From 5618de65625bf16c800f3fc79e25239427926c0a Mon Sep 17 00:00:00 2001 From: iahsanGill Date: Tue, 10 Nov 2026 02:36:14 +0500 Subject: [PATCH 1/2] build: verify SOCI and Nydus artifacts SOCI and Nydus test artifacts were downloaded and extracted without integrity verification, unlike the other binary dependencies in the integration image. Add pinned SHA-256 sums for both supported architectures and verify each archive before extraction. Point the canary updater at the current Nydus release repository so future version bumps generate matching checksum files. Signed-off-by: iahsanGill --- Dockerfile | 19 ++++++++++++------- Dockerfile.d/SHA256SUMS.d/nydus-v2.4.5 | 2 ++ .../SHA256SUMS.d/soci-snapshotter-v0.16.1 | 2 ++ hack/build-integration-canary.sh | 3 ++- 4 files changed, 18 insertions(+), 8 deletions(-) create mode 100644 Dockerfile.d/SHA256SUMS.d/nydus-v2.4.5 create mode 100644 Dockerfile.d/SHA256SUMS.d/soci-snapshotter-v0.16.1 diff --git a/Dockerfile b/Dockerfile index bf3458206de..c21de7f2813 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,12 +42,12 @@ ARG BUILDG_VERSION=v0.5.3@BINARY ARG GOMODJAIL_VERSION=v2.0.1@5924a4079d0f70459a10973f715238dc336478ea # Test deps -# Currently, the Docker Official Images and the test deps are not pinned by the hash +# Some test deps and the Docker Official Images are not pinned by hash ARG GO_VERSION=1.26 ARG UBUNTU_VERSION=26.04 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2 -ARG NYDUS_VERSION=v2.4.5 -ARG SOCI_SNAPSHOTTER_VERSION=0.16.1 +ARG NYDUS_VERSION=v2.4.5@BINARY +ARG SOCI_SNAPSHOTTER_VERSION=0.16.1@BINARY ARG KUBO_VERSION=v0.43.1 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.10.0@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx @@ -277,18 +277,23 @@ COPY --from=ghcr.io/sigstore/cosign/cosign:v3.0.5@sha256:be924970ba7438c22e18067 # (the static build, so that it also runs on EL hosts, whose glibc is older than what # the default build requires) ARG SOCI_SNAPSHOTTER_VERSION -RUN fname="soci-snapshotter-${SOCI_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}-static.tar.gz" && \ +RUN SOCI_SNAPSHOTTER_VERSION=${SOCI_SNAPSHOTTER_VERSION%%@*}; \ + fname="soci-snapshotter-${SOCI_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TARGETARCH:-amd64}-static.tar.gz" && \ curl -o "${fname}" -fsSL --retry 5 --retry-delay 5 --retry-max-time 120 --connect-timeout 20 --proto '=https' --tlsv1.2 "https://github.com/awslabs/soci-snapshotter/releases/download/v${SOCI_SNAPSHOTTER_VERSION}/${fname}" && \ + grep "${fname}" "/SHA256SUMS.d/soci-snapshotter-v${SOCI_SNAPSHOTTER_VERSION}" | sha256sum -c && \ tar -C /out/bin -xvf "${fname}" soci soci-snapshotter-grpc && \ rm -f "${fname}" # enable offline ipfs for integration test COPY --from=build-kubo /out/${TARGETARCH:-amd64}/* /out/bin/ # install nydus components ARG NYDUS_VERSION -RUN curl -o nydus-static.tgz -fsSL --retry 5 --retry-delay 5 --retry-max-time 120 --connect-timeout 20 --proto '=https' --tlsv1.2 "https://github.com/dragonflyoss/image-service/releases/download/${NYDUS_VERSION}/nydus-static-${NYDUS_VERSION}-linux-${TARGETARCH}.tgz" && \ - tar xzf nydus-static.tgz && \ +RUN NYDUS_VERSION=${NYDUS_VERSION%%@*}; \ + fname="nydus-static-${NYDUS_VERSION}-linux-${TARGETARCH}.tgz" && \ + curl -o "${fname}" -fsSL --retry 5 --retry-delay 5 --retry-max-time 120 --connect-timeout 20 --proto '=https' --tlsv1.2 "https://github.com/dragonflyoss/nydus/releases/download/${NYDUS_VERSION}/${fname}" && \ + grep "${fname}" "/SHA256SUMS.d/nydus-${NYDUS_VERSION}" | sha256sum -c && \ + tar xzf "${fname}" && \ mv nydus-static/nydus-image nydus-static/nydusd nydus-static/nydusify /out/bin/ && \ - rm -rf nydus-static.tgz nydus-static + rm -rf "${fname}" nydus-static # tests need a tini-custom binary RUN cp /out/bin/tini /out/bin/tini-custom diff --git a/Dockerfile.d/SHA256SUMS.d/nydus-v2.4.5 b/Dockerfile.d/SHA256SUMS.d/nydus-v2.4.5 new file mode 100644 index 00000000000..c191c8d234b --- /dev/null +++ b/Dockerfile.d/SHA256SUMS.d/nydus-v2.4.5 @@ -0,0 +1,2 @@ +1ad7b793a1996577e462b0bf5c1a22e4450b9c04f7e9e99d4b274ccc92f19072 nydus-static-v2.4.5-linux-amd64.tgz +85925af702d79fc3a8b9d501a5267ddc9f81449ff9fe94841845eb98eda84593 nydus-static-v2.4.5-linux-arm64.tgz diff --git a/Dockerfile.d/SHA256SUMS.d/soci-snapshotter-v0.16.1 b/Dockerfile.d/SHA256SUMS.d/soci-snapshotter-v0.16.1 new file mode 100644 index 00000000000..e02f0c8578e --- /dev/null +++ b/Dockerfile.d/SHA256SUMS.d/soci-snapshotter-v0.16.1 @@ -0,0 +1,2 @@ +2ad05a0430042885a7b2ab4a707a85250117dd39f41adc097e83a00a83ae4bc7 soci-snapshotter-0.16.1-linux-amd64-static.tar.gz +8cea5bd515c5beda5d9e9ba3ddaadcf3e2a5fcd11ea3492630cbd91da68db8a3 soci-snapshotter-0.16.1-linux-arm64-static.tar.gz diff --git a/hack/build-integration-canary.sh b/hack/build-integration-canary.sh index 052140fafb7..e0b2d409514 100755 --- a/hack/build-integration-canary.sh +++ b/hack/build-integration-canary.sh @@ -42,7 +42,7 @@ dependencies=( containerd/fuse-overlayfs-snapshotter gotestyourself/gotestsum ipfs/kubo - containerd/nydus-snapshotter + dragonflyoss/nydus containernetworking/plugins rootless-containers/rootlesskit opencontainers/runc @@ -64,6 +64,7 @@ FUSE_OVERLAYFS_CHECKSUM=linux # Avoids the full build BUILDG_CHECKSUM=buildg-v ROOTLESSKIT_CHECKSUM=linux +NYDUS_CHECKSUM=linux STARGZ_SNAPSHOTTER_CHECKSUM=linux # We specifically want the static ones TINI_CHECKSUM=static From ac4398c524e532824234945831161d8762d4fab7 Mon Sep 17 00:00:00 2001 From: iahsanGill Date: Wed, 11 Nov 2026 00:26:08 +0500 Subject: [PATCH 2/2] build: pin remaining test dependencies Signed-off-by: iahsanGill --- Dockerfile | 8 ++++---- hack/build-integration-canary.sh | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index c21de7f2813..73dc10d9051 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,13 +42,13 @@ ARG BUILDG_VERSION=v0.5.3@BINARY ARG GOMODJAIL_VERSION=v2.0.1@5924a4079d0f70459a10973f715238dc336478ea # Test deps -# Some test deps and the Docker Official Images are not pinned by hash +# Docker Official Images intentionally track their latest revisions ARG GO_VERSION=1.26 ARG UBUNTU_VERSION=26.04 -ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2 +ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2@3025bfd6df7b4c11ad69cc7bb0bc0874ecdf901a ARG NYDUS_VERSION=v2.4.5@BINARY ARG SOCI_SNAPSHOTTER_VERSION=0.16.1@BINARY -ARG KUBO_VERSION=v0.43.1 +ARG KUBO_VERSION=v0.43.1@acc53c093810a8fe9a4bc2f023f0b1e0c1d629b5 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.10.0@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx @@ -237,7 +237,7 @@ COPY --from=build-gomodjail /out/${TARGETARCH:-amd64}/* /out/bin/ RUN echo "- gomodjail: ${GOMODJAIL_VERSION}" >> /out/share/doc/nerdctl-full/README.md ARG CONTAINERIZED_SYSTEMD_VERSION RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN \ - http::helper github::file AkihiroSuda/containerized-systemd docker-entrypoint.sh "${CONTAINERIZED_SYSTEMD_VERSION}" > /docker-entrypoint.sh && \ + http::helper github::file AkihiroSuda/containerized-systemd docker-entrypoint.sh "${CONTAINERIZED_SYSTEMD_VERSION##*@}" > /docker-entrypoint.sh && \ chmod +x /docker-entrypoint.sh RUN echo "" >> /out/share/doc/nerdctl-full/README.md && \ diff --git a/hack/build-integration-canary.sh b/hack/build-integration-canary.sh index e0b2d409514..571a57e9e54 100755 --- a/hack/build-integration-canary.sh +++ b/hack/build-integration-canary.sh @@ -42,6 +42,7 @@ dependencies=( containerd/fuse-overlayfs-snapshotter gotestyourself/gotestsum ipfs/kubo + AkihiroSuda/containerized-systemd dragonflyoss/nydus containernetworking/plugins rootless-containers/rootlesskit