From 16738c2301f822b792fadba68d2029e8c985c46d Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Mon, 9 Nov 2026 09:33:29 +0800 Subject: [PATCH] build(docker): ship mcli's legal files and keep base digests current Copy LICENSE, NOTICE and CREDITS from the same verified mcli archive as the bundled binary into /licenses/mcli; the server's CREDITS covers only the server's own dependencies. Correct the mcli archive pins to the RELEASE.2026-10-26T00-00-00Z checksums. The release workflow overrides them from the attested checksum file, but a plain local build failed with "Published checksum drift". Add a Dependabot docker update so the digest-pinned bases in Dockerfile.goreleaser and Dockerfile.distroless keep receiving fixes. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Feng Ruohang --- .github/dependabot.yml | 12 ++++++++++++ Dockerfile.goreleaser | 10 +++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..7dce9691e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 + +updates: + # Dockerfile.goreleaser and Dockerfile.distroless pin their bases by digest + # so a release tag rebuilds from the same bytes. Without this the pins would + # silently rot and stop receiving base-image CVE fixes. + - package-ecosystem: docker + directory: / + schedule: + interval: weekly + commit-message: + prefix: build diff --git a/Dockerfile.goreleaser b/Dockerfile.goreleaser index 5a2fbc284..47fc763f3 100644 --- a/Dockerfile.goreleaser +++ b/Dockerfile.goreleaser @@ -18,8 +18,8 @@ ENV CGO_ENABLED=0 ARG MC_REPO=pgsty/mc ARG MC_VERSION=RELEASE.2026-10-26T00-00-00Z -ARG MC_AMD64_SHA256=54bd131039dad6677f083a75207b28f82818c067c8e65fae1973f51510d268e1 -ARG MC_ARM64_SHA256=9bb294f1912f8c6b9ac08c9a0b8d2964b86306a7c440b987ee5f0570d18de3c5 +ARG MC_AMD64_SHA256=e86295bb11ed59369c0560f030d59abd42fb64a376b1d7e9799ec2e8596ebf64 +ARG MC_ARM64_SHA256=47b1a558f766f26bef5beeedd5300e082bcdec07a5e7d4a16f5f9d168f5275d1 RUN apk add -U --no-cache \ ca-certificates \ @@ -65,7 +65,9 @@ RUN apk add -U --no-cache \ echo "No mc or mcli binary found in archive:"; ls -la /tmp/mcli-extract/; exit 1; \ fi && \ chmod +x /go/bin/mcli && \ - ln -sf mcli /go/bin/mc + ln -sf mcli /go/bin/mc && \ + mkdir -p /go/share/mcli && \ + cp /tmp/mcli-extract/LICENSE /tmp/mcli-extract/NOTICE /tmp/mcli-extract/CREDITS /go/share/mcli/ FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:16e9e43d99e181463513cc84a514859b1abb9460f1c4d9e208da4b4e51cd5cc3 AS certs # Native root blocklist mitigation: https://access.redhat.com/security/vulnerabilities/RHSB-2026-012 @@ -107,6 +109,8 @@ ENV MINIO_ACCESS_KEY_FILE=access_key \ COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY silo /usr/bin/silo COPY --from=build /go/bin/mcli /usr/bin/mcli +# mcli's own legal files, from the same verified archive as the binary. +COPY --from=build /go/share/mcli /licenses/mcli COPY --from=curl-build /go/bin/curl /usr/bin/curl COPY --from=curl-build /go/share/curl /licenses/curl COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh