Skip to content

fix(container): drop ldconfig's aux-cache so the image builds reproducibly #492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Nov 10, 2026
+12 −2
Merged

fix(container): drop ldconfig's aux-cache so the image builds reproducibly #492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
621545c
fix(container): drop ldconfig's aux-cache so the image builds reprodu…
claude Nov 10, 2026
b8a6f45
Merge branch 'main' into claude/container-repro-aux-cache
hyperpolymath Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion .github/workflows/container-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,13 @@ jobs:
id=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT/jobs" \
--paginate --jq ".jobs[] | select(.name == \"$1\") | .id" | head -n 1)
[ -n "$id" ] || { echo "::warning::no job named '$1' in this run attempt"; return 1; }
gh api "repos/$GITHUB_REPOSITORY/actions/jobs/$id/logs" \
# Job logs carry ANSI colour codes, which newer gh releases refuse
# to print ("terminal escape sequences"), and older ones lack the
# override flag. Fetch them with curl; only 64-hex digest lines
# survive the grep. -L follows the signed redirect without
# forwarding the token to the other host.
curl -fsSL --proto '=https' -H "Authorization: Bearer $GH_TOKEN" \
"${GITHUB_API_URL:-https://api.github.com}/repos/$GITHUB_REPOSITORY/actions/jobs/$id/logs" \
| sed -E 's/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9:.]+Z //' \
| sed -n '/^FS-FINGERPRINT-BEGIN$/,/^FS-FINGERPRINT-END$/p' \
| grep -E '^[0-9a-f]{64} '
Expand Down
6 changes: 5 additions & 1 deletion Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# =============================================================================
# Stage 1: Rust Builder
# =============================================================================
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:9c2092b053779e14c82fb50f77b37bcc38b7d2c83972352d5813280f9d035b03 AS rust-builder

Check warning on line 16 in Containerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_echidna&issues=AaHGnUmPgaDw_TOd4JHd&open=AaHGnUmPgaDw_TOd4JHd&pullRequest=492

RUN apk add --no-cache \
rust \
Expand Down Expand Up @@ -50,7 +50,7 @@
# =============================================================================
# Stage 2: Prover Installer (Z3 from official release, Lean via elan)
# =============================================================================
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:9c2092b053779e14c82fb50f77b37bcc38b7d2c83972352d5813280f9d035b03 AS prover-installer

Check warning on line 53 in Containerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_echidna&issues=AaHGnUmPgaDw_TOd4JHe&open=AaHGnUmPgaDw_TOd4JHe&pullRequest=492

RUN apk add --no-cache \
curl \
Expand Down Expand Up @@ -78,7 +78,7 @@
# =============================================================================
# Stage 3: Runtime Image (chainguard)
# =============================================================================
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:9c2092b053779e14c82fb50f77b37bcc38b7d2c83972352d5813280f9d035b03

Check warning on line 81 in Containerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_echidna&issues=AaHGnUmPgaDw_TOd4JHf&open=AaHGnUmPgaDw_TOd4JHf&pullRequest=492

LABEL maintainer="Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"
LABEL org.opencontainers.image.source="https://github.com/hyperpolymath/echidna"
Expand All @@ -87,11 +87,15 @@
LABEL org.opencontainers.image.version="1.5.0"
LABEL org.opencontainers.image.vendor="hyperpolymath"

# Wolfi's apk commit hook runs ldconfig, whose aux-cache records the build
# host's inode numbers and timestamps. Drop it so two builds of one commit
# give the same layer; ld.so.cache itself is deterministic and kept.
RUN apk add --no-cache \
ca-certificates \
libssl3 \
gmp \
libstdc++
libstdc++ \
&& rm -f /var/cache/ldconfig/aux-cache

WORKDIR /app

Expand Down
Loading