Cronos testnet image upgrade v1.4.7 #71
Conversation
Signed-off-by: Dmitrii Spichakov <[email protected]>
WalkthroughThe Dockerfile was updated to install Cronos version 1.4.7 instead of 1.4.5 by modifying the download URL and filename references. No other changes were made to the Dockerfile's structure or logic. Changes
Poem
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure ✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: guardrails/scan
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.7-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.7-testnet_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.7-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
Insecure disabling of certificate validation in wget command
Disabling SSL certificate verification (--no-check-certificate) opens the build to man-in-the-middle attacks. GitHub releases are served over valid HTTPS, so this flag is unnecessary.
Additionally, to make future version bumps simpler and avoid hard-coding, consider parameterizing the Cronos version with a build argument (ARG CRONOS_VERSION=1.4.7-testnet).
Apply this diff:
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.7-testnet_Linux_x86_64.tar.gz \
+ARG CRONOS_VERSION=1.4.7-testnet
+RUN cd /tmp && wget https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz \
&& tar -xvf cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz \
&& rm cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz \
&& mv ./* /home/cronos/📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.7-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.7-testnet_Linux_x86_64.tar.gz \ | |
| && rm cronos_1.4.7-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | |
| # parameterize Cronos version for easier bumps | |
| ARG CRONOS_VERSION=1.4.7-testnet | |
| RUN cd /tmp && \ | |
| wget https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \ | |
| tar -xvf cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \ | |
| rm cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \ | |
| mv ./* /home/cronos/ |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile lines 7 to 8, remove the `--no-check-certificate` flag from the
wget command to ensure SSL certificate validation is enforced, preventing
security risks. Introduce a build argument `ARG CRONOS_VERSION=1.4.7-testnet` at
the top of the Dockerfile and replace the hard-coded version in the wget URL and
filenames with this variable to simplify future version updates.
OPS-4930 Cronos v1.4.7 Upgrades across clusters
Summary by CodeRabbit