Skip to content

Commit ff31ec5

Browse files
benjaminskiljanbenjaminskiljan
authored
Pin dependencies to hash
1 parent c8ba10d commit ff31ec5

File tree

6 files changed

+44
-42
lines changed

6 files changed

+44
-42
lines changed

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,6 @@ jobs:
7373
# Upload the results to GitHub's code scanning dashboard (optional).
7474
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7575
- name: "Upload to code-scanning"
76-
uses: github/codeql-action/upload-sarif@v3
76+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.7
7777
with:
7878
sarif_file: results.sarif

‎images/algorand/Dockerfile‎

Lines changed: 38 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.3-labs
2-
FROM debian:12 as build
2+
FROM debian:12@sha256:b6507e340c43553136f5078284c8c68d86ec8262b1724dde73c325e8d3dcdeba as build
33

44
ARG ALGORAND_VERSION=v4.1.2-stable
55
ARG GO_VERSION=1.23.9
@@ -11,64 +11,66 @@ ENV GOPATH=/opt/algorand/go
1111
ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
1212

1313
RUN <<-EOF
14-
apt-get -y update && \
15-
apt-get -y install \
16-
curl \
17-
git \
18-
make \
19-
gcc \
20-
g++ \
21-
pkg-config \
22-
libboost-dev \
23-
autoconf \
24-
automake \
25-
python3 && \
26-
curl -L -o /tmp/go-linux-amd64.tar.gz https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz && \
14+
set -e
15+
apt-get -y update && apt-get -y install \
16+
curl \
17+
git \
18+
make \
19+
gcc \
20+
g++ \
21+
pkg-config \
22+
libboost-dev \
23+
autoconf \
24+
automake \
25+
python3
26+
curl -L -o /tmp/go-linux-amd64.tar.gz https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz
2727
tar -C /usr/local -xf /tmp/go-linux-amd64.tar.gz
2828
EOF
2929

3030
RUN <<-EOF
31-
git clone --branch "$ALGORAND_VERSION" https://github.com/algorand/go-algorand.git && \
32-
cd go-algorand && \
33-
./scripts/configure_dev.sh && \
34-
./scripts/buildtools/install_buildtools.sh && \
35-
make build && \
36-
find /opt/algorand/go/bin -type f -executable -exec strip -s {} + 2>/dev/null || true && \
37-
./scripts/local_install.sh -c stable -p ${GOPATH}/bin -d /opt/algorand/algorand-defaults -f -s && \
38-
rm /opt/algorand/algorand-defaults/genesis.json && \
39-
cp installer/genesis/mainnet/genesis.json /opt/algorand/algorand-defaults/genesis-mainnet.json && \
40-
cp installer/genesis/betanet/genesis.json /opt/algorand/algorand-defaults/genesis-betanet.json && \
41-
cp installer/genesis/devnet/genesis.json /opt/algorand/algorand-defaults/genesis-devnet.json && \
31+
set -e
32+
git clone --branch "$ALGORAND_VERSION" https://github.com/algorand/go-algorand.git
33+
cd go-algorand
34+
./scripts/configure_dev.sh
35+
./scripts/buildtools/install_buildtools.sh
36+
make build
37+
find /opt/algorand/go/bin -type f -executable -exec strip -s {} + 2>/dev/null || true
38+
./scripts/local_install.sh -c stable -p ${GOPATH}/bin -d /opt/algorand/algorand-defaults -f -s
39+
rm /opt/algorand/algorand-defaults/genesis.json
40+
cp installer/genesis/mainnet/genesis.json /opt/algorand/algorand-defaults/genesis-mainnet.json
41+
cp installer/genesis/betanet/genesis.json /opt/algorand/algorand-defaults/genesis-betanet.json
42+
cp installer/genesis/devnet/genesis.json /opt/algorand/algorand-defaults/genesis-devnet.json
4243
cp installer/genesis/testnet/genesis.json /opt/algorand/algorand-defaults/genesis-testnet.json
4344
EOF
4445

