chore: migrate to hosted scalable CI (#3620)

2026-10-26 06:08:40 +01:00 · 2026-10-03 15:41:27 +02:00
parent 8661681110
commit 77e4b946eb
23 changed files with 1309 additions and 237 deletions
@@ -9,11 +9,23 @@ cd "$(dirname "$0")"

 ../prepare_moneroc.sh

-for COIN in monero wownero zano;
+if [[ -n "${COIN:-}" ]]; then
+    COINS=("$COIN")
+else
+    COINS=(monero wownero zano)
+fi
+
+if [[ -n "${TARGET:-}" ]]; then
+    TARGETS=("$TARGET")
+else
+    TARGETS=(x86_64-linux-android aarch64-linux-android armv7a-linux-androideabi)
+fi
+
+for COIN in "${COINS[@]}";
 do
    pushd ../monero_c
        monero_c_tag=$(git describe --tags)
-        for target in {x86_64,aarch64}-linux-android armv7a-linux-androideabi
+        for target in "${TARGETS[@]}"
        do
            if [[ -f "release/${monero_c_tag}/${target}/${COIN}_libwallet2_api_c.so" ]];
            then
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIUO9LtTFYNTLeRJ0Vs/BoW/RHanY4wDQYJKoZIhvcNAQEL
+BQAwcDELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0FtZXJpY2ExEDAOBgNVBAcMB0Zs
+b3JpZGExEzARBgNVBAoMCkNha2VXYWxsZXQxEzARBgNVBAsMCkNha2VXYWxsZXQx
+EzARBgNVBAMMCkNha2VXYWxsZXQwIBcNMjYwOTEwMDgwMzU5WhgPMjA1NDAxMjYw
+ODAzNTlaMHAxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdBbWVyaWNhMRAwDgYDVQQH
+DAdGbG9yaWRhMRMwEQYDVQQKDApDYWtlV2FsbGV0MRMwEQYDVQQLDApDYWtlV2Fs
+bGV0MRMwEQYDVQQDDApDYWtlV2FsbGV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAlHYehgoK7D3/ga26LlYMQhVqyokmUZQ9E6+S2utKQixTwHlJsAe7
+IWY0TpUhz1iDSq8XG/IQdnos8o/SEHY8EVO+STzOjbYIk4J6mm6jqZa59y+l2Brk
+4IEZYe8HsIjMBFmbn8WlLhhT9PewcMZxutW3D0+swx+8azpfYHBY/5a6PaKAstey
+HKSejD7atfcI7xZbWzzPGwS0hDjAcqGcfyYH/r2ziIbvEU2xDeOBYBm9yE1B6sEn
+dI2KB2Q5HtKfNV8Vw1vSLvFEIAJh/vmuO7RoW+tPdUfORTydCeNvDIK8DGe1ka8/
+ZmQraNgGgTxA5YpJKZsTYgc5eMWyxIHBlwIDAQABo1MwUTAdBgNVHQ4EFgQUSTWY
+iEWvKz3YwrB0bufUbxcZ2YgwHwYDVR0jBBgwFoAUSTWYiEWvKz3YwrB0bufUbxcZ
+2YgwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAZ+21ksy5plnb
+ZCTYifmk8E8M+sGWS2m5eLTjzAl4iEEr30Eit4ghQvt7YG5r62HLHBFirv4z6k01
+5mhjU+BJp0NU1e8XOVq6M0EnMKF8OIz3lUy4aUnr6olCdEbSsRyd0l7Ht21Ci0HH
+BkFbZ+HlqwXTPA5kUWMkJ0JlrMhaeyRMpA0jsE1fhgjWmrB2keeFP8CwA3GnQhq1
+HEkN6izdaobnUHnTE7dH3Eixkt0L4XwpkCsw7IV3aVt7+tsc0zICod8JS0ib4Lrw
+XHVWIRtcTGwDLqYlknacR0Mh7JeDYU3JtfxvCB7jstDI9CmYnPOiAsO4NccnbzD5
+WIbD9bRlYg==
+-----END CERTIFICATE-----
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCUdh6GCgrsPf+B
+rbouVgxCFWrKiSZRlD0Tr5La60pCLFPAeUmwB7shZjROlSHPWINKrxcb8hB2eizy
+j9IQdjwRU75JPM6NtgiTgnqabqOplrn3L6XYGuTggRlh7wewiMwEWZufxaUuGFP0
+97BwxnG61bcPT6zDH7xrOl9gcFj/lro9ooCy17IcpJ6MPtq19wjvFltbPM8bBLSE
+OMByoZx/Jgf+vbOIhu8RTbEN44FgGb3ITUHqwSd0jYoHZDke0p81XxXDW9Iu8UQg
+AmH++a47tGhb6091R85FPJ0J428MgrwMZ7WRrz9mZCto2AaBPEDlikkpmxNiBzl4
+xbLEgcGXAgMBAAECggEAILrz2sg/BTtb58qVx95noHAZVaKsBINCfeMQ5NvHyNP9
+OqkgL8Llf7y3DpLtGtGssHsPdh9oako3KcxgDiY4JcOVhYmUZ7GwEKdZgurYFmf
+ESx7iyvOtuIvZuRsVRKrq+/Xe/92fbWWWOT8jLhrXW39iE4f//qwrxE08s2CCYLq
+zQFUIrICN6/7te+qTessWO4Z2zscqhzTMae2kWksUMiU0mYv9BJ6Lzb1Mj2kqSir
+CMBxmxvQmjmE4+29rKulmAQlKNb+rwKgsmdk5+oYcCdMHP0VeXL8RZ+IcOkOv4JU
+xj+isHr8S9mmGMmpM5aAnZoS7tF3aLDH4aojN6MNfQKBgQDQ44cB+SDoKujnfMsK
+1ci21HB2R7qobbspJVGHNQx25XYJdAw1CTsnN8FwziXGR8/tpSJMHQin0M7ZLHqn
+u/aTZLT+7VAmFNUOOY4mbBrQzTA21r2l0kMloXyqmO6ec820L+9bqeAZ6N4y1iNt
+iQ8yVYOuS1SMi+QfqerxbXwg4wKBgQC18byTn58edwprsqWs48u7hB/zI3SLoXOn
+qHPke9uCo4ynV6yEmLa/yN9iyXL2UjY7KjzbpFLhrFYE5JxXfCfCgOk3N1nF8953
+2K95/3uFrasbRSRDi2ROVmDYD1stqN+euHfx3N15uZ/E/Ol8e7GhBMIWo9WIyqJ7
+3GiU9ce+vQKBgDmTfVL96CQWL7wemZiS9I/wXk871ic2l6/vqVkrNhRPiwlwAy1b
+LgLRS3BcYe0VPiqyqZFxL0GSPHF/4Q76sCxQRdM+dikI9PDGzHeqtHl5FSEIb52V
+JwzoRgR/wsXKBZj03XTWjf6WQSih/YHjlVy6VWFlQhi7NlXD8A47r0shAoGAX+Pj
+qzn5NqkuiMxCnPgBq/ZakF4jUmPo/He/fK/6ZMOloZyHg+qohjNr6Dibqk5x3oTI
+Rko4lE+rljCWZVU97zjZsQwu+DErEqbU9Ms9YprBD0JFdoPEfbTwnW6ac1oJYTF/
+pazt3PWDyuIwfDcEywQi9qOqKsoBEJ59T+SpPVECgYBzT9XnT01Eh5MGYxoC/8cu
+c19gWNqHNnvTeUYNI6y8+bUSSbP3vJ8Bytb0VuBega5QQYrT9EYILJIVu9oKSHJE
+v5rSGMmM9hNbWmROGEad/afO82AilvfOR0fx6Tmyk3Sf3tg3JltA3tAzPgo/BOlc
+GqVhDf37ULi8YBLGLkNOZA==
+-----END PRIVATE KEY-----
@@ -10,6 +10,7 @@ RUN mkdir -p /w/cw_decred/lib/api
 COPY --from=torch_source /w/scripts/torch_dart /w/scripts/torch_dart
 COPY cw_core/pubspec.yaml /w/cw_core/pubspec.yaml
 COPY cw_decred/pubspec.yaml /w/cw_decred/pubspec.yaml
+COPY pubspec_overrides.yaml /w/cw_decred/pubspec_overrides.yaml
 COPY scripts/android/build_decred.sh /w/scripts/android/build_decred.sh
 RUN /w/scripts/android/build_decred.sh

