+ chaining again apt-get update & install to make sure packages are up to date

+ building qrcode from source for ARM

debian-signal.Dockerfile

@@ -15,34 +15,57 @@ RUN apt-get update && \
 RUN git clone https://github.com/signalapp/zkgroup.git /usr/src/zkgroup
 WORKDIR /usr/src/zkgroup
 ENV USER=root
-RUN mkdir -p .cargo \
+RUN mkdir -p .cargo && \
-  && cargo vendor > .cargo/config
+    cargo vendor > .cargo/config
 
 
 
 ######################################
 # STAGE 2
 #
-# Builder for signal-cli & libzkgroupn its native dependency
+# Builder for signal-cli, libzkgroup (its native dependency) and qrcode
 #
-FROM rust:1.49-buster as signal_builder
+# This could be any image compatible with the final one
+# python:3 is already in cache and has good multiarch support
+FROM python:3 as signal_builder
 
 ARG TARGETPLATFORM
 ARG signal_version=0.7.1
 # Buggy tzdata installation : https://serverfault.com/questions/949991/how-to-install-tzdata-on-a-ubuntu-docker-image
 ARG TZ=Europe/Paris
 
-RUN apt-get update
+RUN apt-get update && \
-RUN apt-get install -y \
+    apt-get install -y \
       # rustc must be > 1.36 or libzkgroup build will fail
       # jfsutils to create a FS that works as a workaround for bug
       # wget does not recognizes github certificates so curl replaces it well...
       git zip curl tar cargo rustc make \
       # seems missing on ubuntu images
-      ca-certificates
+      ca-certificates \
       #python3 python3-pip && \
+      # qrcode dependencies when built from source
+      # See https://pillow.readthedocs.io/en/latest/installation.html
+      # required dependencies
+      zlib1g-dev libjpeg-dev \
+      # SOME optional dependencies (not all to keep the build simple enough)
+      libtiff5-dev libopenjp2-7-dev libfreetype6-dev liblcms2-dev libwebp-dev \
+      tcl8.6-dev tk8.6-dev python3-tk libharfbuzz-dev libfribidi-dev libxcb1-dev
 RUN update-ca-certificates
 
+# Compiles (or downloads) the native libzkgroup library for signal-cli
+# See https://github.com/AsamK/signal-cli/wiki/Provide-native-lib-for-libsignal
+WORKDIR /root
+COPY docker/libzkgroup libzkgroup
+COPY --from=rust_fix /usr/src/zkgroup libzkgroup/zkgroup
+WORKDIR libzkgroup
+# This script tries to download precompiled binaries before falling back to compilation
+RUN ./build.sh
+
+# The 'qr' command is used in the process of linking the machine with a Signal account
+# --> Built files are put in /root/.local
+RUN python3 -m pip install --no-cache-dir --user --upgrade pip
+RUN python3 -m pip install --no-cache-dir --user qrcode[pil]
+
 # Signal unpacking
 WORKDIR /root
 ENV SIGNAL_VERSION=${signal_version}
@@ -50,22 +73,13 @@ RUN curl -L -o signal-cli.tar.gz "https://github.com/AsamK/signal-cli/releases/d
 RUN tar xf "signal-cli.tar.gz" -C /opt
 RUN mv "/opt/signal-cli-${SIGNAL_VERSION}" /opt/signal-cli
 
-# Compiles (or downloads) the native libzkgroup library for signal-cli
+# Prepare a placeholder for libzkgroup
-# See https://github.com/AsamK/signal-cli/wiki/Provide-native-lib-for-libsignal
+# Option a : Remove the classic library from the JAR (the alpine-compatible one has to be put somewhere in java.library.path)
-COPY docker/libzkgroup libzkgroup
+# The JAR is the same for all environments : can be cached, etc.
-COPY --from=rust_fix /usr/src/zkgroup libzkgroup/zkgroup
-WORKDIR libzkgroup
-# This script tries to download precompiled binaries before falling back to compilation
-RUN ./build.sh
-
-# Copies libzkgroup where it belongs
-WORKDIR ${TARGETPLATFORM}
-# TODO Use option a. ; it allows running this step before the signal-cli installation
-# and doesn't touch the signal-cli files
-# Option a : Removes the classic library from the JAR (the alpine-compatible one has to be put somewhere in java.library.path)
 RUN zip -d /opt/signal-cli/lib/zkgroup-java-*.jar libzkgroup.so
-# Option b : Replaces the classic library directly inside the JAR with the compiled one
+# Option b : Replace the classic library directly inside the JAR with the compiled one
-# Maybe less clean but also simpler in the second build stage
+# Maybe less clean than a. but the next build stage has one less file to copy
+# WORKDIR ${TARGETPLATFORM}
 # RUN zip -d /opt/signal-cli/lib/zkgroup-java-*.jar libzkgroup.so && \
 #     zip /opt/signal-cli/lib/zkgroup-java-*.jar libzkgroup.*
 
@@ -86,9 +100,9 @@ ARG TARGETPLATFORM
 
 LABEL signal="true"
 
-# apt-utils : not required ; but there is a warning asking for it
-# lsb_release is required by pip and not present on slim + ARM images
 RUN apt-get update && \
+    # apt-utils : not required ; but may improve build speed
+    # lsb_release is required by pip and not present on slim + ARM images
     apt-get install --reinstall -y apt-utils lsb-release && \
     rm -rf /var/lib/apt/lists/*
 
@@ -106,9 +120,10 @@ ENV PATH=${JAVA_HOME}/bin:${PATH}
 # basic smoke test
 RUN java --version
 
-# The 'qr' command is used in the process of linking the machine with a Signal account
+# Don't need to set the PATH because it's already done in the base image
-RUN python3 -m pip install --no-cache-dir --user --upgrade pip && \
+# ENV PATH=/root/.local/bin:$PATH
-    python3 -m pip install --no-cache-dir --user qrcode[pil]
+# Copy qrcode and dependencies
+COPY --from=signal_builder /root/.local /root/.local/
 
 # signal-cli files
 COPY --from=signal_builder /opt/signal-cli /opt/signal-cli