RHAIENG-3052: Update RStudio IDE version and R packages#3307
RHAIENG-3052: Update RStudio IDE version and R packages#3307ayush17 wants to merge 2 commits intoopendatahub-io:mainfrom
Conversation
- Update RStudio Server from 2025.09.0-387 to 2026.01.1-403 - Update R packages in install_packages.R: - Rcpp: 1.0.14 → 1.1.1 - vetiver: 0.2.5 → 0.2.7 - devtools: 2.4.5 → 2.5.0 Made-with: Cursor
|
@ayush17 — This PR is from a fork. Recommended: Push your branch to the main repo for full CI: Then open a new PR from that branch. No push access? A maintainer will cherry-pick and test your changes. See CONTRIBUTING.md for details. |
github-actions
Bot
added
the
review-requested
📝 WalkthroughWalkthroughUpdated RStudio Server RPM pin from Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Security & Actionability
Required next steps before merge:
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3307 +/- ##
=====================================
Coverage 3.34% 3.34%
=====================================
Files 31 31
Lines 3562 3562
Branches 572 572
=====================================
Hits 119 119
Misses 3441 3441
Partials 2 2
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
rstudio/rhel9-python-3.12/Dockerfile.konflux.cuda (1)
128-134:⚠️ Potential issue | 🟠 MajorCWE-494: Downloaded RStudio RPM lacks integrity verification.
The RPM is fetched via
wgetwithout checksum validation. Whilednfcan verify GPG signatures, there is no explicit GPG key configuration or checksum verification in the build.Add SHA256 verification before installation:
Proposed fix
ARG RSTUDIO_RPM=rstudio-server-rhel-2026.01.1-403-x86_64.rpm +ARG RSTUDIO_RPM_SHA256=<obtain-from-rstudio-release-page> RUN /bin/bash <<'EOF' set -Eeuxo pipefail wget --progress=dot:giga https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM} +echo "${RSTUDIO_RPM_SHA256} ${RSTUDIO_RPM}" | sha256sum -c - dnf install -y ${RSTUDIO_RPM}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rstudio/rhel9-python-3.12/Dockerfile.konflux.cuda` around lines 128 - 134, The Dockerfile currently downloads RSTUDIO_RPM with wget and installs it without explicit integrity checks; add explicit integrity verification by introducing a build ARG (e.g., RSTUDIO_SHA256) for the trusted SHA256, download the RPM as you already do (RSTUDIO_RPM), then verify the downloaded file against RSTUDIO_SHA256 using sha256sum -c (or compute sha256sum and compare) and exit non-zero on mismatch; additionally import the RStudio/GPG signing public key before calling dnf install (so dnf/rpm can verify package signatures) and ensure the RUN block that performs these steps (the heredoc /bin/bash block that uses RSTUDIO_RPM) fails the build if either the checksum or the GPG signature verification fails.
🧹 Nitpick comments (1)
rstudio/rhel9-python-3.12/install_packages.R (1)
16-20: Identical to c9s-python-3.12/install_packages.R.Consider consolidating into a single shared script to avoid drift.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rstudio/rhel9-python-3.12/install_packages.R` around lines 16 - 20, This file duplicates package installation logic (multiple remotes::install_version calls for Rcpp, tidyverse, tidymodels, vetiver, devtools) that is identical to another script; create a single shared installation script (e.g., define a packages vector of names and versions and a small loop calling remotes::install_version(pkg, version, lib = lib, dependencies = TRUE, upgrade = "never")) and replace the duplicated blocks in both rstudio/rhel9-python-3.12/install_packages.R and c9s-python-3.12/install_packages.R with a single source("shared-install_packages.R") call so both use the same source of truth.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@rstudio/rhel9-python-3.12/Dockerfile.konflux.cuda`:
- Around line 128-134: The Dockerfile currently downloads RSTUDIO_RPM with wget
and installs it without explicit integrity checks; add explicit integrity
verification by introducing a build ARG (e.g., RSTUDIO_SHA256) for the trusted
SHA256, download the RPM as you already do (RSTUDIO_RPM), then verify the
downloaded file against RSTUDIO_SHA256 using sha256sum -c (or compute sha256sum
and compare) and exit non-zero on mismatch; additionally import the RStudio/GPG
signing public key before calling dnf install (so dnf/rpm can verify package
signatures) and ensure the RUN block that performs these steps (the heredoc
/bin/bash block that uses RSTUDIO_RPM) fails the build if either the checksum or
the GPG signature verification fails.
