feat: add 1.14.9 on bookworm

.github/workflows/build-ci.yml

@@ -4,39 +4,43 @@ on:
   pull_request:
     paths:
       - "**/Dockerfile"
-      - "**/entrypoint.py"
+      - "**/entrypoint*"
       - "**/PLATFORMS"
       - "tests/**"
       - "tools/genmatrix.js"
       - ".github/workflows/build-ci.yml"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   gen-matrix:
     name: generate-matrix
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Get changed files
-        id: get-changed-files
-        uses: jitterbit/get-changed-files@v1
-        with:
-          format: 'json'
+        uses: actions/checkout@v4
 
       - name: Generate testing matrix
-        uses: actions/github-script@v4.1
+        uses: actions/github-script@v7
         id: generator
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const script = require(`${process.env.GITHUB_WORKSPACE}/tools/genmatrix.js`)
-            return script(process.env.GITHUB_WORKSPACE, ${{ steps.get-changed-files.outputs.all }});
+            // Read changed files from the API rather than a third-party
+            // action, so the build list depends on nothing we don't control.
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+            const script = require(`${process.env.GITHUB_WORKSPACE}/tools/genmatrix.js`);
+            return script(process.env.GITHUB_WORKSPACE, files.map(file => file.filename));
     outputs:
       matrix: ${{ steps.generator.outputs.result }}
 
   build:
-    if: ${{ fromJson(needs.gen-matrix.outputs.matrix) }}
+    if: ${{ needs.gen-matrix.outputs.matrix != 'null' }}
     needs: gen-matrix
     name: build
     env:
@@ -50,17 +54,17 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
 
       - name: Build image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           builder: ${{ steps.buildx.outputs.name }}
           push: false

.github/workflows/lint-docker.yml

@@ -0,0 +1,39 @@
+name: lint-docker
+
+on:
+  push:
+    paths:
+      - "**/Dockerfile"
+      - ".github/workflows/lint-docker.yml"
+  pull_request:
+    paths:
+      - "**/Dockerfile"
+      - ".github/workflows/lint-docker.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  lint-docker:
+    name: lint (dockerfile)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Every Dockerfile in the tree, so a new version directory is linted
+      # without touching this workflow. Rule exceptions belong inline, next
+      # to the line they excuse.
+      - name: Run hadolint
+        run: |
+          status=0
+          while IFS= read -r dockerfile; do
+            echo "==> ${dockerfile}"
+            docker run --rm -i hadolint/hadolint:v2.12.0 hadolint - \
+              < "${dockerfile}" || status=1
+          done < <(find . -name Dockerfile)
+          exit "${status}"
+        shell: bash

.github/workflows/lint-js.yml

@@ -10,6 +10,9 @@ on:
       - "**/*.js"
       - ".github/workflows/lint-js.yml"
 
+permissions:
+  contents: read
+
 jobs:
   lint-js:
     name: lint (javascript)
@@ -18,12 +21,16 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - name: Install semistandard
-        run: |
-          npm install -g semistandard
-
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+
+      - name: Set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 'lts/*'
+
+      - name: Install semistandard
+        run: npm install -g semistandard
 
       - name: Run linter
-        run: find . -name "*.js" | xargs semistandard
+        run: find . -name "*.js" -exec semistandard {} +

.github/workflows/lint-py.yml

@@ -4,12 +4,17 @@ on:
   push:
     paths:
       - "**/*.py"
+      - "pylintrc.tests"
       - ".github/workflows/lint-py.yml"
   pull_request:
     paths:
       - "**/*.py"
+      - "pylintrc.tests"
       - ".github/workflows/lint-py.yml"
 
+permissions:
+  contents: read
+
 jobs:
   lint-py:
     name: lint (python)
@@ -18,17 +23,24 @@ jobs:
     strategy:
       fail-fast: false
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Runner system python is externally managed (PEP 668), pip cannot
+      # install into it. Provision our own interpreter instead.
+      - name: Set up python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
       - name: Install pylint
         run: pip3 install pylint
 
-      - name: Checkout
-        uses: actions/checkout@v2
-
       - name: Run linter for images code
-        run: find . -name "*.py" ! -path "*/tests/*" | xargs pylint
+        run: find . -name "*.py" ! -path "*/tests/*" -exec pylint --rcfile=pylintrc.images {} +
 
       - name: Install pylint dependencies for tests
         run: pip3 install pytest
 
       - name: Run linter for tests code
-        run: find "./tests" -name "*.py" | xargs pylint --rcfile=pylintrc.tests
+        run: find "./tests" -name "*.py" -exec pylint --rcfile=pylintrc.tests {} +

