Skip to content

[sec-check] fix: checksum-verify zig download; digest-pin lib-c-docs base images #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hanthor-hive-agent merged 1 commit into from
Sep 5, 2026
Merged

[sec-check] fix: checksum-verify zig download; digest-pin lib-c-docs base images #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions src/build/docker/debian/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,20 @@ COPY ./build.zig ./build.zig.zon /src/

# Install zig
# https://ziglang.org/download/

RUN export ZIG_VERSION=$(sed -n -E 's/^\s*\.?minimum_zig_version\s*=\s*"([^"]+)".*/\1/p' build.zig.zon) && curl -L -o /tmp/zig.tar.xz "https://ziglang.org/download/$ZIG_VERSION/zig-$(uname -m)-linux-$ZIG_VERSION.tar.xz" && \
#
# Checksum-verified: the tarball is checked against the shasum published in
# ziglang.org/download/index.json for this exact version + architecture
# before extraction. A tampered mirror/CDN or compromised release then fails
# the build instead of shipping attacker code into the produced images.
# (blueshell#41 — mirrors the org's checksum-verified rclone pattern.)
RUN export ZIG_VERSION=$(sed -n -E 's/^\s*\.?minimum_zig_version\s*=\s*"([^"]+)".*/\1/p' build.zig.zon) && \
case "$(uname -m)" in \
x86_64) ZIG_SHA="02aa270f183da276e5b5920b1dac44a63f1a49e55050ebde3aecc9eb82f93239" ;; \
aarch64|arm64) ZIG_SHA="958ed7d1e00d0ea76590d27666efbf7a932281b3d7ba0c6b01b0ff26498f667f" ;; \
*) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
esac && \
curl -fsSL -o /tmp/zig.tar.xz "https://ziglang.org/download/$ZIG_VERSION/zig-$(uname -m)-linux-$ZIG_VERSION.tar.xz" && \
echo "$ZIG_SHA /tmp/zig.tar.xz" | sha256sum -c - && \
tar -xf /tmp/zig.tar.xz -C /opt && \
rm /tmp/zig.tar.xz && \
ln -s "/opt/zig-$(uname -m)-linux-$ZIG_VERSION/zig" /usr/local/bin/zig
Expand Down
7 changes: 5 additions & 2 deletions src/build/docker/lib-c-docs/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
#--------------------------------------------------------------------
# Generate documentation with Doxygen
#--------------------------------------------------------------------
FROM --platform=linux/amd64 archlinux:latest AS builder
# Base images are digest-pinned (blueshell#28): archlinux is a rolling
# release and nginx:alpine floats — mutable refs make the same commit build
# different images and let a bad :latest push silently change what ships.
FROM --platform=linux/amd64 archlinux@sha256:bf88f8143c3ef21b14d0ebb8140099f0bf75ecfc3699f357ff92317a73f5aba9 AS builder

# Build argument for noindex header
ARG ADD_NOINDEX_HEADER=false
Expand All @@ -23,7 +26,7 @@ RUN doxygen
#--------------------------------------------------------------------
# Host the static HTML
#--------------------------------------------------------------------
FROM nginx:alpine AS runtime
FROM nginx@sha256:1f25fedd50aec27413031afb3a4f8ee4effcc9d843f6a76e81bfa92245ac5c06 AS runtime

# Pass build arg to runtime stage
ARG ADD_NOINDEX_HEADER=false
Expand Down
Loading