---
Nitpick comments:
In `@rstudio/rhel9-python-3.12/install_packages.R`:
- Around line 16-20: This file duplicates package installation logic (multiple
remotes::install_version calls for Rcpp, tidyverse, tidymodels, vetiver,
devtools) that is identical to another script; create a single shared
installation script (e.g., define a packages vector of names and versions and a
small loop calling remotes::install_version(pkg, version, lib = lib,
dependencies = TRUE, upgrade = "never")) and replace the duplicated blocks in
both rstudio/rhel9-python-3.12/install_packages.R and
c9s-python-3.12/install_packages.R with a single
source("shared-install_packages.R") call so both use the same source of truth.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: a1d66265-4919-4468-9890-bfcc38949ae0
📒 Files selected for processing (8)
rstudio/c9s-python-3.12/Dockerfile.cpurstudio/c9s-python-3.12/Dockerfile.cudarstudio/c9s-python-3.12/install_packages.Rrstudio/rhel9-python-3.12/Dockerfile.cpurstudio/rhel9-python-3.12/Dockerfile.cudarstudio/rhel9-python-3.12/Dockerfile.konflux.cpurstudio/rhel9-python-3.12/Dockerfile.konflux.cudarstudio/rhel9-python-3.12/install_packages.R
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jiridanek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@ayush17 please allowlist that, so it does not keep failing, thanks, cc @coderabbitai |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainLet me find the allowlist configuration for the binary checker. 🏁 Script executed: Repository: opendatahub-io/notebooks 🏁 Script executed: Repository: opendatahub-io/notebooks 🏁 Script executed: Repository: opendatahub-io/notebooks 🏁 Script executed: Repository: opendatahub-io/notebooks 🏁 Script executed: Repository: opendatahub-io/notebooks 🏁 Script executed: Repository: opendatahub-io/notebooks 🏁 Script executed: Repository: opendatahub-io/notebooks
Root cause: The
These are caught by the Konflux The Recommended fix for # Install RStudio
ARG RSTUDIO_RPM=rstudio-server-rhel-2026.01.1-403-x86_64.rpm
RUN /bin/bash <<'EOF'
set -Eeuxo pipefail
wget --progress=dot:giga https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM}
dnf install -y ${RSTUDIO_RPM}
rm ${RSTUDIO_RPM}
dnf -y clean all --enablerepo='*'
# Remove statically-linked Copilot language server binaries (disabled by default,
# flagged by check-payload as not dynamically linked)
rm -rf /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/arm64/rg \
/usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/x64/rg
...
EOFThis needs to be applied to all four Dockerfiles:
|
Remove the statically-linked ripgrep (rg) binaries from the RStudio Copilot language server directory. These binaries are flagged by Konflux check-payload as "not dynamically linked". Since GitHub Copilot is disabled by default in RStudio Server, these binaries are not needed. Addresses: check-payload failure for executable not dynamically linked Made-with: Cursor
|
New changes are detected. LGTM label has been removed. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@rstudio/rhel9-python-3.12/Dockerfile.cpu`:
- Around line 131-135: The Dockerfile currently downloads ${RSTUDIO_RPM} and
installs it directly; update the RUN block that handles RSTUDIO_RPM to verify
integrity before installing by fetching a trusted checksum or signature
alongside the RPM, validating it (e.g., compare a pinned SHA256 checksum or
verify a GPG signature with rpm --checksig or gpg and rpm --import of a trusted
key), and only proceeding to dnf install ${RSTUDIO_RPM} if verification succeeds
otherwise exit non‑zero; ensure the verification step uses a pinned checksum
value or trusted key material embedded or ARG/BUILDARG-provided and remove the
RPM on failure.
