From 4ae1ef3a62ad35f450bee37348b90d8c9c1539b2 Mon Sep 17 00:00:00 2001 From: svcnemo-autobot Date: Fri, 7 Aug 2026 11:54:44 +0000 Subject: [PATCH] build: verify downloaded yq binaries Signed-off-by: svcnemo-autobot (cherry picked from commit 59bbfaf318b5bf3cb0297c68ccbdacd515536b57) --- docker/Dockerfile.ci.dev | 7 ++++--- docker/Dockerfile.ci.lts | 7 ++++--- docker/Dockerfile.ci.nemo | 1 + 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/docker/Dockerfile.ci.dev b/docker/Dockerfile.ci.dev index bd342e613b1..d65f6b301e0 100644 --- a/docker/Dockerfile.ci.dev +++ b/docker/Dockerfile.ci.dev @@ -23,12 +23,13 @@ RUN bash -ex <<"EOF" python -m venv /opt/jet ARCH=$(uname -m) case "${ARCH}" in \ - "x86_64") YQ_ARCH=amd64 ;; \ - "aarch64") YQ_ARCH=arm64 ;; \ - "armv7l") YQ_ARCH=arm ;; \ + "x86_64") YQ_ARCH=amd64; YQ_SHA256=6dc2d0cd4e0caca5aeffd0d784a48263591080e4a0895abe69f3a76eb50d1ba3 ;; \ + "aarch64") YQ_ARCH=arm64; YQ_SHA256=8c12fcc10e14774ca6624cc282f092a526568b036fe1192258c3aecbad56d063 ;; \ + "armv7l") echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \ *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \ esac wget https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${YQ_ARCH} -O /usr/local/bin/yq + echo "\${YQ_SHA256} /usr/local/bin/yq" | sha256sum --check - chmod a+x /usr/local/bin/yq curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh EOF diff --git a/docker/Dockerfile.ci.lts b/docker/Dockerfile.ci.lts index 1e681e2ff81..64181571e8c 100644 --- a/docker/Dockerfile.ci.lts +++ b/docker/Dockerfile.ci.lts @@ -30,12 +30,13 @@ RUN bash -ex <<"EOF" python -m venv /opt/jet ARCH=$(uname -m) case "${ARCH}" in \ - "x86_64") YQ_ARCH=amd64 ;; \ - "aarch64") YQ_ARCH=arm64 ;; \ - "armv7l") YQ_ARCH=arm ;; \ + "x86_64") YQ_ARCH=amd64; YQ_SHA256=6dc2d0cd4e0caca5aeffd0d784a48263591080e4a0895abe69f3a76eb50d1ba3 ;; \ + "aarch64") YQ_ARCH=arm64; YQ_SHA256=8c12fcc10e14774ca6624cc282f092a526568b036fe1192258c3aecbad56d063 ;; \ + "armv7l") echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \ *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \ esac wget https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${YQ_ARCH} -O /usr/local/bin/yq + echo "\${YQ_SHA256} /usr/local/bin/yq" | sha256sum --check - chmod a+x /usr/local/bin/yq curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh EOF diff --git a/docker/Dockerfile.ci.nemo b/docker/Dockerfile.ci.nemo index 8f250b4374a..11433c33e48 100644 --- a/docker/Dockerfile.ci.nemo +++ b/docker/Dockerfile.ci.nemo @@ -8,6 +8,7 @@ RUN apt-get update && \ apt-get install -y --no-install-recommends gettext && \ apt-get clean && \ wget https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_amd64 -O /usr/local/bin/yq && \ + echo "6dc2d0cd4e0caca5aeffd0d784a48263591080e4a0895abe69f3a76eb50d1ba3 /usr/local/bin/yq" | sha256sum --check - && \ chmod a+x /usr/local/bin/yq ##### For NVIDIANS only #####