.github/workflows/lint-sh.yml

@@ -0,0 +1,38 @@
+name: lint-sh
+
+on:
+  push:
+    paths:
+      - "**/*.sh"
+      - ".github/workflows/lint-sh.yml"
+  pull_request:
+    paths:
+      - "**/*.sh"
+      - ".github/workflows/lint-sh.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  lint-sh:
+    name: lint (shell)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # No-op while the tree has no shell scripts; present so that adding one
+      # cannot land unlinted.
+      - name: Run shellcheck
+        run: |
+          mapfile -t scripts < <(find . -name "*.sh")
+          if [ "${#scripts[@]}" -eq 0 ]; then
+            echo "No shell scripts to lint."
+            exit 0
+          fi
+          docker run --rm -v "${PWD}:/mnt" -w /mnt \
+            koalaman/shellcheck:v0.9.0 "${scripts[@]}"
+        shell: bash

1.14.5/bullseye/Dockerfile → 1.14.5/bookworm/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim AS verify
+FROM debian:bookworm-slim AS verify
 
 WORKDIR /verify
 
@@ -28,6 +28,9 @@ ARG DESCRIPTOR_PATH=dogecoin/contrib/gitian-descriptors/gitian-${RLS_OS}.yml
 ARG RLS_LOCATION=https://github.com/dogecoin/dogecoin/releases/download/v${RLS_VERSION}
 
 # install system requirements
+# Versions are deliberately unpinned: Debian rotates point releases out of
+# the archive, so a pin turns a security update into a build failure.
+# hadolint ignore=DL3008
 RUN apt-get update && apt-get install --no-install-recommends -y \
     wget \
     git \
@@ -60,29 +63,37 @@ RUN ARCHITECTURE=$(dpkg --print-architecture) \
     && grep "${RLS_FILE_NAME}" SHASUMS | sha256sum -c \
     && mv "${RLS_FILE_NAME}" dogecoin.tar.gz
 
-FROM debian:bullseye-slim AS final
+FROM debian:bookworm-slim AS final
 
 ENV USER=dogecoin
 ENV DATADIR=/${USER}/.dogecoin
 
 # Root configuration to mimic user
 ENV HOME=/${USER}
 
-RUN useradd ${USER} --home-dir ${HOME}
+# Pin the uid. An unpinned useradd takes whatever is free, so a base image
+# change would silently move ownership of bind-mounted wallet files.
+RUN useradd ${USER} --uid 1000 --user-group --home-dir ${HOME}
 
 WORKDIR /tmp
 
 # Copy the downloaded binary from the verify stage
 COPY --from=verify /verify/dogecoin.tar.gz ./
 
-# Move downloaded binaries and man pages in the container system.
-# Setuid on binaries with $USER rights, to limit root usage.
+# Install the binaries root-owned and not setuid, so the unprivileged
+# runtime user can neither replace them nor escalate through them.
 RUN tar -xvf dogecoin.tar.gz --strip-components=1 \
     && cp bin/dogecoind bin/dogecoin-cli bin/dogecoin-tx /usr/local/bin/ \
-    && chown ${USER}:${USER} /usr/local/bin/dogecoin* \
-    && chmod 4555 /usr/local/bin/dogecoin* \
+    && chown root:root /usr/local/bin/dogecoin* \
+    && chmod 0555 /usr/local/bin/dogecoin* \
     && rm -rf -- *
 
+# Group-own the home and datadir by root(0) and grant group write, so an
+# operator overriding the uid (--user 1001:0) keeps write access.
+RUN mkdir -p ${DATADIR} \
+    && chown -R 1000:0 ${HOME} \
+    && chmod -R g+rwX ${HOME}
+
 WORKDIR ${HOME}
 
 # P2P network (mainnet, testnet & regnet respectively)
@@ -94,12 +105,19 @@ EXPOSE 22555 44555 18332
 VOLUME ["/dogecoin/.dogecoin"]
 
 # Dependencies install
+# hadolint ignore=DL3008
 RUN apt-get update && apt-get install --no-install-recommends -y \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
 COPY entrypoint.py /usr/local/bin/entrypoint.py
-RUN chmod 500 /usr/local/bin/entrypoint.py
+# World-readable and executable: the entrypoint now runs as the
+# unprivileged user, so a root-only mode would make the image unstartable.
+RUN chmod 0555 /usr/local/bin/entrypoint.py
+
+# Numeric, so that runAsNonRoot admission can verify it without running
+# the image. Never root at runtime.
+USER 1000:1000
 
 ENTRYPOINT ["entrypoint.py"]
 CMD ["dogecoind"]