From 507a61ecb69d48603afcaa049c997e5c20b4f66a Mon Sep 17 00:00:00 2001
From: Gaurav Gahlot <me@gauravgahlot.in>
Date: Mon, 24 Aug 2026 20:31:17 +0200
Subject: [PATCH 1/3] fix: onvif-video-broker build step

Signed-off-by: Gaurav Gahlot <me@gauravgahlot.in>
---
 Makefile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a1c62cb..450402e 100644
--- a/Makefile
+++ b/Makefile
@@ -61,7 +61,10 @@ onvif-video-broker: onvif-video-broker-multiarch
 
 onvif-video-broker-multiarch: onvif-video-broker-amd64 onvif-video-broker-arm64 onvif-video-broker-arm32
 ifeq (1, $(PUSH))
-	docker buildx imagetools create --tag "$(PREFIX)/onvif-video-broker:$(LABEL_PREFIX)"
+	docker buildx imagetools create --tag "$(PREFIX)/onvif-video-broker:$(LABEL_PREFIX)" \
+		$$(for f in onvif-video-broker.sha-amd64 onvif-video-broker.sha-arm64 onvif-video-broker.sha-arm32; do \
+			[ -f "$$f" ] && echo "$(PREFIX)/onvif-video-broker@$$(cat $$f)"; \
+		done)
 endif
 
 ONVIF_BUILDX_PUSH_OUTPUT = type=image,name=$(PREFIX)/onvif-video-broker,push-by-digest=true,name-canonical=true,push=true

From 6ee8152d3ac27cb738d1fb7fbdcd3caa93a8aa72 Mon Sep 17 00:00:00 2001
From: Gaurav Gahlot <me@gauravgahlot.in>
Date: Mon, 24 Aug 2026 20:43:09 +0200
Subject: [PATCH 2/3] paas the metadata file

Signed-off-by: Gaurav Gahlot <me@gauravgahlot.in>
---
 Makefile | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 450402e..b5e9bfa 100644
--- a/Makefile
+++ b/Makefile
@@ -62,8 +62,10 @@ onvif-video-broker: onvif-video-broker-multiarch
 onvif-video-broker-multiarch: onvif-video-broker-amd64 onvif-video-broker-arm64 onvif-video-broker-arm32
 ifeq (1, $(PUSH))
 	docker buildx imagetools create --tag "$(PREFIX)/onvif-video-broker:$(LABEL_PREFIX)" \
-		$$(for f in onvif-video-broker.sha-amd64 onvif-video-broker.sha-arm64 onvif-video-broker.sha-arm32; do \
-			[ -f "$$f" ] && echo "$(PREFIX)/onvif-video-broker@$$(cat $$f)"; \
+		$$(for f in onvif-video-broker.meta-amd64.json onvif-video-broker.meta-arm64.json onvif-video-broker.meta-arm32.json; do \
+			[ -f "$$f" ] || continue; \
+			d=$$(sed -n 's/.*"containerimage\.digest"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$$f"); \
+			[ -n "$$d" ] && echo "$(PREFIX)/onvif-video-broker@$$d"; \
 		done)
 endif
 
@@ -72,17 +74,17 @@ ONVIF_BUILDX_ARGS = $(if $(LOAD), --load --tag $(PREFIX)/onvif-video-broker:$(LA
 
 onvif-video-broker-amd64:
 ifneq (,or(findstring(amd64,$(PLATFORMS)), findstring(x86_64,$(PLATFORMS))))
-	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --iidfile onvif-video-broker.sha-amd64) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(AMD64_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-x64 .
+	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --metadata-file onvif-video-broker.meta-amd64.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(AMD64_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-x64 .
 endif
 
 onvif-video-broker-arm32:
 ifneq (,findstring(arm/v7,$(PLATFORMS)))
-	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --iidfile onvif-video-broker.sha-arm32) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM32V7_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm .
+	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --metadata-file onvif-video-broker.meta-arm32.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM32V7_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm .
 endif
 
 onvif-video-broker-arm64:
 ifneq (,or(findstring(aarch64,$(PLATFORMS)),findstring(arm64,$(PLATFORMS))))
-	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --iidfile onvif-video-broker.sha-arm64) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM64V8_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm64 .
+	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --metadata-file onvif-video-broker.meta-arm64.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM64V8_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm64 .
 endif
 
 opcua-monitoring-broker:

