fix(scanner): arm64 ramparts GLIBC_2.39 + trivy vuln-DB pre-cache (MCP-2150)#744
Merged
Merged
Conversation
ramparts (GLIBC_2.39): - Split CI matrix into per-arch native builds: ubuntu-latest for amd64, ubuntu-24.04-arm for arm64. Eliminates QEMU overhead that caused arm64 cargo-install to time out (MCP-2395), which left a stale arm64 manifest in GHCR linked against glibc 2.39 (trixie-era rust:1-slim). - Add merge-ramparts job: assembles the multi-arch :latest manifest from :latest-amd64 + :latest-arm64 using docker buildx imagetools create. - Dockerfile already has the bookworm pin (PR #665); no Dockerfile change needed. trivy-mcp (vuln-DB download timeout): - Add docker/scanners/trivy/Dockerfile: wraps ghcr.io/aquasecurity/trivy:latest and pre-caches the ~96 MiB vuln DB at build time via trivy image --download-db-only. TRIVY_CACHE_DIR=/trivy-cache baked in so runtime reads the same path without --cache-dir flags. - Update registry_bundled.go: DockerImage -> ghcr.io/smart-mcp-proxy/scanner-trivy, Timeout 300s -> 120s (no download needed for fs scans), update NetworkReq comment. - Add trivy to scanner-images.yml matrix (linux/amd64,linux/arm64). - Add weekly cron schedule (Monday 03:00 UTC) so the pre-cached DB stays current. Co-Authored-By: Paperclip <noreply@paperclip.ing>
Deploying mcpproxy-docs with
|
| Latest commit: |
1a84190
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7b508c74.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://fix-mcp-2150-scanner-arm64-t.mcpproxy-docs.pages.dev |
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 27934996620 --repo smart-mcp-proxy/mcpproxy-go
|
![mcpproxy-gatekeeper[bot]](https://avatars.githubusercontent.com/u/216428285?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Gatekeeper approval — MCP-2150 scanner arm64 fix. KimiReviewer verdict ACCEPT (model-diverse fallback). CI fully green incl. scanner-image builds (trivy + ramparts per-arch). Diff: trivy → pre-cached scanner-trivy image (DB baked, 300→120s timeout), per-arch native runners avoid QEMU timeout. Author (ReleaseEngineer) ≠ approver.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Two scanner images fail at runtime on arm64 (Apple Silicon macOS):
ramparts exits with
GLIBC_2.39 not foundon aarch64. The ramparts Dockerfile was already fixed (PR fix(scanner): pin ramparts builder to rust:1-slim-bookworm (MCP-2395) #665 pinned the Rust builder todebian:bookworm-slimto match the runtime glibc), but the CI only builtlinux/amd64. The old stalelinux/arm64manifest (built against the trixie-erarust:1-slimwith glibc 2.39+) remained in GHCR and was served to arm64 Docker clients.trivy-mcp exits 1 with no output: the
ghcr.io/aquasecurity/trivy:latestimage downloads its ~96 MiB vuln DB on first scan, which races the per-scanner timeout on slow connections.Fix
ramparts — native arm64 runner (MCP-2150 / MCP-2395)
Split the ramparts CI matrix into two per-arch entries:
ubuntu-latest(amd64 native) → pushes:latest-amd64ubuntu-24.04-arm(arm64 native) → pushes:latest-arm64Add a
merge-rampartsjob that usesdocker buildx imagetools createto assemble the multi-arch:latestand:<sha>manifests. This replaces the stale arm64 manifest. The Dockerfile itself is unchanged — the bookworm pin from PR #665 is correct.trivy-mcp — pre-cached vuln DB
Add
docker/scanners/trivy/Dockerfile: extendsghcr.io/aquasecurity/trivy:latestand runstrivy image --download-db-onlyat build time.TRIVY_CACHE_DIR=/trivy-cacheis baked into the image so the runtime binary reads the pre-cached DB without needing--cache-dirflags.registry_bundled.go:DockerImage→ghcr.io/smart-mcp-proxy/scanner-trivy:latest,Timeout300s → 120s (no download fortrivy fs),NetworkReqcomment updated (still true fortrivy imagescanning remote registries).linux/amd64,linux/arm64).Testing
go test ./internal/security/scanner/...— PASSgolangci-lint— 0 issuesRelated