module Tebako
+  # Tebako packaging support (stripper)
+  module Stripper
+    DELETE_EXTENSIONS = %w[o lo obj a la lib].freeze
+    BIN_FILES = %w[
+      bundle bundler rbs erb gem irb racc racc2y
+      rake rdoc ri y2racc rdbg syntax_suggest typeprof
+    ].freeze
+    CMD_SUFFIX = ".cmd"
+    BAT_SUFFIX = ".bat"
+
+    class << self
+      # Strip
+      # Removes build artefacts, strip shared objects
+      def strip(scm, src_dir)
+        puts "   ... stripping the output"
+        strip_bs(src_dir)
+        strip_dsym(src_dir) if scm.macos?
+        strip_fi(scm, src_dir)
+        strip_li(scm, src_dir)
+      end
+
+      # Remove macOS .dSYM debug companions before stripping. They are external debug info
+      # (useless in the packaged memfs) and the DWARF Mach-O inside them is named "<ext>.bundle",
+      # so strip_li would try to `strip -S` it and fail with
+      # "string table not at the end of the file (can't be processed)".
+      def strip_dsym(src_dir)
+        Dir.glob(File.join(src_dir, "**", "*.dSYM")).each { |d| FileUtils.rm_rf(d) }
+      end
+
+      def strip_file(file_in, file_out = nil)
+        params = ["strip", "-S", file_in]
+        params << "-o" << file_out unless file_out.nil?
+        out, st = Open3.capture2e(*params)
+
+        # Some gems (well, libmspack) has bundled extensions for several architectures)
+        # Getting something like:
+        # strip: Unable to recognise the format of the input file
+        # `/tmp/cirrus-ci-build/o/s/lib/ruby/gems/3.1.0/gems/libmspack-0.11.0/ext/x86_64-linux/libmspack.so'
+        # on aarch64
+
+        puts "Warning: could not strip #{file_in}:\n #{out}" unless st.exitstatus.zero?
+      end
+
+      # `strip` drops the Mach-O code signature. On macOS (notably >= 26) the dynamic loader
+      # SIGKILLs any dlopen of an unsigned / invalidly-signed .bundle/.dylib with
+      # "Code Signature Invalid" — and tebako dlopens native extensions extracted from the
+      # memfs at runtime. Re-apply an ad-hoc signature so the stripped extensions still load.
+      def resign_macho(file)
+        _out, st = Open3.capture2e("codesign", "--force", "--sign", "-", file)
+        puts "Warning: could not ad-hoc re-sign #{file}" unless st.exitstatus.zero?
+      end
+
+      private
+
+      def get_files(scm)
+        exe_suffix = scm.exe_suffix
+        files = BIN_FILES.flat_map do |f|
+          [f, "#{f}#{CMD_SUFFIX}", "#{f}#{BAT_SUFFIX}"]
+        end
+
+        files += ["ruby#{exe_suffix}", "rubyw#{exe_suffix}"]
+        files
+      end
+
+      def strip_bs(src_dir)
+        FileUtils.rm_rf([
+                          File.join(src_dir, "share"),
+                          File.join(src_dir, "include"),
+                          File.join(src_dir, "lib", "pkgconfig")
+                        ])
+      end
+
+      def strip_fi(scm, src_dir)
+        files = get_files(scm).map { |f| "#{src_dir}/bin/#{f}" }
+        FileUtils.rm(files, force: true)
+      end
+
+      def strip_li(scm, src_dir)
+        sext = strip_extensions(scm)
+        Find.find(src_dir) do |file|
+          next if File.directory?(file)
+
+          extension = File.extname(file).delete_prefix(".").downcase
+          if DELETE_EXTENSIONS.include?(extension)
+            FileUtils.rm(file)
+          elsif sext.include?(extension)
+            strip_file(file)
+            resign_macho(file) if scm.macos?
+          end
+        end
+      end
+
+      def strip_extensions(scm)
+        sext = ["so"]
+        sext << "dll" if scm.msys?
+        sext << "dylib" << "bundle" if scm.macos?
+        sext
+      end
+    end
+  end
+end

data/lib/tebako/version.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+# Copyright (c) 2023-2025 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+module Tebako
+  VERSION = "0.15.0"
+end

data/lib/tebako.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# Copyright (c)  2023-2025 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+# Tebako - an executable packager
+# Core module
+module Tebako
+end
+
+require_relative "tebako/version"
+require_relative "tebako/error"