45-
RUN mkdir -p /opt/algorand/.algorand && \
46-
touch /opt/algorand/.algorand/algod.token && \
47-
touch /opt/algorand/.algorand/algod.admin.token && \
48-
chown -R 65532:65532 /opt/algorand/
46+
RUN <<-EOF
47+
set -e
48+
mkdir -p /opt/algorand/.algorand
49+
touch /opt/algorand/.algorand/algod.token
50+
touch /opt/algorand/.algorand/algod.admin.token
51+
EOF
4952

5053
COPY scripts/entrypoint.go /tmp/entrypoint.go
51-
RUN go build -o /tmp/entrypoint /tmp/entrypoint.go && \
52-
chown 65532:65532 /tmp/entrypoint
54+
RUN go build -o /tmp/entrypoint /tmp/entrypoint.go
5355

54-
FROM gcr.io/distroless/static-debian12:nonroot as final
56+
FROM gcr.io/distroless/static-debian12:nonroot@sha256:cdf4daaf154e3e27cfffc799c16f343a384228f38646928a1513d925f473cb46 as final
5557

5658
ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
5759

5860
ENV GOPATH=/opt/algorand/go
5961
ENV ALGORAND_DATA=/opt/algorand/.algorand
6062

6163
# Binaries for core functionality
62-
COPY --from=build \
64+
COPY --from=build --chown=65532:65532 \
6365
/opt/algorand/go/bin/algod \
6466
/opt/algorand/go/bin/goal \
6567
/opt/algorand/go/bin/kmd \
6668
/opt/algorand/go/bin/
67-
COPY --from=build /opt/algorand/algorand-defaults/ /opt/algorand/algorand-defaults/
69+
COPY --from=build --chown=65532:65532 /opt/algorand/algorand-defaults/ /opt/algorand/algorand-defaults/
6870
COPY --from=build --chown=65532:65532 /opt/algorand/.algorand/ /opt/algorand/.algorand/
6971

70-
COPY --from=build /tmp/entrypoint /opt/algorand/scripts/entrypoint
71-
COPY default-config/ /opt/algorand/default-config/
72+
COPY --from=build --chown=65532:65532 /tmp/entrypoint /opt/algorand/scripts/entrypoint
73+
COPY --chown=65532:65532 default-config/ /opt/algorand/default-config/
7274

7375
ENTRYPOINT ["/opt/algorand/scripts/entrypoint"]
7476
CMD ["/opt/algorand/go/bin/algod"]

‎images/ethereumd/geth/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ ARG VERSION=""
44
ARG BUILDNUM=""
55

66
# Build Geth in a stock Go builder container
7-
FROM golang:1.19-alpine as builder
7+
FROM golang:1.19-alpine@sha256:0ec0646e208ea58e5d29e558e39f2e59fccf39b7bda306cb53bbaff91919eca5 as builder
88

99
RUN apk add --no-cache gcc musl-dev linux-headers git
1010

@@ -17,7 +17,7 @@ ADD . /go-ethereum
1717
RUN cd /go-ethereum && go run build/ci.go install -static ./cmd/geth
1818

1919
# Pull Geth into a second stage deploy alpine container
20-
FROM alpine:latest
20+
FROM alpine:3@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
2121

2222
RUN apk add --no-cache ca-certificates
2323
COPY --from=builder /go-ethereum/build/bin/geth /usr/local/bin/

‎images/k8s_hc_sidecar/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1.3-labs
2-
FROM alpine:3
2+
FROM alpine:3@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
33

44
RUN apk add --no-cache bash netcat-openbsd jq curl ts expect
55

‎images/polygond/bor/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:latest
1+
FROM golang:1.24.6@sha256:2c89c41fb9efc3807029b59af69645867cfe978d2b877d475be0d72f6c6ce6f6
22

33
ARG BOR_DIR=/bor
44
ENV BOR_DIR=$BOR_DIR

‎images/polygond/heimdall/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM alpine:3.14
1+
FROM alpine:3.14@sha256:0f2d5c38dd7a4f4f733e688e3a6733cb5ab1ac6e3cb4603a5dd564e5bfb80eed
22

33
ARG HEIMDALL_DIR=/heimdall
44
ENV HEIMDALL_DIR=$HEIMDALL_DIR

0 commit comments

Comments
 (0)