@@ -2,8 +2,13 @@ ARG BASE_IMAGE
 FROM --platform=linux/amd64 ${BASE_IMAGE} AS build

 RUN mkdir -p /w/scripts/android
+COPY scripts/functions.sh /w/scripts/functions.sh
 COPY scripts/prepare_moneroc.sh /w/scripts/prepare_moneroc.sh
 COPY scripts/android/build_monero_all.sh /w/scripts/android/build_monero_all.sh
+ARG COIN
+ARG TARGET
+ENV COIN=$COIN
+ENV TARGET=$TARGET
 RUN /w/scripts/android/build_monero_all.sh \
    && rm -rf /w/scripts/monero_c/contrib \
    /w/scripts/monero_c/.git \
@@ -13,7 +13,13 @@ RUN groupadd -g "$GID" "$USER" && \
 RUN sudo chown $UID:$GID -R /w /root
 USER builder

-RUN /w/scripts/android/build_torch.sh && rm -rf /w/scripts/torch_dart/simplybs
+ARG TARGET
+RUN if [ -n "$TARGET" ]; then \
+      /w/scripts/android/build_torch.sh "$TARGET"; \
+    else \
+      /w/scripts/android/build_torch.sh; \
+    fi \
+    && rm -rf /w/scripts/torch_dart/simplybs

 FROM --platform=linux/amd64 alpine
 COPY --from=build /w /w
@@ -4,50 +4,233 @@ cd "$(dirname $0)"

 CW_DOCKER_REGISTRY="${CW_DOCKER_REGISTRY:-localhost/cake-tech/cake_wallet}"
 CW_DOCKER_USE_CLOUD="${CW_DOCKER_USE_CLOUD:-}"
+IMAGE_PREFIX="android-deps"

 SCRIPT_DIR="$(pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"

+ONLY=""
+TARGET=""
+COIN=""
+MERGE=false
+EXTRACT=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --only)
+      ONLY="$2"
+      shift 2
+      ;;
+    --target)
+      TARGET="$2"
+      shift 2
+      ;;
+    --coin)
+      COIN="$2"
+      shift 2
+      ;;
+    --merge)
+      MERGE=true
+      shift
+      ;;
+    --extract)
+      EXTRACT=true
+      shift
+      ;;
+    -h|--help)
+      echo "Usage: $0 [--only NAME] [--target TRIPLE] [--coin COIN] [--merge] [--extract]"
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+TORCH_TARGETS=(
+  aarch64-linux-android
+  armv7a-linux-androideabi
+  x86_64-linux-android
+)
+MONERO_COINS=(monero wownero zano)
+MONERO_TARGETS=(
+  aarch64-linux-android
+  armv7a-linux-androideabi
+  x86_64-linux-android
+)
+
 image_exists() {
  docker image inspect "$1" &>/dev/null
 }