From adee45e62c29dbf425e27a67dcc3a5a8351deca1 Mon Sep 17 00:00:00 2001
From: Gaurav Gahlot <me@gauravgahlot.in>
Date: Mon, 24 Aug 2026 22:03:19 +0200
Subject: [PATCH 3/3] paas the metadata file

Signed-off-by: Gaurav Gahlot <me@gauravgahlot.in>
---
 .gitignore                                  |  3 +++
 Makefile                                    | 12 ++++++------
 build/brokers/Dockerfile.onvif-video-broker |  4 +++-
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1fff7dd..dee7aeb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,6 @@
 .idea
 *.pyc
 pki/*
+
+# buildx metadata emitted by the onvif multi-arch build
+onvif-video-broker.meta-*.json
diff --git a/Makefile b/Makefile
index b5e9bfa..f1ff9bb 100644
--- a/Makefile
+++ b/Makefile
@@ -73,18 +73,18 @@ ONVIF_BUILDX_PUSH_OUTPUT = type=image,name=$(PREFIX)/onvif-video-broker,push-by-
 ONVIF_BUILDX_ARGS = $(if $(LOAD), --load --tag $(PREFIX)/onvif-video-broker:$(LABEL_PREFIX)) $(if $(PUSH), --output $(ONVIF_BUILDX_PUSH_OUTPUT)) -f build/brokers/Dockerfile.onvif-video-broker
 
 onvif-video-broker-amd64:
-ifneq (,or(findstring(amd64,$(PLATFORMS)), findstring(x86_64,$(PLATFORMS))))
-	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --metadata-file onvif-video-broker.meta-amd64.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(AMD64_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-x64 .
+ifneq (,$(or $(findstring amd64,$(PLATFORMS)),$(findstring x86_64,$(PLATFORMS))))
+	docker buildx build $(ONVIF_BUILDX_ARGS) --platform linux/amd64 $(if $(PUSH), --metadata-file onvif-video-broker.meta-amd64.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(AMD64_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-x64 .
 endif
 
 onvif-video-broker-arm32:
-ifneq (,findstring(arm/v7,$(PLATFORMS)))
-	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --metadata-file onvif-video-broker.meta-arm32.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM32V7_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm .
+ifneq (,$(findstring arm/v7,$(PLATFORMS)))
+	docker buildx build $(ONVIF_BUILDX_ARGS) --platform linux/arm/v7 $(if $(PUSH), --metadata-file onvif-video-broker.meta-arm32.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM32V7_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm .
 endif
 
 onvif-video-broker-arm64:
-ifneq (,or(findstring(aarch64,$(PLATFORMS)),findstring(arm64,$(PLATFORMS))))
-	docker buildx build $(ONVIF_BUILDX_ARGS) $(if $(PUSH), --metadata-file onvif-video-broker.meta-arm64.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM64V8_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm64 .
+ifneq (,$(or $(findstring aarch64,$(PLATFORMS)),$(findstring arm64,$(PLATFORMS))))
+	docker buildx build $(ONVIF_BUILDX_ARGS) --platform linux/arm64 $(if $(PUSH), --metadata-file onvif-video-broker.meta-arm64.json) --build-arg OUTPUT_PLATFORM_TAG=$(USE_OPENCV_BASE_VERSION)-$(ARM64V8_SUFFIX) --build-arg DOTNET_PUBLISH_RUNTIME=linux-arm64 .
 endif
 
 opcua-monitoring-broker:
diff --git a/build/brokers/Dockerfile.onvif-video-broker b/build/brokers/Dockerfile.onvif-video-broker
index 2299f2f..72ef1a2 100644
--- a/build/brokers/Dockerfile.onvif-video-broker
+++ b/build/brokers/Dockerfile.onvif-video-broker
@@ -2,7 +2,9 @@ ARG BUILD_PLATFORM_TAG=3.1-bullseye
 ARG OUTPUT_PLATFORM_TAG=3.1-bullseye-slim
 ARG DOTNET_PUBLISH_RUNTIME=linux-x64
 
-FROM mcr.microsoft.com/dotnet/sdk:${BUILD_PLATFORM_TAG} AS build
+# Build on the native builder platform and cross-compile for the target arch via
+# `dotnet publish -r $DOTNET_PUBLISH_RUNTIME`; avoids emulating the SDK stage.
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:${BUILD_PLATFORM_TAG} AS build
 ARG BUILD_PLATFORM_TAG
 RUN echo "Build base image: mcr.microsoft.com/dotnet/sdk:${BUILD_PLATFORM_TAG}"