Merge 2b6736f978 into 9ba95b5c20

1. Create a multi-architecture container image for Dangerzone, instead
   of having two different tarballs (or no option at all)
2. Build the Dangerzone container image on our supported architectures
   (linux/amd64 and linux/arm64). It so happens that GitHub also offers
   ARM machine runners, which speeds up the build.
3. Combine the images from these two architectures into one, multi-arch
   image.
4. Generate provenance info for each manifest, and the root manifest
   list.
5. Check the image's reproduciblity.

Also, remove an older CI action, that is now obsolete.

Fixes #1035

.github/workflows/build-push-image.yml

@@ -69,6 +69,10 @@ jobs:
     runs-on: ${{ matrix.platform.runs-on }}
     needs:
       - prepare
+    outputs:
+      debian_archive_date: ${{ needs.prepare.outputs.debian_archive_date }}
+      source_date_epoch: ${{ needs.prepare.outputs.source_date_epoch }}
+      image: ${{ needs.prepare.outputs.image }}
     strategy:
       fail-fast: false
       matrix:
@@ -131,9 +135,11 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     needs:
-      - prepare  # implied by build, but required here to access image params
       - build
     outputs:
+      debian_archive_date: ${{ needs.build.outputs.debian_archive_date }}
+      source_date_epoch: ${{ needs.build.outputs.source_date_epoch }}
+      image: ${{ needs.build.outputs.image }}
       digest_root: ${{ steps.image.outputs.digest_root }}
       digest_amd64: ${{ steps.image.outputs.digest_amd64 }}
       digest_arm64: ${{ steps.image.outputs.digest_arm64 }}
@@ -162,15 +168,15 @@ jobs:
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests
         run: |
-          DIGESTS=$(printf '${{ needs.prepare.outputs.image }}@sha256:%s ' *)
-          docker buildx imagetools create -t ${{ needs.prepare.outputs.image }} ${DIGESTS}
+          DIGESTS=$(printf '${{ needs.build.outputs.image }}@sha256:%s ' *)
+          docker buildx imagetools create -t ${{ needs.build.outputs.image }} ${DIGESTS}
 
       - name: Inspect image
         id: image
         run: |
           # Inspect the image
-          docker buildx imagetools inspect ${{ needs.prepare.outputs.image }}
-          docker buildx imagetools inspect ${{ needs.prepare.outputs.image }} --format "{{json .Manifest}}" > manifest
+          docker buildx imagetools inspect ${{ needs.build.outputs.image }}
+          docker buildx imagetools inspect ${{ needs.build.outputs.image }} --format "{{json .Manifest}}" > manifest
 
           # Calculate and print the digests
           digest_root=$(jq -r .digest manifest)
@@ -192,7 +198,6 @@ jobs:
   # the container registry.
   provenance:
     needs:
-      - prepare  # implied by merge, but required here to access image params
       - merge
     strategy:
       matrix:
@@ -207,7 +212,7 @@ jobs:
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
     with:
       digest: ${{ needs.merge.outputs[format('digest_{0}', matrix.manifest_type)] }}
-      image: ${{ needs.prepare.outputs.image }}
+      image: ${{ needs.merge.outputs.image }}
       registry-username: ${{ inputs.registry_user }}
     secrets:
       registry-password: ${{ secrets.registry_token }}
@@ -216,7 +221,6 @@ jobs:
   check-reproducibility:
     if: ${{ inputs.reproduce }}
     needs:
-      - prepare  # implied by merge, but required here to access image params
       - merge
     runs-on: ${{ matrix.platform.runs-on }}
     strategy:
@@ -238,7 +242,7 @@ jobs:
             --runtime \
             docker \
             --debian-archive-date \
-            ${{ needs.prepare.outputs.debian_archive_date }} \
+            ${{ needs.merge.outputs.debian_archive_date }} \
             --platform \
             linux/${{ matrix.platform.name }} \
             ${{ needs.merge.outputs[format('digest_{0}', matrix.platform.name)] }}

tests/test_docs_large

@@ -1 +1 @@
-Subproject commit 9e95f7e1b7fbf904a76078715485e4fdba495676
+Subproject commit 0faa21eb4e33ec1a3212468dcb6db3a668cf8fc8