 tinysha() {
-    cat "$@" | sha256sum | cut -c1-6
+  cat "$@" | sha256sum | cut -c1-6
+}
+
+slice_extra() {
+  if [[ -n "$COIN" && -n "$TARGET" ]]; then
+    echo "-${COIN}-${TARGET}"
+  elif [[ -n "$TARGET" ]]; then
+    echo "-${TARGET}"
+  else
+    echo ""
+  fi
+}
+
+# Distinct from the unsuffixed all-in-one tag. The hash of slice suffixes
+# invalidates the merge image if a coin or target is added or removed.
+assembled_extra() {
+  local tmp
+  tmp="$(mktemp)"
+  printf '%s\n' "$@" > "$tmp"
+  echo "-merged-$(tinysha "$tmp")"
+  rm -f "$tmp"
+}
+
+torch_assembled_extra() {
+  local extras=()
+  local t
+  for t in "${TORCH_TARGETS[@]}"; do
+    extras+=("-$t")
+  done
+  assembled_extra "${extras[@]}"
+}
+
+monero_assembled_extra() {
+  local extras=()
+  local coin t
+  for coin in "${MONERO_COINS[@]}"; do
+    for t in "${MONERO_TARGETS[@]}"; do
+      extras+=("-${coin}-${t}")
+    done
+  done
+  assembled_extra "${extras[@]}"
+}
+
+component_extra() {
+  local name="$1"
+  local sliced
+  sliced="$(slice_extra)"
+  if [[ -n "$sliced" ]]; then
+    echo "$sliced"
+    return
+  fi
+  case "$name" in
+    torch) torch_assembled_extra ;;
+    monero) monero_assembled_extra ;;
+    *) echo "" ;;
+  esac
+}
+
+img() {
+  local name="$1"
+  local version="$2"
+  local extra="${3:-}"
+  echo "$CW_DOCKER_REGISTRY:${IMAGE_PREFIX}-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}${extra}"
+}
+
+remote_exists() {
+  local tag="$1"
+  if docker buildx version >/dev/null 2>&1; then
+    docker buildx imagetools inspect "$tag" >/dev/null 2>&1
+    return
+  fi
+  DOCKER_CLI_EXPERIMENTAL=enabled docker manifest inspect "$tag" >/dev/null 2>&1
+}
+
+cached() {
+  local tag="$1"
+  if image_exists "$tag"; then
+    return 0
+  fi
+  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]] && remote_exists "$tag"; then
+    return 0
+  fi
+  return 1
+}
+
+maybe_push() {
+  local tag="$1"
+  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]]; then
+    docker push "$tag"
+  fi
 }

 build() {
  local name="$1"; shift
  local version=$1; shift
-  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]]
-  then
-    set +e
-    docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" | \
-      grep "^${CW_DOCKER_REGISTRY}:android-deps-" | \
-      awk '{print $2}' | \
-      xargs -r docker rmi
-    docker pull "$CW_DOCKER_REGISTRY:android-deps-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}"
-    set -e
-  fi
-  if image_exists "$CW_DOCKER_REGISTRY:android-deps-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}"; then
-    echo "==> skipping $name (image already exists)"
+  local extra
+  extra="$(component_extra "$name")"
+  local tag
+  tag="$(img "$name" "$version" "$extra")"
+  if cached "$tag"; then
+    echo "==> skipping $name (cached: $tag)"
    return 0
  fi
-  echo "==> building $name"
+  echo "==> building $name${extra}"
  docker build \
    --platform linux/amd64 \
    --file     "$SCRIPT_DIR/Dockerfile.${name}" \
-    --tag      "$CW_DOCKER_REGISTRY:android-deps-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}" \
+    --tag      "$tag" \
    "$@" \
    "$REPO_ROOT"
-  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]]
-  then
-    docker push "$CW_DOCKER_REGISTRY:android-deps-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}"
-  fi
+  maybe_push "$tag"
 }

-img() {
-    echo "$CW_DOCKER_REGISTRY:android-deps-${1}-$(tinysha "$SCRIPT_DIR/Dockerfile.${1}")-${2}"
+merge_slices() {
+  local name="$1"
+  local version="$2"
+  local extra="$3"
+  shift 3
+  local dest
+  dest="$(img "$name" "$version" "$extra")"
+  if cached "$dest"; then
+    echo "==> skipping merge $name (cached: $dest)"
+    return 0
+  fi
+
+  local slices=("$@")
+  if [[ ${#slices[@]} -eq 0 ]]; then
+    echo "merge_slices: no slice images given" >&2
+    exit 1
+  fi
+
+  local dockerfile
+  dockerfile="$(mktemp)"
+  local build_args=()
+  local i=0
+  for slice in "${slices[@]}"; do
+    echo "ARG SRC${i}" >> "$dockerfile"
+    i=$((i + 1))
+  done
+  i=0
+  for slice in "${slices[@]}"; do
+    if ! cached "$slice"; then
+      echo "merge_slices: missing slice $slice" >&2
+      rm -f "$dockerfile"
+      exit 1
+    fi
+    echo "FROM --platform=linux/amd64 \${SRC${i}} AS s${i}" >> "$dockerfile"
+    build_args+=(--build-arg "SRC${i}=$slice")
+    i=$((i + 1))
+  done
+  echo "FROM --platform=linux/amd64 alpine" >> "$dockerfile"
+  i=0
+  for slice in "${slices[@]}"; do
+    echo "COPY --from=s${i} /w /w" >> "$dockerfile"
+    i=$((i + 1))
+  done
+
+  echo "==> merging $name from ${#slices[@]} slices -> $dest"
+  docker build \
+    --platform linux/amd64 \
+    --file "$dockerfile" \
+    --tag "$dest" \
+    "${build_args[@]}" \
+    "$SCRIPT_DIR"
+  rm -f "$dockerfile"
+  maybe_push "$dest"
 }

