feat: add 1.14.9 on bookworm - #57
Open
xanimo wants to merge 7 commits into
Open
Conversation
jitterbit/get-changed-files@v1 has been unmaintained since 2021 and is the only third party dep in the build matrix. reads the changed file list off the pulls api now instead. bumped checkout/github-script/qemu/buildx/build-push, added permissions blocks, added entrypoint* to the paths filter so a non python entrypoint still triggers a build. not a repair. build-ci last ran green 2026-06-26 and lint-py 2026-06-11, the pinned actions still work, they're just old and one is abandoned. genmatrix untouched. same matrix for a changed Dockerfile, null for an unrelated file, all builds for a ci change. both pylint runs 10.00/10.
hadolint and shellcheck run over the whole tree so a new version dir or a new script is covered without touching the workflow. closes the rest of #43. suppressed DL3008 inline on both apt-get calls instead of fixing it since debian rotates point releases out of the archive and pinning turns a security update into a build failure. hadolint v2.12.0 exits 0 on 1.14.5/bullseye, shellcheck path is a no-op until a script exists.
binaries were installed setuid to a useradd assigned uid and entrypoint.py setuid()d to it, so everything written to a bind mount landed as that uid no matter who ran the container. --user couldn't override it since setuid() is EPERM for a non root caller. binaries are root:root 0555 now with no setuid bit, uid pinned so a base image change can't move it, USER 1000:1000 numeric so runAsNonRoot can check it without running the image. setuid and chown are gone from the entrypoint and the datadir is group owned by 0 with group write so --user 1001:0 keeps access. verified on amd64. binaries r-xr-xr-x root root, runtime uid 1000, dogecoind at --user 1001:1001 writes host files owned by 1001. integration suite passes, pylint 10.00/10, hadolint clean.
converts the pytest cases left in #33 and dogecoin#50 to the integration framework. the originals assert mode 4555 and a fixed owner which is the defect not the behaviour. files_metadata stats every installed file and rejects any setuid or setgid bit. datadir checks the runtime user isn't root, that a missing datadir gets created, and that the creating uid is the operator's, once as the default user and once as --user 1001:0. framework gains optional user and volume args, nothing else uses them yet. these fail against the pre fix model rather than only passing against the new one. rebuilt with 4555 binaries and the old entrypoint gives "expected (0, 0, '555'), found (1000, 1000, '4555')" and "container runs as root" while the version test still passes. 3/3 green on the fixed image, pylint 10.00/10.
mirrors 1.14.5/bullseye with the same de-privileged model and the same entrypoint.py. verification differs. no signer of 1.14.9-linux has a key in contrib/gitian-keys so every signature there is BAD SIGNATURE and there's nothing to pick from. gates on the release SHA256SUMS instead, signed by a maintainer key that is in the keyring. fingerprint is pinned because gpg exits 0 on EXPKEYSIG and that key has since expired, so the exit code alone would accept a signature it never evaluated. pinned SHASUMS still checked separately. ca-certificates is explicit now, 1.14.5 got it transitively off ruby which this stage doesn't need. builds on all four declared platforms, 3/3 on amd64 and arm64, hadolint clean, pylint 10.00/10. build fails as intended when the fingerprint doesn't match.
bullseye is past lts end so debian-security rotates packages out from under a stale index and the verify stage 404s on libperl5.32 deb11u5, which failed three of four platforms on ci twice in a row. copies the build to 1.14.5/bookworm with only the base image changed and drops the bullseye dir. fresh --no-cache build verifies against a gitian signer on bookworm ruby, 3/3 integration on amd64, hadolint clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
adds a 1.14.9 image on bookworm and carries the security and qa work it sits on: setuid is gone and the uid is pinned, integration tests cover installed file metadata and datadir ownership, hadolint and shellcheck run over the whole tree, and the one unmaintained ci action is replaced with a read off the pulls api.
the 1.14.9 build mirrors 1.14.5 with the same de-privileged model and the same entrypoint.py. verification differs: no signer of 1.14.9-linux has a key in contrib/gitian-keys so every signature there is BAD SIGNATURE, and it gates on the release SHA256SUMS instead, signed by a maintainer key that is in the keyring. the fingerprint is pinned because gpg exits 0 on EXPKEYSIG and that key has since expired, so the exit code alone would accept a signature it never evaluated. pinned SHASUMS are still checked separately.
the security change lands in 1.14.5 too, and 1.14.5 moves from bullseye to bookworm since bullseye is past lts end and debian-security 404s on rotated packages. binaries were installed setuid to a useradd assigned uid and entrypoint.py setuid()d to it, so everything written to a bind mount landed as that uid no matter who ran the container, and --user couldn't override it since setuid() is EPERM for a non root caller. binaries are root:root 0555 now, USER is 1000:1000 numeric so runAsNonRoot can check it without running the image, and the datadir is group owned by 0 with group write so --user 1001:0 keeps access.
the new tests fail against the pre fix model rather than only passing against the new one. rebuilt with 4555 binaries and the old entrypoint gives "expected (0, 0, '555'), found (1000, 1000, '4555')" and "container runs as root" while the version test still passes.
builds on all four declared platforms, 3/3 integration on amd64 and arm64, hadolint clean, pylint 10.00/10. build fails as intended when the fingerprint doesn't match.