[infra] Ruby 3.4.1 arm64 builds are unreliable

[prabhu]

Temporarily disabled these for Ruby 2.5 and cdxgen-secure. We need the split workflows proposed by #1601

[prabhu]

Debian Ruby 26 is now unreliable for arm64.

------
 > [linux/arm64 3/3] RUN apt-get update && apt-get install -qq -y --no-install-recommends curl bash bzip2 git-core zip unzip make gawk     && apt-get install -qq -y build-essential gcc-9 g++-9 python2 libmagic-dev locales nodejs     && gem install bundler -v 1.17.3     && bundle config git.allow_insecure true     && chmod +x /tmp/install.sh     && SKIP_PYTHON=yes ./tmp/install.sh && rm /tmp/install.sh     && node -v     && npm -v     && npm install -g corepack     && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false     && rm -rf /var/lib/apt/lists/*:
35.16 Setting up git (1:2.30.2-1+deb11u4) ...
35.84 Setting up libcurl4:arm64 (7.74.0-1.3+deb11u14) ...
35.84 Setting up curl (7.74.0-1.3+deb11u14) ...
35.85 Setting up libcurl4-openssl-dev:arm64 (7.74.0-1.3+deb11u14) ...
35.85 Processing triggers for libc-bin (2.31-13+deb11u3) ...
35.91 qemu: uncaught target signal 11 (Segmentation fault) - core dumped
36.31 Segmentation fault (core dumped)
36.33 qemu: uncaught target signal 11 (Segmentation fault) - core dumped
36.79 Segmentation fault (core dumped)
: Sub-process /usr/bin/dpkg returned an error code (1)

In general, the arm64 workflows needs some serious work or users must start building their own images.

• qemu: uncaught target signal 11 (Segmentation fault) - core dumped docker/buildx#1169

[prabhu]

I am seriously tempted to hire a DevOps and fully fund them to setup and maintain all the oss infrastructure. Send me your profile: prabhu at appthreat dot dev.

[prabhu]

My attempt to use the new macos-hosted for docker builds has been unsuccessful. It's an arm64 machine, so using buildx for linux/amd64 keeps failing with strange errors.

[prabhu]

We now have two Mac Mini M4 Pro's with the label macos-hosted. I have assigned some debian ruby images to use these builders and things are quite fast!

Some learnings:

• Just use colima without the osxkeychain helper. This increases the need for better physical security and OS hardening
• Only one docker build could run at a time per machine. This is due to the use of a shared docker context.