 base_ver="latest"
@@ -55,65 +238,153 @@ torch_ver="$(tinysha $SCRIPT_DIR/Dockerfile.torch $REPO_ROOT/scripts/prepare_tor
 reown_ver=$(tinysha $SCRIPT_DIR/Dockerfile.reown $REPO_ROOT/scripts/prepare_reown.sh $REPO_ROOT/scripts/android/build_reown_deps.sh)
 bitbox_ver=$(tinysha $SCRIPT_DIR/Dockerfile.bitbox $REPO_ROOT/scripts/build_bitbox_flutter.sh)
 monero_ver=$(tinysha $SCRIPT_DIR/Dockerfile.monero $REPO_ROOT/scripts/prepare_moneroc.sh $REPO_ROOT/scripts/android/build_monero_all.sh)
-mwebd_ver=$(tinysha $SCRIPT_DIR/Dockerfile.mwebd $REPO_ROOT/pubspec_overrides.yaml $(find $REPO_ROOT/cw_mweb/go -type f))
+mwebd_ver=$(tinysha $SCRIPT_DIR/Dockerfile.mwebd $REPO_ROOT/pubspec_overrides.yaml $(find $REPO_ROOT/cw_mweb/go -type f | sort))
 zcash_ver=$(tinysha $SCRIPT_DIR/Dockerfile.zcash $REPO_ROOT/scripts/prepare_zcash.sh $REPO_ROOT/scripts/android/build_zcash.sh)
-decred_ver=$(tinysha $SCRIPT_DIR/Dockerfile.torch $SCRIPT_DIR/Dockerfile.decred $REPO_ROOT/scripts/android/build_decred.sh $REPO_ROOT/cw_decred/pubspec.yaml)
-echo $base_ver $torch_ver $reown_ver $bitbox_ver $monero_ver $mwebd_ver $zcash_ver $decred_ver > /tmp/docker_build_versions
+torch_assembled_extra > /tmp/cw_torch_assembled_extra
+decred_ver=$(tinysha $SCRIPT_DIR/Dockerfile.torch $SCRIPT_DIR/Dockerfile.decred $REPO_ROOT/scripts/android/build_decred.sh $REPO_ROOT/cw_decred/pubspec.yaml $REPO_ROOT/pubspec_overrides.yaml /tmp/cw_torch_assembled_extra)
+echo $base_ver $torch_ver $reown_ver $bitbox_ver $monero_ver $mwebd_ver $zcash_ver $decred_ver "$(torch_assembled_extra)" "$(monero_assembled_extra)" > /tmp/docker_build_versions
 final_ver=$(tinysha /tmp/docker_build_versions)

-docker create --name temp_extract $(img final $final_ver) \
-&& cd $REPO_ROOT \
-&& docker cp temp_extract:/w.top w.top \
-&& rsync -av w.top/ . \
-&& rm -rf w.top \
-&& docker rm temp_extract \
-&& echo "cache ok" \
-&& exit 0 \
-|| echo "cache miss oh"
+extract_final() {
+  local required="${1:-}"
+  local tag
+  tag="$(img final "$final_ver")"
+  if ! image_exists "$tag" && [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]] && remote_exists "$tag"; then
+    docker pull "$tag"
+  fi
+  docker rm -f temp_extract >/dev/null 2>&1 || true
+  if docker create --name temp_extract "$tag"; then
+    cd "$REPO_ROOT"
+    docker cp temp_extract:/w.top w.top
+    rsync -av w.top/ .
+    rm -rf w.top
+    docker rm temp_extract
+    echo "cache ok"
+    echo "$tag" > /tmp/cakewallet_docker
+    return 0
+  fi
+  docker rm -f temp_extract >/dev/null 2>&1 || true
+  echo "cache miss oh"
+  if [[ "$required" == "required" ]]; then
+    echo "final image missing: $tag" >&2
+    exit 1
+  fi
+  return 1
+}

-docker rm temp_extract || true
+build_base() {
+  build base "$base_ver"
+}

-build base "$base_ver"
+build_bitbox() {
+  build bitbox "$bitbox_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build bitbox "$bitbox_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_mwebd() {
+  build mwebd "$mwebd_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build mwebd "$mwebd_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_reown() {
+  build reown "$reown_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build reown "$reown_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_zcash() {
+  build zcash "$zcash_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build monero "$monero_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_torch() {
+  if [[ "$MERGE" == true ]]; then
+    local slices=()
+    local t
+    for t in "${TORCH_TARGETS[@]}"; do
+      slices+=("$(img torch "$torch_ver" "-$t")")
+    done
+    merge_slices torch "$torch_ver" "$(torch_assembled_extra)" "${slices[@]}"
+    return 0
+  fi
+  build torch "$torch_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg TARGET="${TARGET}"
+}

-build zcash "$zcash_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_monero() {
+  if [[ "$MERGE" == true ]]; then
+    local slices=()
+    local coin t
+    for coin in "${MONERO_COINS[@]}"; do
+      for t in "${MONERO_TARGETS[@]}"; do
+        slices+=("$(img monero "$monero_ver" "-${coin}-${t}")")
+      done
+    done
+    merge_slices monero "$monero_ver" "$(monero_assembled_extra)" "${slices[@]}"
+    return 0
+  fi
+  build monero "$monero_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg COIN="${COIN}" \
+    --build-arg TARGET="${TARGET}"
+}

