Slim down Autograph container

[grahamalama]

The autograph container is large, which makes pulling it in CI pipelines pretty time consuming. I looked for anything we could do to make it smaller to speed up pulls, and I came up with these "quick wins":

• build binaries in separate stage and copy to final stage
• install deb packages with --no-install-recommends
• remove apt-get lists as a cleanup step
• add .git directory to .dockerignore

These changes make for a 44% reduction of the size of the compressed container

❯ ls -lah ../ | grep tar
-rw-r--r--@  1 gbeckley  staff   556M Oct 18 18:44 after.tar.gz
-rw-r--r--@  1 gbeckley  staff   998M Oct 18 18:21 before.tar.gz

[grahamalama]

This passed the integration test, though I noticed some of these in the output on CircleCI:

fatal: not a git repository (or any of the parent directories): .git

I'm guessing that comes from here

autograph/tools/autograph-client/build_test_xpis.sh

Line 14 in 7bc7ab2

OUTPUT_BASENAME=autograph-$(git rev-parse --short HEAD)-$CONFIG-$(basename $INPUT_FILE '.zip')-PKCS7

Is the SHA itself important here? Maybe there's another value we can provide, or maybe it's not important in a CI setting? If we do need it, maybe we can provide it as a build arg or environment variable.

[hwine]

N.B.: Remote settings does some gnarly stuff for testing. This is not a "guaranteed interface", but it'd be nice not to break it.

[jmhodges]

@grahamalama so, @oskirby updated the dockerfile in similar ways just now. Is there still stuff left on table for us to do?

[jmhodges]

(That comment was directed @grahamalama. Edited to be more clear!)

[grahamalama]

@jmhodges did you mean to link to this PR? It seems to get more into the nitty gritty of the Dockerfile than #897.

I'm not seeing any PR that does quite the same thing as this one, but maybe these changes could be folded into one of the ones from @oskirby. #898 seems to make the image (just a bit) larger, but I don't see a reason why we couldn't apply similar strategies (multistage build, cleaning after we use apt, leverage .dockerignore) to a different base image.