Skip to content

Refresh Alpine base image package pins #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gocanto merged 1 commit into from
Jul 27, 2026
Merged

Refresh Alpine base image package pins #196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion infra/docker/base-images/Dockerfile.builder
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ COPY checksums/ /tmp/checksums/
# fortify-headers separately (it must be added by path because its virtual
# provider name conflicts with the musl-provided headers already present).
# 6. Clean up all temporary artifacts.
RUN apk add --no-cache openssl=3.5.6-r0 && \
RUN apk add --no-cache openssl=3.5.7-r0 && \

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

The temporary OpenSSL package bypasses the reproducible package flow.

Both images install OpenSSL from the live APK index rather than downloading and verifying the exact artefact used for the build. This weakens the stated checksum and reproducibility guarantees.

  • infra/docker/base-images/Dockerfile.builder#L40-L40: resolve the architecture before installation, then fetch and checksum-verify openssl-3.5.7-r0.apk before installing it by path.
  • infra/docker/base-images/Dockerfile.runtime#L33-L33: apply the same verified installation flow and add the corresponding runtime checksum entry.
🧰 Tools
🪛 Hadolint (2.14.0)

[warning] 40-40: Use WORKDIR to switch to a directory

(DL3003)

[warning] 40-40: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

(DL3018)

[info] 40-40: Double quote to prevent globbing and word splitting.

(SC2086)

[warning] 40-40: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

(DL4006)

🪛 Trivy (0.72.0)

[warning] 40-104: 'RUN cd ...' to change directory

RUN should not be used to change directory: 'apk add --no-cache openssl=3.5.7-r0 && target_arch="${TARGETARCH}"; if [ -z "${target_arch}" ]; then case "$(apk --print-arch)" in aarch64) target_arch="arm64" ;; x86_64) target_arch="amd64" ;; *) echo "Unsupported Alpine arch: $(apk --print-arch)" &gt;&amp;2; exit 1 ;; esac; fi &amp;&amp; case "${target_arch}" in arm64) apk_arch="aarch64" ;; amd64) apk_arch="x86_64" ;; ) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; esac && mkdir -p "/tmp/local-repo/${apk_arch}" && for apk_pkg in binutils-2.45.1-r0.apk file-5.46-r2.apk fortify-headers-1.1-r5.apk g++-15.2.0-r2.apk gcc-15.2.0-r2.apk gmp-6.3.0-r4.apk isl26-0.26-r1.apk jansson-2.14.1-r0.apk libatomic-15.2.0-r2.apk libgcc-15.2.0-r2.apk libgomp-15.2.0-r2.apk libmagic-5.46-r2.apk libsharpyuv-1.6.0-r0.apk libstdc++-15.2.0-r2.apk libstdc++-dev-15.2.0-r2.apk libwebp-1.6.0-r0.apk libwebpdecoder-1.6.0-r0.apk libwebpdemux-1.6.0-r0.apk libwebp-dev-1.6.0-r0.apk libwebpmux-1.6.0-r0.apk make-4.4.1-r3.apk mpc1-1.3.1-r1.apk mpfr4-4.2.2-r0.apk musl-1.2.5-r23.apk musl-dev-1.2.5-r23.apk patch-2.8-r0.apk pkgconf-2.5.1-r0.apk zlib-1.3.2-r0.apk zstd-libs-1.5.7-r2.apk ; do wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; done && cd "/tmp/local-repo/${apk_arch}" && sha256sum -c "/tmp/checksums/builder-${apk_arch}.sha256" && openssl genrsa -out /tmp/apk-sign.rsa 2048 2>/dev/null && openssl rsa -in /tmp/apk-sign.rsa -pubout -out /etc/apk/keys/apk-sign.rsa.pub 2>/dev/null && apk index -q -o /tmp/APKINDEX.unsigned.tar.gz /tmp/local-repo/${apk_arch}/.apk && mkdir -p /tmp/sig && openssl dgst -sha1 -sign /tmp/apk-sign.rsa -out /tmp/sig/.SIGN.RSA.apk-sign.rsa.pub /tmp/APKINDEX.unsigned.tar.gz && tar cf /tmp/sig.tar -C /tmp/sig .SIGN.RSA.apk-sign.rsa.pub && head -c $(( $(wc -c < /tmp/sig.tar) - 1024 )) /tmp/sig.tar | gzip -9 | cat - /tmp/APKINDEX.unsigned.tar.gz > "/tmp/local-repo/${apk_arch}/APKINDEX.tar.gz" && apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo binutils file g++ gcc make musl-dev patch pkgconf libwebp-dev && apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/fortify-headers-1.1-r5.apk" && apk del --no-cache openssl && rm -rf /tmp/local-repo /tmp/checksums /tmp/apk-sign.rsa /tmp/sig /tmp/sig.tar /tmp/APKINDEX.unsigned.tar.gz /etc/apk/keys/apk-sign.rsa.pub'. Use 'WORKDIR' statement instead.

