install contemporary git and clang

docker-image/Dockerfile

@@ -3,21 +3,23 @@
 
 # pin the cmake version to ensure repeatable builds
 ARG CMAKE_VERSION="3.26.3"
+# patch releases are automatically accepted by pip install ninja~=1.11.0
+ARG NINJA_MINOR_VERSION="1.11.0"
 
 # Ubuntu Bionic 18.04 LTS has GLIBC 2.27
 FROM ubuntu:bionic
 
 ARG CMAKE_VERSION
+ARG NINJA_MINOR_VERSION
 ARG XDG_CONFIG_HOME
+ARG DEBIAN_FRONTEND=noninteractive
 
 LABEL org.opencontainers.image.authors="[email protected]"
 
-ENV DEBIAN_FRONTEND=noninteractive
-ENV GIT_DISCOVERY_ACROSS_FILESYSTEM=1
-ENV TZ=UTC
-
 USER root
 
+ENV GIT_DISCOVERY_ACROSS_FILESYSTEM=1
+ENV TZ=UTC
 ENV PATH="/usr/local/:${PATH}"
 # used by git to find global config in container that is writeable by the
 # developer's UID
@@ -26,29 +28,57 @@ ENV GIT_CONFIG_GLOBAL="/tmp/ziti-builder-gitconfig"
 ENV BUILD_ENVIRONMENT="ziti-builder-docker"
 
 RUN apt-get update \
-    && apt-get -y install \
+    && apt-get --yes --quiet --no-install-recommends install \
         autoconf \
         automake \
         autopoint \
         build-essential \
+        cppcheck \
         crossbuild-essential-arm64 \
         crossbuild-essential-armhf \
         curl \
         doxygen \
-        git \
+        flex \
+        gcovr \
+        gpg \
         graphviz \
         libcap-dev \
         libssl-dev \
         libsystemd-dev \
         libtool \
-        ninja-build \
         pkg-config \
         python3 \
+        python3-pip \
+        software-properties-common \
         tar \
         unzip \
+        wget \
         zip \
         zlib1g-dev \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get --yes autoremove \
+    && apt-get clean autoclean \
+    && rm -fr /var/lib/apt/lists/{apt,dpkg,cache,log} /tmp/* /var/tmp/*
+
+# provides patch releases for 1.11 in /usr/local/bin/ninja
+RUN python3 -m pip install ninja~=${NINJA_MINOR_VERSION}
+
+RUN curl -sSLf https://apt.llvm.org/llvm-snapshot.gpg.key \
+    | gpg --dearmor --output /usr/share/keyrings/llvm-snapshot.gpg \
+    && chmod +r /usr/share/keyrings/llvm-snapshot.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/llvm-snapshot.gpg] http://apt.llvm.org/bionic/ llvm-toolchain-bionic-17 main" > /etc/apt/sources.list.d/llvm-snapshot.list
+
+RUN add-apt-repository ppa:git-core/ppa \
+    && apt-get update \
+    && apt-get --yes --quiet --no-install-recommends install \
+        git \
+        clang-17 \
+        clang-tidy-17 \
+    && apt-get --yes autoremove \
+    && apt-get clean autoclean \
+    && rm -fr /var/lib/apt/lists/{apt,dpkg,cache,log} /tmp/* /var/tmp/*
+RUN ln -sfvn /usr/bin/clang-17 /usr/bin/clang \
+    && ln -sfvn /usr/bin/clang++-17 /usr/bin/clang++ \
+    && ln -sfvn /usr/bin/clang-tidy-17 /usr/bin/clang-tidy
 
 RUN curl -sSfL https://cmake.org/files/v${CMAKE_VERSION%.*}/cmake-${CMAKE_VERSION}-linux-$(uname -m).sh -o cmake.sh \
     && (bash cmake.sh --skip-license --prefix=/usr/local) \
@@ -59,14 +89,17 @@ RUN dpkg --add-architecture armhf
 RUN dpkg --add-architecture arm64
 COPY ./crossbuild.list /etc/apt/sources.list.d/crossbuild.list
 RUN sed -Ei 's/^deb/deb [arch=amd64]/g' /etc/apt/sources.list
-RUN apt-get update
-RUN apt-get -y install \
-    libcap-dev:armhf \
-    libcap-dev:arm64 \
-    zlib1g-dev:armhf \
-    zlib1g-dev:arm64 \
-    libssl-dev:armhf \
-    libssl-dev:arm64
+RUN apt-get update \
+    && apt-get --yes --quiet --no-install-recommends install \
+        libcap-dev:armhf \
+        libcap-dev:arm64 \
+        zlib1g-dev:armhf \
+        zlib1g-dev:arm64 \
+        libssl-dev:armhf \
+        libssl-dev:arm64 \
+    && apt-get --yes autoremove \
+    && apt-get clean autoclean \
+    && rm -fr /var/lib/apt/lists/{apt,dpkg,cache,log} /tmp/* /var/tmp/*
 
 ENV VCPKG_ROOT=/usr/local/vcpkg
 # this must be set on arm. see https://learn.microsoft.com/en-us/vcpkg/users/config-environment#vcpkg_force_system_binaries
@@ -80,6 +113,21 @@ RUN cd /usr/local \
     && ./vcpkg/bootstrap-vcpkg.sh -disableMetrics \
     && chmod -R ugo+rwX /usr/local/vcpkg
 
+# RUN cd /usr/local/src \
+#     && wget -q https://github.com/gcc-mirror/gcc/archive/refs/tags/releases/gcc-13.2.0.tar.gz \
+#     && tar -xzf gcc-13.2.0.tar.gz
+# build gcc
+# RUN cd /usr/local/src \
+#     && cd ./gcc-releases-gcc-13.2.0 \
+#     && ./contrib/download_prerequisites \
+#     && mkdir /usr/local/src/gcc-build && cd /usr/local/src/gcc-build \
+#     && /usr/local/gcc-releases-gcc-13.2.0/configure \
+#         --enable-languages=c,c++ \
+#     && make -j$(nproc) \
+#     && make install \
+#     && cd /usr/local \
+#     && rm -rf ./gcc-releases-gcc-13.2.0/ ./gcc-13.2.0.tar.gz
+
 # this is set to document the expectation of a predictable workdir in build
 # scripts used by CI and developers building locally, but GitHub Actions will
 # always override with WORKDIR=/github/workspace when running the job container