-build torch "$torch_ver" \
-  --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_decred() {
+  build decred "$decred_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg TORCH_IMAGE="$(img torch "$torch_ver" "$(torch_assembled_extra)")"
+}

-build decred "$decred_ver" \
-  --build-arg BASE_IMAGE="$(img base "$base_ver")" \
-  --build-arg TORCH_IMAGE="$(img torch "$torch_ver")"
+build_final() {
+  build final "$final_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg TORCH_IMAGE="$(img torch "$torch_ver" "$(torch_assembled_extra)")" \
+    --build-arg REOWN_IMAGE="$(img reown "$reown_ver")" \
+    --build-arg BITBOX_IMAGE="$(img bitbox "$bitbox_ver")" \
+    --build-arg MONERO_IMAGE="$(img monero "$monero_ver" "$(monero_assembled_extra)")" \
+    --build-arg DECRED_IMAGE="$(img decred "$decred_ver")" \
+    --build-arg MWEBD_IMAGE="$(img mwebd "$mwebd_ver")" \
+    --build-arg ZCASH_IMAGE="$(img zcash "$zcash_ver")"
+  echo "done: $(img final $final_ver)"
+  echo "$(img final $final_ver)" > /tmp/cakewallet_docker
+}

-build final $final_ver \
-  --build-arg BASE_IMAGE="$(img base $base_ver)" \
-  --build-arg TORCH_IMAGE="$(img torch $torch_ver)" \
-  --build-arg REOWN_IMAGE="$(img reown $reown_ver)" \
-  --build-arg BITBOX_IMAGE="$(img bitbox $bitbox_ver)" \
-  --build-arg MONERO_IMAGE="$(img monero $monero_ver)" \
-  --build-arg DECRED_IMAGE="$(img decred $decred_ver)" \
-  --build-arg MWEBD_IMAGE="$(img mwebd $mwebd_ver)" \
-  --build-arg ZCASH_IMAGE="$(img zcash $zcash_ver)"
+run_one() {
+  case "$1" in
+    base) build_base ;;
+    bitbox) build_bitbox ;;
+    mwebd) build_mwebd ;;
+    reown) build_reown ;;
+    zcash) build_zcash ;;
+    torch) build_torch ;;
+    monero) build_monero ;;
+    decred) build_decred ;;
+    final) build_final ;;
+    *)
+      echo "Unknown component: $1" >&2
+      exit 1
+      ;;
+  esac
+}

-echo "done: $(img final $final_ver)"
-echo $(img final $final_ver) > /tmp/cakewallet_docker
+if [[ "$EXTRACT" == true ]]; then
+  extract_final required
+  exit 0
+fi

+if [[ -z "$ONLY" ]]; then
+  extract_final && exit 0 || true
+  ONLY=""
+  TARGET=""
+  COIN=""
+  MERGE=false
+  build_base
+  build_bitbox
+  build_mwebd
+  build_reown
+  build_monero
+  build_zcash
+  build_torch
+  build_decred
+  build_final
+  extract_final required
+  exit 0
+fi

-docker create --name temp_extract $(img final $final_ver) \
-&& cd $REPO_ROOT \
-&& docker cp temp_extract:/w.top w.top \
-&& rsync -av w.top/ . \
-&& rm -rf w.top \
-&& docker rm temp_extract \
-&& echo "cache ok" \
-&& exit 0
-
-echo idk.
-exit 1
+run_one "$ONLY"
@@ -0,0 +1,45 @@
+#!/bin/bash
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+STORE_PASS="${STORE_PASS:-test@cake_wallet}"
+KEY_PASS="${KEY_PASS:-test@cake_wallet}"
+DEST="${1:-}"
+
+if [[ -z "$DEST" ]]; then
+  DEST="$(cd ../.. && pwd)/android/app/key.jks"
+elif [[ "$DEST" != /* ]]; then
+  DEST="$(cd ../.. && pwd)/$DEST"
+fi
+
+P12="$(mktemp /tmp/cakewallet-dev-XXXXXX.p12)"
+cleanup() { rm -f "$P12"; }
+trap cleanup EXIT
+
+openssl pkcs12 -export \
+  -inkey "$PWD/dev-test-key.pem" \
+  -in "$PWD/dev-test-key.crt" \
+  -out "$P12" \
+  -name testKey \
+  -passout "pass:${STORE_PASS}" \
+  -certpbe PBE-SHA1-3DES \
+  -keypbe PBE-SHA1-3DES \
+  -macalg sha1
+
+mkdir -p "$(dirname "$DEST")"
+rm -f "$DEST"
+
+keytool -importkeystore \
+  -srckeystore "$P12" \
+  -srcstoretype PKCS12 \
+  -srcstorepass "$STORE_PASS" \
+  -destkeystore "$DEST" \
+  -deststoretype JKS \
+  -deststorepass "$STORE_PASS" \
+  -destkeypass "$KEY_PASS" \
+  -srcalias testKey \
+  -destalias testKey \
+  -noprompt
+
+echo "Wrote $DEST"
@@ -7,16 +7,23 @@ cd "$(dirname "$0")"