- Around line 136-138: The removal step uses a silent `rm -f` on the
copilot-language-server-js `rg` binaries which masks missing or moved paths;
change the step that references
"/usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/arm64/rg" and
the x64 `rg` to first discover any matching files (for example with `find`/glob)
and assert that none remain, and if any are found fail the build (exit non‑zero)
so the pipeline fails fast; update the block that mentions
`copilot-language-server-js` and `rg` to perform discovery and an explicit
assertion rather than using `rm -f`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: b2782b3a-d1cf-497f-a4d7-fc6d89ee32d4
📒 Files selected for processing (6)
rstudio/c9s-python-3.12/Dockerfile.cpurstudio/c9s-python-3.12/Dockerfile.cudarstudio/rhel9-python-3.12/Dockerfile.cpurstudio/rhel9-python-3.12/Dockerfile.cudarstudio/rhel9-python-3.12/Dockerfile.konflux.cpurstudio/rhel9-python-3.12/Dockerfile.konflux.cuda
🚧 Files skipped from review as they are similar to previous changes (5)
- rstudio/rhel9-python-3.12/Dockerfile.konflux.cuda
- rstudio/rhel9-python-3.12/Dockerfile.cuda
- rstudio/rhel9-python-3.12/Dockerfile.konflux.cpu
- rstudio/c9s-python-3.12/Dockerfile.cuda
- rstudio/c9s-python-3.12/Dockerfile.cpu
| ARG RSTUDIO_RPM=rstudio-server-rhel-2026.01.1-403-x86_64.rpm | ||
| RUN set -Eeuxo pipefail && \ | ||
| wget --progress=dot:giga https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM} && \ | ||
| dnf install -y ${RSTUDIO_RPM} && \ | ||
| rm ${RSTUDIO_RPM} && \ |
There was a problem hiding this comment.
Enforce RPM integrity verification before install (CWE-494).
Severity: High.
Exploit scenario: Line 133 downloads an RPM over the network, and Line 134 installs it as root. If the mirror/CDN path is compromised, a tampered package gets root execution during build.
Remediation: pin and verify a trusted checksum (or signature) before dnf install.
Suggested fix
ARG RSTUDIO_RPM=rstudio-server-rhel-2026.01.1-403-x86_64.rpm
+ARG RSTUDIO_RPM_SHA256=<vendor-published-sha256>
RUN set -Eeuxo pipefail && \
- wget --progress=dot:giga https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM} && \
+ curl -fsSLo ${RSTUDIO_RPM} --retry 3 https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM} && \
+ echo "${RSTUDIO_RPM_SHA256} ${RSTUDIO_RPM}" | sha256sum -c - && \
dnf install -y ${RSTUDIO_RPM} && \
rm ${RSTUDIO_RPM} && \As per coding guidelines, **: REVIEW PRIORITIES: 1. Security vulnerabilities (provide severity, exploit scenario, and remediation code).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ARG RSTUDIO_RPM=rstudio-server-rhel-2026.01.1-403-x86_64.rpm | |
| RUN set -Eeuxo pipefail && \ | |
| wget --progress=dot:giga https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM} && \ | |
| dnf install -y ${RSTUDIO_RPM} && \ | |
| rm ${RSTUDIO_RPM} && \ | |
| ARG RSTUDIO_RPM=rstudio-server-rhel-2026.01.1-403-x86_64.rpm | |
| ARG RSTUDIO_RPM_SHA256=<vendor-published-sha256> | |
| RUN set -Eeuxo pipefail && \ | |
| curl -fsSLo ${RSTUDIO_RPM} --retry 3 https://download2.rstudio.org/server/rhel9/x86_64/${RSTUDIO_RPM} && \ | |
| echo "${RSTUDIO_RPM_SHA256} ${RSTUDIO_RPM}" | sha256sum -c - && \ | |
| dnf install -y ${RSTUDIO_RPM} && \ | |
| rm ${RSTUDIO_RPM} && \ |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@rstudio/rhel9-python-3.12/Dockerfile.cpu` around lines 131 - 135, The
Dockerfile currently downloads ${RSTUDIO_RPM} and installs it directly; update
the RUN block that handles RSTUDIO_RPM to verify integrity before installing by
