Skip to content

[ci-maintainer] fix(docker): per-attempt timeouts on bobshell download in src/Dockerfile + src/Dockerfile.contributor #4942

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
clubanderson merged 1 commit into from
Aug 28, 2026
+10 −2
Merged

[ci-maintainer] fix(docker): per-attempt timeouts on bobshell download in src/Dockerfile + src/Dockerfile.contributor #4942

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion src/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,13 +340,19 @@ ARG BOBSHELL_SHA256_ARM64=6ec51abec4251d41ec45709030988b90baa659f535fc8d14dd0030
# a silent trap that cost real debugging time. If this download breaks, the
# build must break loudly rather than ship an image that reproduces that bug.
# The `which bob` check turns a partial install into a build failure too.
# Per-attempt bounds (--connect-timeout/--speed-time/--max-time) kill stalled
# IBM COS connections so they can't consume the whole retry budget: without
# them a single hung download burned all of --retry-max-time and exited 28
# (issue #4941; CI runs 32990236986, 33072306789, 33132187354).
RUN ARCH="${TARGETARCH:-$(dpkg --print-architecture)}" && \
case "$ARCH" in \
amd64) BOBSHELL_SHA256="$BOBSHELL_SHA256_AMD64" ;; \
arm64) BOBSHELL_SHA256="$BOBSHELL_SHA256_ARM64" ;; \
*) echo "unsupported arch for bobshell: $ARCH" >&2; exit 1 ;; \
esac && \
curl -fsSL --retry 8 --retry-delay 5 --retry-max-time 300 --retry-connrefused --retry-all-errors -o /tmp/bobshell.tgz "${BOBSHELL_BASE_URL}/bobshell-${BOBSHELL_VERSION}.tgz" && \
curl -fsSL --retry 8 --retry-delay 5 --retry-max-time 600 --retry-connrefused --retry-all-errors \
--connect-timeout 15 --speed-limit 1024 --speed-time 30 --max-time 180 \
-o /tmp/bobshell.tgz "${BOBSHELL_BASE_URL}/bobshell-${BOBSHELL_VERSION}.tgz" && \
echo "${BOBSHELL_SHA256} /tmp/bobshell.tgz" | sha256sum -c - && \
npm install -g /tmp/bobshell.tgz && \
npm cache clean --force && \
Expand Down
4 changes: 3 additions & 1 deletion src/Dockerfile.contributor
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
# NODESOURCE_KEY_SHA256 is the digest of the raw ASCII-armored key as
# published at the URL below; re-verify against NodeSource's documented
# fingerprint (6F71F5252828 41EEDAF851B4 2F59B5F99B1B E0B4) before bumping.
ARG NODESOURCE_KEY_SHA256=b42e0321dabdc24e892115da705cf061167eac12a317f23d329862d0aa0a271d

Check warning on line 37 in src/Dockerfile.contributor

View workflow job for this annotation

GitHub Actions / build-contributor (linux/amd64, ubuntu-latest)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "NODESOURCE_KEY_SHA256")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 37 in src/Dockerfile.contributor

View workflow job for this annotation

GitHub Actions / build-contributor (linux/arm64, ubuntu-24.04-arm)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "NODESOURCE_KEY_SHA256")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
RUN mkdir -p /etc/apt/keyrings \
&& curl -fsSL -o /tmp/nodesource.key https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
&& echo "${NODESOURCE_KEY_SHA256} /tmp/nodesource.key" | sha256sum -c - \
Expand Down Expand Up @@ -88,7 +88,9 @@
arm64) BOBSHELL_SHA256="$BOBSHELL_SHA256_ARM64" ;; \
*) echo "unsupported arch for bobshell: $ARCH" >&2; exit 1 ;; \
esac \
&& curl -fsSL -o /tmp/bobshell.tgz "${BOBSHELL_BASE_URL}/bobshell-${BOBSHELL_VERSION}.tgz" \
&& curl -fsSL --retry 8 --retry-delay 5 --retry-max-time 600 --retry-connrefused --retry-all-errors \
--connect-timeout 15 --speed-limit 1024 --speed-time 30 --max-time 180 \
-o /tmp/bobshell.tgz "${BOBSHELL_BASE_URL}/bobshell-${BOBSHELL_VERSION}.tgz" \
&& echo "${BOBSHELL_SHA256} /tmp/bobshell.tgz" | sha256sum -c - \
&& npm install -g /tmp/bobshell.tgz && \
npm cache clean --force && \
Expand Down
Loading