 ../prepare_moneroc.sh

-for COIN in monero wownero;
+if [[ -n "${COIN:-}" ]]; then
+    COINS=("$COIN")
+else
+    COINS=(monero wownero)
+fi
+
+if [[ -n "${TARGET:-}" ]]; then
+    target="$TARGET"
+elif [[ $(uname -m) == "arm64" || $(uname -m) == "aarch64" ]]; then
+    target="aarch64-linux-gnu"
+else
+    target="x86_64-linux-gnu"
+fi
+
+for COIN in "${COINS[@]}";
 do
    pushd ../monero_c
-        # Determine target architecture based on system architecture
-        if [[ $(uname -m) == "arm64" || $(uname -m) == "aarch64" ]]; then
-            target="aarch64-linux-gnu"
-        else
-            target="x86_64-linux-gnu"
-        fi
-
        ./build_single.sh ${COIN} $target -j$MAKE_JOB_COUNT
    popd
 done
@@ -2,8 +2,18 @@
 set -x -e
 cd "$(dirname "$0")"

+DEFAULT_TARGETS=(
+  "x86_64-linux-gnu"
+)
+
+if [ "$#" -gt 0 ]; then
+  TARGETS=("$@")
+else
+  TARGETS=("${DEFAULT_TARGETS[@]}")
+fi
+
 ../prepare_torch.sh

 cd ../torch_dart

-./build.sh x86_64-linux-gnu
+./build.sh "${TARGETS[@]}"
@@ -13,6 +13,10 @@ RUN mkdir -p /w/scripts/linux
 COPY scripts/prepare_moneroc.sh /w/scripts/prepare_moneroc.sh
 COPY scripts/linux/build_monero_all.sh /w/scripts/linux/build_monero_all.sh
 COPY scripts/functions.sh /w/scripts/functions.sh
+ARG COIN
+ARG TARGET
+ENV COIN=$COIN
+ENV TARGET=$TARGET
 RUN /w/scripts/linux/build_monero_all.sh \
    && rm -rf /w/scripts/monero_c/contrib/depends/simplybs \
    /w/scripts/monero_c/monero_libwallet2_api_c/build \
@@ -14,7 +14,13 @@ RUN groupadd -g "$GID" "$USER" && \
 RUN sudo chown $UID:$GID -R /w /root
 USER builder

-RUN /w/scripts/linux/build_torch.sh && rm -rf /w/scripts/torch_dart/simplybs
+ARG TARGET
+RUN if [ -n "$TARGET" ]; then \
+      /w/scripts/linux/build_torch.sh "$TARGET"; \
+    else \
+      /w/scripts/linux/build_torch.sh; \
+    fi \
+    && rm -rf /w/scripts/torch_dart/simplybs

 FROM --platform=linux/amd64 alpine
 COPY --from=build /w /w
@@ -4,50 +4,214 @@ cd "$(dirname $0)"

 CW_DOCKER_REGISTRY="${CW_DOCKER_REGISTRY:-localhost/cake-tech/cake_wallet}"
 CW_DOCKER_USE_CLOUD="${CW_DOCKER_USE_CLOUD:-}"
+IMAGE_PREFIX="linux-deps-amd64"

 SCRIPT_DIR="$(pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"

+ONLY=""
+TARGET=""
+COIN=""
+MERGE=false
+EXTRACT=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --only)
+      ONLY="$2"
+      shift 2
+      ;;
+    --target)
+      TARGET="$2"
+      shift 2
+      ;;
+    --coin)
+      COIN="$2"
+      shift 2
+      ;;
+    --merge)
+      MERGE=true
+      shift
+      ;;
+    --extract)
+      EXTRACT=true
+      shift
+      ;;
+    -h|--help)
+      echo "Usage: $0 [--only NAME] [--target TRIPLE] [--coin COIN] [--merge] [--extract]"
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+MONERO_COINS=(monero wownero)
+MONERO_TARGETS=(x86_64-linux-gnu)
+
 image_exists() {
  docker image inspect "$1" &>/dev/null
 }

 tinysha() {
-    cat "$@" | sha256sum | cut -c1-6
+  cat "$@" | sha256sum | cut -c1-6
+}
+
+slice_extra() {
+  if [[ -n "$COIN" && -n "$TARGET" ]]; then
+    echo "-${COIN}-${TARGET}"
+  elif [[ -n "$TARGET" ]]; then
+    echo "-${TARGET}"
+  else
+    echo ""
+  fi
+}
+
+# Distinct from the unsuffixed all-in-one tag. The hash of slice suffixes
+# invalidates the merge image if a coin or target is added or removed.
+assembled_extra() {
+  local tmp
+  tmp="$(mktemp)"
+  printf '%s\n' "$@" > "$tmp"
+  echo "-merged-$(tinysha "$tmp")"
+  rm -f "$tmp"
+}
+
+monero_assembled_extra() {
+  local extras=()
+  local coin t
+  for coin in "${MONERO_COINS[@]}"; do
+    for t in "${MONERO_TARGETS[@]}"; do
+      extras+=("-${coin}-${t}")
+    done
+  done
+  assembled_extra "${extras[@]}"
+}
+
+component_extra() {
+  local name="$1"
+  local sliced
+  sliced="$(slice_extra)"
+  if [[ -n "$sliced" ]]; then
+    echo "$sliced"
+    return
+  fi
+  case "$name" in
+    monero) monero_assembled_extra ;;
+    *) echo "" ;;
+  esac
+}
+
+img() {
+  local name="$1"
+  local version="$2"
+  local extra="${3:-}"
+  echo "$CW_DOCKER_REGISTRY:${IMAGE_PREFIX}-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}${extra}"
+}
+
+remote_exists() {
+  local tag="$1"
+  if docker buildx version >/dev/null 2>&1; then
+    docker buildx imagetools inspect "$tag" >/dev/null 2>&1
+    return
+  fi
+  DOCKER_CLI_EXPERIMENTAL=enabled docker manifest inspect "$tag" >/dev/null 2>&1
+}
+
+cached() {
+  local tag="$1"
+  if image_exists "$tag"; then
+    return 0
+  fi
+  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]] && remote_exists "$tag"; then
+    return 0
+  fi
+  return 1
+}
+
+maybe_push() {
+  local tag="$1"
+  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]]; then
+    docker push "$tag"
+  fi
 }

