pkg: Improve package build

- Only build if the hash has changed. Previosuly
  we'd unconditionally build and not push of the tag existed.
- Add '.m' to the hash if the repository is dirty.
  This allows developers to build locally without committing
  but makes it clear that the hash is from a modified repository.
- Don't push to hub if the repository is dirty
- If the current commit has a tag, also push this to hub.

Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>

pkg/package.mk

@@ -5,13 +5,39 @@ ORG?=linuxkit
 HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
 BASE_DEPS=Dockerfile Makefile
 
-tag: $(BASE_DEPS) $(DEPS)
-ifndef $(NETWORK)
-	docker build -t $(ORG)/$(IMAGE):$(HASH) .
+# Add '-dirty' to hash if the repository is not clean. make does not
+# concatenate strings without spaces, so we use the documented trick
+# of replacing the space with nothing.
+DIRTY=$(shell git diff-index --quiet HEAD --; echo $$?)
+ifneq ($(DIRTY),0)
+HASH+=-dirty
+nullstring :=
+space := $(nullstring) $(nullstring)
+TAG=$(subst $(space),,$(HASH))
 else
-	docker build --network=none -t $(ORG)/$(IMAGE):$(HASH) .
+TAG=$(HASH)
 endif
 
+# Get a release tag, if present
+RELEASE=$(shell git tag -l --points-at HEAD)
+
+ifndef $(NETWORK)
+NET_OPT=
+else
+NET_OPT=--network=none
+endif
+
+tag: $(BASE_DEPS) $(DEPS)
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(TAG) || \
+	docker build $(NET_OPT) -t $(ORG)/$(IMAGE):$(TAG) .
+
 push: tag
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(HASH) || \
-	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(HASH)
+ifneq ($(DIRTY),0)
+	$(error Your repository is not clean. Will not push package image.)
+endif
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(TAG) || \
+	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(TAG)
+ifneq ($(RELEASE),)
+	docker tag $(ORG)/$(IMAGE):$(TAG) $(ORG)/$(IMAGE):$(RELEASE)	
+	DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(RELEASE)
+endif