Build tonistiigi/binfmt image from source

[hjiawei]

This change imports the tonistiigi/binfmt source into our toolchain and rebuilds the cross-platform emulator collection image using qemu-user-static from Fedora.

[Copilot]

Pull request overview

This pull request adds support for building the tonistiigi/binfmt image from source rather than using a pre-built external image. This improves security, reproducibility, and control over the binfmt tooling used for multi-architecture container builds.

Changes:

• Introduces a new calico-binfmt image that bundles QEMU user-static binaries from Fedora and a custom binfmt binary built from Go source code
• Adds binfmt command-line tool (ported from tonistiigi/binfmt) to manage binfmt_misc registrations for cross-architecture emulation
• Updates CI/CD pipelines to build and publish the new binfmt image alongside existing base and go-build images

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
images/calico-binfmt/versions.yaml	Defines version pins for QEMU (10.1.3) and tonistiigi-binfmt source reference (commit 49eb232)
images/calico-binfmt/Dockerfile	Multi-stage build that installs QEMU binaries from Fedora and packages them with the binfmt binary
images/Makefile	Adds build targets for calico-binfmt image, updates clean target and image dependencies
go.mod	Updates Go version to 1.25.6 and adds dependencies for platforms, buildkit, and image-spec libraries
go.sum	Adds checksums for new dependencies and updates existing ones (logrus, testify, sys, yaml)
cmd/binfmt/version.go	Defines version variables injected at build time via ldflags
cmd/binfmt/main.go	Main implementation of binfmt CLI tool for installing/uninstalling architecture emulation support
cmd/binfmt/config.go	Configuration data for supported architectures including ELF magic bytes and masks for QEMU registration
cmd/Makefile	Adds build target for binfmt binary with version information from versions.yaml
.semaphore/semaphore.yml	Adds CI job to build calico/binfmt image and updates promotion configuration
.semaphore/promotions/calico-binfmt.yml	Defines CI/CD pipeline for publishing calico/binfmt images
.gitignore	Adds images/calico-binfmt/bin to ignore list

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hjiawei]

We only support the amd64, arm64, s390x, and ppc64le platforms. All other platforms have been commented out to reduce potential merge conflicts in the future.

[hjiawei]

We only support the amd64, arm64, s390x, and ppc64le platforms.

[hjiawei]

Instead of using latest, I’ve tagged the image using the qemu-vx.y.z scheme. The current tag is calico/binfmt:qemu-v10.1.3.

[hjiawei]

Related to tonistiigi/binfmt#285.