Rule: DS-0013

Learn more

(IaC/Dockerfile)

📍 Affects 2 files
  • infra/docker/base-images/Dockerfile.builder#L40-L40 (this comment)
  • infra/docker/base-images/Dockerfile.runtime#L33-L33
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@infra/docker/base-images/Dockerfile.builder` at line 40, Replace the
live-index OpenSSL installation in infra/docker/base-images/Dockerfile.builder
at lines 40-40 with the existing reproducible flow: resolve the architecture,
download openssl-3.5.7-r0.apk, verify it against its checksum, and install the
verified package by path. Apply the same change in
infra/docker/base-images/Dockerfile.runtime at lines 33-33, adding the
corresponding runtime checksum entry.

target_arch="${TARGETARCH}"; \
if [ -z "${target_arch}" ]; then \
case "$(apk --print-arch)" in \
Expand Down
6 changes: 3 additions & 3 deletions infra/docker/base-images/Dockerfile.runtime
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ COPY checksums/ /tmp/checksums/
# 4. Remove openssl — it is only needed for the signing step and should not
# remain in the runtime image.
# 5. Clean up all temporary artifacts.
RUN apk add --no-cache openssl=3.5.6-r0 && \
RUN apk add --no-cache openssl=3.5.7-r0 && \
target_arch="${TARGETARCH}"; \
if [ -z "${target_arch}" ]; then \
case "$(apk --print-arch)" in \
Expand All @@ -48,7 +48,7 @@ RUN apk add --no-cache openssl=3.5.6-r0 && \
libsharpyuv-1.6.0-r0.apk \
libwebp-1.6.0-r0.apk \
musl-1.2.5-r23.apk \
tzdata-2026b-r0.apk \
tzdata-2026c-r0.apk \
zlib-1.3.2-r0.apk \
; do \
wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; \
Expand All @@ -68,6 +68,6 @@ RUN apk add --no-cache openssl=3.5.6-r0 && \
| cat - /tmp/APKINDEX.unsigned.tar.gz \
> "/tmp/local-repo/${apk_arch}/APKINDEX.tar.gz" && \
apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo musl=1.2.5-r23 libwebp && \
apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026b-r0.apk" && \
apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026c-r0.apk" && \
apk del --no-cache openssl && \
rm -rf /tmp/local-repo /tmp/checksums /tmp/apk-sign.rsa /tmp/sig /tmp/sig.tar /tmp/APKINDEX.unsigned.tar.gz /etc/apk/keys/apk-sign.rsa.pub
2 changes: 1 addition & 1 deletion infra/docker/base-images/checksums/runtime-aarch64.sha256
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
5b5009c66c47bd7a49a1b0eb236b526a14b2ed6c0802cb82d41eb6f9ea852a59 libsharpyuv-1.6.0-r0.apk
808eac0eba50a5a7de86e280f4337281eace15a6b10301ee04de3d39f212cfb9 libwebp-1.6.0-r0.apk
6a3edd924ead1fad88a69e28c5775809af3026b322f58428001cd02fedc5299e musl-1.2.5-r23.apk
3649d55ead19c80e66fd5c210f8fdd5b20ccaf007d5ec862e6345aa54a4b5b0f tzdata-2026b-r0.apk
b274132e7e9d36985b9d3324c7e2d724b5b70610743b69f7fe5bc9082bd085aa tzdata-2026c-r0.apk
ecda4cc94fd18f90182f1d3a615889df5e0db9cf78926d11627dd23e06d2e6e8 zlib-1.3.2-r0.apk
2 changes: 1 addition & 1 deletion infra/docker/base-images/checksums/runtime-x86_64.sha256
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
68b1787f41c36e7b6d9def855c5663f2f1ab62fbcc599d38ce3487e75fc883ec libsharpyuv-1.6.0-r0.apk
4d5303958ee38a978501c330c23b62ef98993ae3c30afcd62444723f33da2477 libwebp-1.6.0-r0.apk
4f3c4a7bf9f51d2c91007e333b17459362ffd881b4a343e8da07b6c50c4f4a0d musl-1.2.5-r23.apk
a172f7eedda93509d0dde2f892cf1e0c135969a30c0f19535deef7556aa910a0 tzdata-2026b-r0.apk
50fbca92f9e6c5d003a291587c67b7bd9c084cb54d1b0b0f04e0ac5715b5ab72 tzdata-2026c-r0.apk
f56dea63692059bd65854bb179b7551971a441000b0d98c5b031291ca0450b56 zlib-1.3.2-r0.apk
2 changes: 1 addition & 1 deletion infra/docker/base-images/generate-checksums.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ RUNTIME_PACKAGES=(
libsharpyuv-1.6.0-r0.apk
libwebp-1.6.0-r0.apk
musl-1.2.5-r23.apk
tzdata-2026b-r0.apk
tzdata-2026c-r0.apk
zlib-1.3.2-r0.apk
)

Expand Down
2 changes: 1 addition & 1 deletion infra/makefile/build.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
BUILD_VERSION ?= latest
BASE_GO_VERSION ?= 1.26.3
BASE_ALPINE_VERSION ?= 3.23
BASE_IMAGE_REVISION ?= 4
BASE_IMAGE_REVISION ?= 5
BASE_GO_IMAGE_VARIANT ?= alpine$(BASE_ALPINE_VERSION)
BASE_GO_IMAGE_DIGEST ?= sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d
BASE_ALPINE_IMAGE_DIGEST ?= sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
Expand Down
Loading