Refresh Alpine base image package pins

[gocanto]

Summary

• update the temporary OpenSSL pin to the current Alpine 3.23 revision
• update tzdata for both runtime architectures and regenerate its checksums
• bump the reproducible base-image revision to r5

Verification

• make build-base-images
• builder smoke check: GCC, libwebp pkg-config, and Go 1.26.3
• make generate-apk-checksums
• git diff --check

This repairs the existing clean-runner failure before the writing redirect deployment.

Summary by CodeRabbit

• Updates
  • Updated the base builder and runtime images with the latest OpenSSL package.
  • Refreshed runtime time-zone data to the 2026c release.
  • Updated package verification data to match the refreshed runtime image contents.
  • Incremented the base image revision, producing new builder and runtime image tags.

[coderabbitai]

Walkthrough

The base images now pin OpenSSL 3.5.7-r0 and tzdata 2026c-r0, update corresponding runtime checksums, and increment the default base image revision from 4 to 5.

Changes

Base image refresh

Layer / File(s)	Summary
Package pins and checksums infra/docker/base-images/Dockerfile.builder, infra/docker/base-images/Dockerfile.runtime, infra/docker/base-images/checksums/*, infra/docker/base-images/generate-checksums.sh	Builder and runtime images use the updated OpenSSL and tzdata APK versions, while checksum generation and recorded runtime hashes match the new tzdata package.
Base image revision infra/makefile/build.mk	The default BASE_IMAGE_REVISION increases from 4 to 5, changing derived base image versions and tags.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: refreshing Alpine base image package pins and related checksum updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@infra/docker/base-images/Dockerfile.builder`:
- Line 40: Replace the live-index OpenSSL installation in
infra/docker/base-images/Dockerfile.builder at lines 40-40 with the existing
reproducible flow: resolve the architecture, download openssl-3.5.7-r0.apk,
verify it against its checksum, and install the verified package by path. Apply
the same change in infra/docker/base-images/Dockerfile.runtime at lines 33-33,
adding the corresponding runtime checksum entry.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1edb895b-f401-4c03-809c-af4931855e5e

📥 Commits

Reviewing files that changed from the base of the PR and between 24e8b72 and df3476c.

📒 Files selected for processing (6)

• infra/docker/base-images/Dockerfile.builder
• infra/docker/base-images/Dockerfile.runtime
• infra/docker/base-images/checksums/runtime-aarch64.sha256
• infra/docker/base-images/checksums/runtime-x86_64.sha256
• infra/docker/base-images/generate-checksums.sh
• infra/makefile/build.mk

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

The temporary OpenSSL package bypasses the reproducible package flow.

Both images install OpenSSL from the live APK index rather than downloading and verifying the exact artefact used for the build. This weakens the stated checksum and reproducibility guarantees.

• infra/docker/base-images/Dockerfile.builder#L40-L40: resolve the architecture before installation, then fetch and checksum-verify openssl-3.5.7-r0.apk before installing it by path.
• infra/docker/base-images/Dockerfile.runtime#L33-L33: apply the same verified installation flow and add the corresponding runtime checksum entry.

🧰 Tools

🪛 Hadolint (2.14.0)

[warning] 40-40: Use WORKDIR to switch to a directory

(DL3003)

---

[warning] 40-40: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

---

[info] 40-40: Double quote to prevent globbing and word splitting.

(SC2086)

---

[warning] 40-40: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

(DL4006)

🪛 Trivy (0.72.0)

[warning] 40-104: 'RUN cd ...' to change directory

RUN should not be used to change directory: 'apk add --no-cache openssl=3.5.7-r0 && target_arch="${TARGETARCH}"; if [ -z "${target_arch}" ]; then case "$(apk --print-arch)" in aarch64) target_arch="arm64" ;; x86_64) target_arch="amd64" ;; *) echo "Unsupported Alpine arch: $(apk --print-arch)" &gt;&amp;2; exit 1 ;; esac; fi &amp;&amp; case "${target_arch}" in arm64) apk_arch="aarch64" ;; amd64) apk_arch="x86_64" ;; ) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; esac && mkdir -p "/tmp/local-repo/${apk_arch}" && for apk_pkg in binutils-2.45.1-r0.apk file-5.46-r2.apk fortify-headers-1.1-r5.apk g++-15.2.0-r2.apk gcc-15.2.0-r2.apk gmp-6.3.0-r4.apk isl26-0.26-r1.apk jansson-2.14.1-r0.apk libatomic-15.2.0-r2.apk libgcc-15.2.0-r2.apk libgomp-15.2.0-r2.apk libmagic-5.46-r2.apk libsharpyuv-1.6.0-r0.apk libstdc++-15.2.0-r2.apk libstdc++-dev-15.2.0-r2.apk libwebp-1.6.0-r0.apk libwebpdecoder-1.6.0-r0.apk libwebpdemux-1.6.0-r0.apk libwebp-dev-1.6.0-r0.apk libwebpmux-1.6.0-r0.apk make-4.4.1-r3.apk mpc1-1.3.1-r1.apk mpfr4-4.2.2-r0.apk musl-1.2.5-r23.apk musl-dev-1.2.5-r23.apk patch-2.8-r0.apk pkgconf-2.5.1-r0.apk zlib-1.3.2-r0.apk zstd-libs-1.5.7-r2.apk ; do wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; done && cd "/tmp/local-repo/${apk_arch}" && sha256sum -c "/tmp/checksums/builder-${apk_arch}.sha256" && openssl genrsa -out /tmp/apk-sign.rsa 2048 2>/dev/null && openssl rsa -in /tmp/apk-sign.rsa -pubout -out /etc/apk/keys/apk-sign.rsa.pub 2>/dev/null && apk index -q -o /tmp/APKINDEX.unsigned.tar.gz /tmp/local-repo/${apk_arch}/.apk && mkdir -p /tmp/sig && openssl dgst -sha1 -sign /tmp/apk-sign.rsa -out /tmp/sig/.SIGN.RSA.apk-sign.rsa.pub /tmp/APKINDEX.unsigned.tar.gz && tar cf /tmp/sig.tar -C /tmp/sig .SIGN.RSA.apk-sign.rsa.pub && head -c $(( $(wc -c < /tmp/sig.tar) - 1024 )) /tmp/sig.tar | gzip -9 | cat - /tmp/APKINDEX.unsigned.tar.gz > "/tmp/local-repo/${apk_arch}/APKINDEX.tar.gz" && apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo binutils file g++ gcc make musl-dev patch pkgconf libwebp-dev && apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/fortify-headers-1.1-r5.apk" && apk del --no-cache openssl && rm -rf /tmp/local-repo /tmp/checksums /tmp/apk-sign.rsa /tmp/sig /tmp/sig.tar /tmp/APKINDEX.unsigned.tar.gz /etc/apk/keys/apk-sign.rsa.pub'. Use 'WORKDIR' statement instead.

Rule: DS-0013

Learn more

(IaC/Dockerfile)

📍 Affects 2 files

• infra/docker/base-images/Dockerfile.builder#L40-L40 (this comment)
• infra/docker/base-images/Dockerfile.runtime#L33-L33

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@infra/docker/base-images/Dockerfile.builder` at line 40, Replace the
live-index OpenSSL installation in infra/docker/base-images/Dockerfile.builder
at lines 40-40 with the existing reproducible flow: resolve the architecture,
download openssl-3.5.7-r0.apk, verify it against its checksum, and install the
verified package by path. Apply the same change in
infra/docker/base-images/Dockerfile.runtime at lines 33-33, adding the
corresponding runtime checksum entry.