Repository navigation
fix(container): drop ldconfig's aux-cache so the image builds reproducibly - #492
Conversation
…cibly
Container Build Verification fails on main: two --no-cache --timestamp 0
builds of one commit differ in one layer. The per-path fingerprints the
build jobs print show the only changed path is
/var/cache/ldconfig/aux-cache. Wolfi's apk commit hook runs ldconfig
after `apk add` in the runtime stage, and the aux-cache records the
build host's inode numbers and timestamps. Remove it in the same RUN;
ld.so.cache is deterministic and stays.
The drift report never named that path in CI: newer gh releases refuse
to print job logs that contain ANSI escape codes ("the response contains
terminal escape sequences"), so both fingerprint reads failed. Older gh
releases lack the override flag, so fetch the logs with curl instead;
only 64-hex digest lines pass the existing grep.
Checked against run 42868217511's two build logs: the curl pipeline
extracts 4320 fingerprint lines from each, and fs-fingerprint-drift.sh
reports exactly var/cache/ldconfig/aux-cache. test-fs-fingerprint.sh
passes. The image build itself is checked by this PR's CI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 25 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
The check reports 3 findings, in Generated by Claude Code |
|
…0.2.0 (#495) ## Summary `governance / Actions lockfile verify` fails on main (d98b0e2). Every open PR fails it too, including #490 and #492. The governance gate installs `gh-actions-lock` v0.2.0. That version reports unused lockfile entries as errors (upstream github/gh-actions-lock#159). echidna's lockfile has 8 such entries: - job-level reusable-workflow calls in `governance`, `hypatia-scan`, `mirror`, `scorecard`, `secret-scanner`, `security-scan`, `spark-theatre-gate` and the SLSA publish workflow (standards, proven-cicd, panic-attack, slsa-github-generator); - the deleted `boj-build.yml`. The lockfile does not track reusable workflows. Each one stays SHA-pinned inline in its workflow file, which `workflow-linter` checks. ## Changes - `.github/workflows/actions.lock` only. I regenerated it with `gh-actions-lock` v0.2.0, built from `github/gh-actions-lock` at tag `v0.2.0`, with `--no-onboard --no-narrow`. - No workflow file and no step pin changes. A plain `gh actions-lock` run would also have rewritten 2 bare-SHA pins to refs, one of them to `@main`. I did not apply those rewrites. ## RSR Quality Checklist ### Required - [x] No secrets, credentials, or `.env` files included ## Testing - Before the change: `gh-actions-lock --verify-local` gives "8 of 34 workflows failed: 8 stale", the same entries as the CI failure. - After the change: "All 34 workflows have complete lockfile coverage." - The run printed "could not verify" warnings for some pins, because the tool's GraphQL calls are blocked in this session. Those pins are unchanged, and the runner re-checks them at job start. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
Summary
Container Build Verificationfails on main with "The Containerfile is not reproducible". Two--no-cache --timestamp 0builds of the same commit differ in exactly one layer.I read the per-path fingerprints from the two build jobs of run 42868217511. Only one path differs:
/var/cache/ldconfig/aux-cache. Wolfi's apk commit hook (etc/apk/commit_hooks.d/ldconfig-commit.sh) runsldconfigafterapk addin the runtime stage, and the aux-cache records the build host's inode numbers and timestamps.The CI drift report never named that path itself. Newer
ghreleases refuse to print job logs that contain ANSI escape codes ("the response contains terminal escape sequences"), so both fingerprint reads failed, and the step fell back to "only the layer comparison is available".Changes
Containerfile: in the runtime stage, theapk addstep now ends with&& rm -f /var/cache/ldconfig/aux-cache.ld.so.cacheis deterministic and stays..github/workflows/container-ci.yml: the drift step fetches job logs withcurlinstead ofgh api. Olderghreleases (2.89, for example) reject the--allow-escape-sequencesoverride, socurlworks with every version.-Lfollows the signed redirect and does not send the token to the other host. The existing grep still keeps only 64-hex digest lines.RSR Quality Checklist
Required
bash scripts/ci/test-fs-fingerprint.shpasses.envfiles includedTesting
curlpipeline on the 2 build logs of run 42868217511. It extracts 4320 fingerprint lines from each log, andfs-fingerprint-drift.shthen reports exactlyvar/cache/ldconfig/aux-cache.Generated by Claude Code