 build() {
  local name="$1"; shift
  local version=$1; shift
-  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]]
-  then
-    set +e
-    docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" | \
-      grep "^${CW_DOCKER_REGISTRY}:linux-deps-amd64-" | \
-      awk '{print $2}' | \
-      xargs -r docker rmi
-    docker pull "$CW_DOCKER_REGISTRY:linux-deps-amd64-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}"
-    set -e
-  fi
-  if image_exists "$CW_DOCKER_REGISTRY:linux-deps-amd64-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}"; then
-    echo "==> skipping $name (image already exists)"
+  local extra
+  extra="$(component_extra "$name")"
+  local tag
+  tag="$(img "$name" "$version" "$extra")"
+  if cached "$tag"; then
+    echo "==> skipping $name (cached: $tag)"
    return 0
  fi
-  echo "==> building $name"
+  echo "==> building $name${extra}"
  docker build \
    --platform linux/amd64 \
    --file     "$SCRIPT_DIR/Dockerfile.${name}" \
-    --tag      "$CW_DOCKER_REGISTRY:linux-deps-amd64-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}" \
+    --tag      "$tag" \
    "$@" \
    "$REPO_ROOT"
-  if [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]]
-  then
-    docker push "$CW_DOCKER_REGISTRY:linux-deps-amd64-${name}-$(tinysha "$SCRIPT_DIR/Dockerfile.${name}")-${version}"
-  fi
+  maybe_push "$tag"
 }

-img() {
-    echo "$CW_DOCKER_REGISTRY:linux-deps-amd64-${1}-$(tinysha "$SCRIPT_DIR/Dockerfile.${1}")-${2}"
+merge_slices() {
+  local name="$1"
+  local version="$2"
+  local extra="$3"
+  shift 3
+  local dest
+  dest="$(img "$name" "$version" "$extra")"
+  if cached "$dest"; then
+    echo "==> skipping merge $name (cached: $dest)"
+    return 0
+  fi
+
+  local slices=("$@")
+  if [[ ${#slices[@]} -eq 0 ]]; then
+    echo "merge_slices: no slice images given" >&2
+    exit 1
+  fi
+
+  local dockerfile
+  dockerfile="$(mktemp)"
+  local build_args=()
+  local i=0
+  for slice in "${slices[@]}"; do
+    echo "ARG SRC${i}" >> "$dockerfile"
+    i=$((i + 1))
+  done
+  i=0
+  for slice in "${slices[@]}"; do
+    if ! cached "$slice"; then
+      echo "merge_slices: missing slice $slice" >&2
+      rm -f "$dockerfile"
+      exit 1
+    fi
+    echo "FROM --platform=linux/amd64 \${SRC${i}} AS s${i}" >> "$dockerfile"
+    build_args+=(--build-arg "SRC${i}=$slice")
+    i=$((i + 1))
+  done
+  echo "FROM --platform=linux/amd64 alpine" >> "$dockerfile"
+  i=0
+  for slice in "${slices[@]}"; do
+    echo "COPY --from=s${i} /w /w" >> "$dockerfile"
+    i=$((i + 1))
+  done
+
+  echo "==> merging $name from ${#slices[@]} slices -> $dest"
+  docker build \
+    --platform linux/amd64 \
+    --file "$dockerfile" \
+    --tag "$dest" \
+    "${build_args[@]}" \
+    "$SCRIPT_DIR"
+  rm -f "$dockerfile"
+  maybe_push "$dest"
 }

 base_ver="latest"
@@ -55,59 +219,133 @@ torch_ver="$(tinysha $SCRIPT_DIR/Dockerfile.torch $REPO_ROOT/scripts/prepare_tor
 reown_ver=$(tinysha $SCRIPT_DIR/Dockerfile.reown $REPO_ROOT/scripts/prepare_reown.sh $REPO_ROOT/scripts/android/build_reown_deps.sh)
 bitbox_ver=$(tinysha $SCRIPT_DIR/Dockerfile.bitbox $REPO_ROOT/scripts/build_bitbox_flutter.sh)
 monero_ver=$(tinysha $SCRIPT_DIR/Dockerfile.monero $REPO_ROOT/scripts/prepare_moneroc.sh $REPO_ROOT/scripts/linux/build_monero_all.sh)
-mwebd_ver=$(tinysha $SCRIPT_DIR/Dockerfile.mwebd $REPO_ROOT/pubspec_overrides.yaml $(find $REPO_ROOT/cw_mweb/go -type f))
+mwebd_ver=$(tinysha $SCRIPT_DIR/Dockerfile.mwebd $REPO_ROOT/pubspec_overrides.yaml $(find $REPO_ROOT/cw_mweb/go -type f | sort))
 zcash_ver=$(tinysha $SCRIPT_DIR/Dockerfile.zcash $REPO_ROOT/scripts/prepare_zcash.sh $REPO_ROOT/scripts/linux/build_zcash.sh)
-echo $base_ver $torch_ver $reown_ver $bitbox_ver $monero_ver $mwebd_ver $zcash_ver > /tmp/docker_build_versions
+echo $base_ver $torch_ver $reown_ver $bitbox_ver $monero_ver $mwebd_ver $zcash_ver "$(monero_assembled_extra)" > /tmp/docker_build_versions
 final_ver=$(tinysha /tmp/docker_build_versions)