fetching a trusted checksum or signature alongside the RPM, validating it (e.g.,
compare a pinned SHA256 checksum or verify a GPG signature with rpm --checksig
or gpg and rpm --import of a trusted key), and only proceeding to dnf install
${RSTUDIO_RPM} if verification succeeds otherwise exit non‑zero; ensure the
verification step uses a pinned checksum value or trusted key material embedded
or ARG/BUILDARG-provided and remove the RPM on failure.
| # Remove statically-linked Copilot language server binaries (disabled by default, flagged by check-payload) \ | ||
| rm -f /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/arm64/rg \ | ||
| /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/x64/rg && \ |
There was a problem hiding this comment.
Make static-binary cleanup fail fast instead of silently ignoring drift.
Line 137-138 uses rm -f, which succeeds even if paths change. That hides breakage until a later pipeline scan. Replace with discovery + assertion so this step fails immediately when rg binaries remain.
Suggested fix
- rm -f /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/arm64/rg \
- /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/x64/rg && \
+ find /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux -type f -name rg -delete && \
+ test -z "$(find /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux -type f -name rg -print -quit)" && \As per coding guidelines, **: REVIEW PRIORITIES: 3. Bug-prone patterns and error handling gaps.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Remove statically-linked Copilot language server binaries (disabled by default, flagged by check-payload) \ | |
| rm -f /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/arm64/rg \ | |
| /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/x64/rg && \ | |
| # Remove statically-linked Copilot language server binaries (disabled by default, flagged by check-payload) \ | |
| find /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux -type f -name rg -delete && \ | |
| test -z "$(find /usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux -type f -name rg -print -quit)" && \ |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@rstudio/rhel9-python-3.12/Dockerfile.cpu` around lines 136 - 138, The removal
step uses a silent `rm -f` on the copilot-language-server-js `rg` binaries which
masks missing or moved paths; change the step that references
"/usr/lib/rstudio-server/bin/copilot-language-server-js/bin/linux/arm64/rg" and
the x64 `rg` to first discover any matching files (for example with `find`/glob)
and assert that none remain, and if any are found fail the build (exit non‑zero)
so the pipeline fails fast; update the block that mentions
`copilot-language-server-js` and `rg` to perform discovery and an explicit
assertion rather than using `rm -f`.
|
It failed to build RStudio on both Konflux and GitHub. As we’ve discussed, we’ve lowered the priority of RStudio work. Therefore, I suggest not merging unless you can successfully build it. @atheo89 |
4 participants
Summary
Files Updated
rstudio/c9s-python-3.12/Dockerfile.cpurstudio/c9s-python-3.12/Dockerfile.cudarstudio/c9s-python-3.12/install_packages.Rrstudio/rhel9-python-3.12/Dockerfile.cpurstudio/rhel9-python-3.12/Dockerfile.cudarstudio/rhel9-python-3.12/Dockerfile.konflux.cpurstudio/rhel9-python-3.12/Dockerfile.konflux.cudarstudio/rhel9-python-3.12/install_packages.RJira Ticket
https://issues.redhat.com/browse/RHAIENG-3052
Test plan
Made with Cursor
Summary by CodeRabbit