data/src/tebako-main.cpp

@@ -0,0 +1,168 @@
+/**
+ *
+ * Copyright (c) 2021-2025 [Ribose Inc](https://www.ribose.com).
+ * All rights reserved.
+ * This file is a part of the Tebako project.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <memory.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdint.h>
+
+#include <string>
+#include <cstdint>
+#include <vector>
+#include <stdexcept>
+#include <tuple>
+
+#ifdef _WIN32
+#include <winsock2.h>
+#include <windows.h>
+#endif
+
+#include <tebako/tebako-config.h>
+#include <tebako/tebako-io.h>
+
+#include <tebako/tebako-version.h>
+#include <tebako/tebako-main.h>
+#include <tebako/tebako-fs.h>
+#include <tebako/tebako-cmdline.h>
+
+static int running_miniruby = 0;
+static tebako::cmdline_args* args = nullptr;
+static std::vector<char> package;
+
+static void tebako_clean(void)
+{
+  unmount_root_memfs();
+  if (args) {
+    delete args;
+    args = nullptr;
+  }
+}
+
+extern "C" int tebako_main(int* argc, char*** argv)
+{
+  int ret = -1, fsret = -1;
+  char** new_argv = nullptr;
+  char* argv_memory = nullptr;
+
+  if (strstr((*argv)[0], "miniruby") != nullptr) {
+    // Ruby build script is designed in such a way that this patch is also applied towards miniruby
+    // Just pass through in such case
+    ret = 0;
+    running_miniruby = -1;
+  }
+  else {
+    std::string mount_point = tebako::fs_mount_point;
+    std::string entry_point = tebako::fs_entry_point;
+    std::optional<std::string> cwd;
+    if (tebako::package_cwd != nullptr) {
+      cwd = tebako::package_cwd;
+    }
+    const void* data = &gfsData[0];
+    size_t size = gfsSize;
+
+    try {
+      args = new tebako::cmdline_args(*argc, (const char**)*argv);
+      args->parse_arguments();
+      if (args->with_application()) {
+        args->process_package();
+        auto descriptor = args->get_descriptor();
+        package = std::move(args->get_package());
+        if (descriptor.has_value()) {
+          mount_point = descriptor->get_mount_point().c_str();
+          entry_point = descriptor->get_entry_point().c_str();
+          cwd = descriptor->get_cwd();
+          data = package.data();
+          size = package.size();
+        }
+      }
+
+      fsret = mount_root_memfs(data, size, tebako::fs_log_level, nullptr, nullptr, nullptr, nullptr, "auto");
+      if (fsret == 0) {
+        args->process_mountpoints();
+        args->build_arguments(mount_point.c_str(), entry_point.c_str());
+        *argc = args->get_argc();
+        *argv = args->get_argv();
+        ret = 0;
+        atexit(tebako_clean);
+      }
+    }
+    catch (std::exception e) {
+      printf("Failed to process command line: %s\n", e.what());
+    }
+
+    if (getcwd(tebako::original_cwd, sizeof(tebako::original_cwd)) == nullptr) {
+      printf("Failed to get current directory: %s\n", strerror(errno));
+      ret = -1;
+    }
+
+    if (cwd.has_value()) {
+      if (tebako_chdir(cwd->c_str()) != 0) {
+        printf("Failed to chdir to '%s' : %s\n", cwd->c_str(), strerror(errno));
+        ret = -1;
+      }
+    }
+  }
+
+  if (ret != 0) {
+    try {
+      printf("Tebako initialization failed\n");
+      tebako_clean();
+    }
+    catch (...) {
+      // Nested error, no recovery :(
+    }
+  }
+  return ret;
+}
+
+extern "C" const char* tebako_mount_point(void)
+{
+  return tebako::fs_mount_point;
+}
+
+extern "C" const char* tebako_original_pwd(void)
+{
+  return tebako::original_cwd;
+}
+
+extern "C" int tebako_is_running_miniruby(void)
+{
+  return running_miniruby;
+}
+
+#ifdef RB_W32_PRE_33
+extern "C" ssize_t rb_w32_pread(int /* fd */, void* /* buf */, size_t /* size */, size_t /* offset */)
+{
+  return -1;
+}
+#endif

data/tools/.gitattributes

@@ -0,0 +1,4 @@
+*.giattributes text eol=lf
+*.sh text eol=lf
+*.cmake text eol=lf
+*.h text eol=lf