-docker create --name temp_extract $(img final $final_ver) \
-&& cd $REPO_ROOT \
-&& docker cp temp_extract:/w.top w.top \
-&& rsync -av w.top/ . \
-&& rm -rf w.top \
-&& docker rm temp_extract \
-&& echo "cache ok" \
-&& exit 0 \
-|| echo "cache miss oh"
+extract_final() {
+  local required="${1:-}"
+  local tag
+  tag="$(img final "$final_ver")"
+  if ! image_exists "$tag" && [[ "x$CW_DOCKER_USE_CLOUD" == "xtrue" ]] && remote_exists "$tag"; then
+    docker pull "$tag"
+  fi
+  docker rm -f temp_extract >/dev/null 2>&1 || true
+  if docker create --name temp_extract "$tag"; then
+    cd "$REPO_ROOT"
+    docker cp temp_extract:/w.top w.top
+    rsync -av w.top/ .
+    rm -rf w.top
+    docker rm temp_extract
+    echo "cache ok"
+    echo "$tag" > /tmp/cakewallet_docker
+    return 0
+  fi
+  docker rm -f temp_extract >/dev/null 2>&1 || true
+  echo "cache miss oh"
+  if [[ "$required" == "required" ]]; then
+    echo "final image missing: $tag" >&2
+    exit 1
+  fi
+  return 1
+}

-docker rm temp_extract || true
+build_base() {
+  build base "$base_ver"
+}

-build base "$base_ver"
+build_bitbox() {
+  build bitbox "$bitbox_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build bitbox "$bitbox_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_mwebd() {
+  build mwebd "$mwebd_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build mwebd "$mwebd_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_reown() {
+  build reown "$reown_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build reown "$reown_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_zcash() {
+  build zcash "$zcash_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+}

-build monero "$monero_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_torch() {
+  build torch "$torch_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg TARGET="${TARGET}"
+}

-build zcash "$zcash_ver" --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_monero() {
+  if [[ "$MERGE" == true ]]; then
+    local slices=()
+    local coin t
+    for coin in "${MONERO_COINS[@]}"; do
+      for t in "${MONERO_TARGETS[@]}"; do
+        slices+=("$(img monero "$monero_ver" "-${coin}-${t}")")
+      done
+    done
+    merge_slices monero "$monero_ver" "$(monero_assembled_extra)" "${slices[@]}"
+    return 0
+  fi
+  build monero "$monero_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg COIN="${COIN}" \
+    --build-arg TARGET="${TARGET}"
+}

-build torch "$torch_ver" \
-  --build-arg BASE_IMAGE="$(img base "$base_ver")"
+build_final() {
+  build final "$final_ver" \
+    --build-arg BASE_IMAGE="$(img base "$base_ver")" \
+    --build-arg TORCH_IMAGE="$(img torch "$torch_ver")" \
+    --build-arg REOWN_IMAGE="$(img reown "$reown_ver")" \
+    --build-arg BITBOX_IMAGE="$(img bitbox "$bitbox_ver")" \
+    --build-arg MONERO_IMAGE="$(img monero "$monero_ver" "$(monero_assembled_extra)")" \
+    --build-arg MWEBD_IMAGE="$(img mwebd "$mwebd_ver")" \
+    --build-arg ZCASH_IMAGE="$(img zcash "$zcash_ver")"
+  echo "done: $(img final $final_ver)"
+  echo "$(img final $final_ver)" > /tmp/cakewallet_docker
+}

-build final $final_ver \
-  --build-arg BASE_IMAGE="$(img base $base_ver)" \
-  --build-arg TORCH_IMAGE="$(img torch $torch_ver)" \
-  --build-arg REOWN_IMAGE="$(img reown $reown_ver)" \
-  --build-arg BITBOX_IMAGE="$(img bitbox $bitbox_ver)" \
-  --build-arg MONERO_IMAGE="$(img monero $monero_ver)" \
-  --build-arg MWEBD_IMAGE="$(img mwebd $mwebd_ver)" \
-  --build-arg ZCASH_IMAGE="$(img zcash $zcash_ver)"
+run_one() {
+  case "$1" in
+    base) build_base ;;
+    bitbox) build_bitbox ;;
+    mwebd) build_mwebd ;;
+    reown) build_reown ;;
+    zcash) build_zcash ;;
+    torch) build_torch ;;
+    monero) build_monero ;;
+    final) build_final ;;
+    *)
+      echo "Unknown component: $1" >&2
+      exit 1
+      ;;
+  esac
+}

-echo "done: $(img final $final_ver)"
-echo $(img final $final_ver) > /tmp/cakewallet_docker
+if [[ "$EXTRACT" == true ]]; then
+  extract_final required
+  exit 0
+fi

+if [[ -z "$ONLY" ]]; then
+  extract_final && exit 0 || true
+  ONLY=""
+  TARGET=""
+  COIN=""
+  MERGE=false
+  build_base
+  build_bitbox
+  build_mwebd
+  build_reown
+  build_monero
+  build_zcash
+  build_torch
+  build_final
+  extract_final required
+  exit 0
+fi

-docker create --name temp_extract $(img final $final_ver) \
-&& cd $REPO_ROOT \
-&& docker cp temp_extract:/w.top w.top \
-&& rsync -av w.top/ . \
-&& rm -rf w.top \
-&& docker rm temp_extract \
-&& echo "cache ok" \
-&& exit 0
-
-echo idk.
-exit 1
+run_one "$ONLY"