data/tools/.github/workflows/build-containers.yml

@@ -0,0 +1,190 @@
+# Copyright (c) 2025 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+name: build-containers
+
+on:
+  workflow_dispatch:
+    inputs:
+      next_version:
+        description: |
+          Next container version: x.y.z or major/minor/patch
+        required: true
+        default: 'patch'
+      push:
+        description: |
+          Push the container images to the registry
+        required: false
+        default: 'false'
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.job }}-${{ github.head_ref || github.ref_name }}'
+  cancel-in-progress: true
+
+jobs:
+  build-containers:
+    name: ${{ matrix.container }} ${{ matrix.architecture.platform }}
+    runs-on: ${{ matrix.architecture.host }}
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        container:
+          - 'ubuntu-20.04-dev'
+          - 'alpine-3.17-dev'
+        architecture:
+          - { host: 'ubuntu-22.04', platform: linux/amd64, suffix: 'x64', suffix2: 'amd64' }
+          - { host: 'ubuntu-22.04-arm', platform: linux/arm64, suffix: 'arm64', suffix2: 'arm64' }
+
+    outputs:
+      tags: ${{ steps.meta.outputs.tags }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set GITHUB_REF
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+            if [[ "${{ github.event.inputs.next_version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              # Direct version number provided
+              VERSION="${{ github.event.inputs.next_version }}"
+              echo "Using provided version: $VERSION"
+            elif [[ "${{ github.event.inputs.next_version }}" == "major" || "${{ github.event.inputs.next_version }}" == "minor" || "${{ github.event.inputs.next_version }}" == "patch" ]]; then
+              # Get latest version tag
+              LATEST_TAG=$(git tag --sort=-v:refname | grep -v '\.rc[0-9]\+$' | head -n 1)
+              LATEST_VERSION=${LATEST_TAG#v}
+
+              # Split the version numbers
+              IFS='.' read -r MAJOR MINOR PATCH <<< "$LATEST_VERSION"
+
+              # Calculate the next version based on the increment type
+              if [[ "${{ github.event.inputs.next_version }}" == "major" ]]; then
+                VERSION="$((MAJOR + 1)).0.0"
+              elif [[ "${{ github.event.inputs.next_version }}" == "minor" ]]; then
+                VERSION="${MAJOR}.$((MINOR + 1)).0"
+              else
+                VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+              fi
+              echo "Calculated next ${{ github.event.inputs.next_version }} version: $VERSION"
+            else
+              echo "::error::Invalid version format. Please use semantic version (x.y.z) or specify 'major', 'minor', or 'patch'"
+              exit 1
+            fi
+
+            TAG="v$VERSION"
+            echo "Setting VERSION to $VERSION"
+            echo "Setting GITHUB_REF to refs/tags/$TAG"
+            echo "GITHUB_REF=refs/tags/$TAG" >> $GITHUB_ENV
+            echo "VERSION=$VERSION" >> $GITHUB_ENV
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}
+          tags: |
+            type=semver,pattern={{version}}-${{ matrix.architecture.suffix2 }},value=${{ env.VERSION }}
+            type=semver,pattern={{major}}.{{minor}}-${{ matrix.architecture.suffix2 }},value=${{ env.VERSION }}
+            type=semver,pattern={{major}}-${{ matrix.architecture.suffix2 }},value=${{ env.VERSION }}
+            type=sha,suffix=-${{ matrix.architecture.suffix2 }}
+          labels: |
+            org.opencontainers.image.vendor=Ribose Inc.
+            org.opencontainers.image.licenses=BSD-2-Clause
+            org.opencontainers.image.documentation=https://www.tamatebako.org
+            org.opencontainers.image.source==${{ github.repositoryUrl }}
+            org.opencontainers.image.description=Tebako executable packager ${{ matrix.container }} ${{ matrix.architecture.platform }} development container
+          annotations: |
+            org.opencontainers.image.licenses=BSD-2-Clause
+            org.opencontainers.image.description=Tebako executable packager ${{ matrix.container }} ${{ matrix.architecture.platform }} development container
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: docker
+          file: docker/${{ matrix.container }}.Dockerfile
+          push:  ${{ github.event.inputs.push == 'true' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+          platforms: ${{ matrix.architecture.platform }}
+          build-args: ARCH=${{ matrix.architecture.suffix }}
+
+  create-manifests:
+    name: Create multiarchitecture manifests for ${{ matrix.container }}
+    if: ${{ github.event.inputs.push == 'true' }}
+    runs-on: ubuntu-22.04
+    needs: build-containers
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        container:
+          - 'ubuntu-20.04-dev'
+          - 'alpine-3.17-dev'
+    steps:
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create multiarchitecture manifests and push
+        run: |
+            for tag in $(echo "${{ needs.build-containers.outputs.tags }}" | tr ',' '\n'); do
+              if [[ $tag != *:latest ]]; then
+                base_tag=$(echo $tag | sed -E 's/.*:(.*)-(amd64|arm64)/\1/')
+                echo "Processing $tag, using base tag $base_tag"
+                docker manifest create \
+                  ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag \
+                    --amend ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag-amd64 \
+                    --amend ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag-arm64
+                 docker manifest push ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag
+
+                if [[ $base_tag == sha* ]]; then
+                  docker manifest push ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag
+                  docker manifest create \
+                    ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:latest \
+                      --amend ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag-amd64 \
+                      --amend ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:$base_tag-arm64
+                  docker manifest push ghcr.io/${{ github.repository_owner }}/tebako-${{ matrix.container }}:latest
+                fi
+              fi
+            done

data/tools/.github/workflows/lint.yml

@@ -0,0 +1,41 @@
+# Copyright (c) 2022-2025 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of the Tebako project.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+name: lint
+
+on:
+  push:
+    branches: [ master, main ]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: -x