Cronos mainnet image upgrade v1.4.7 #72
Conversation
Signed-off-by: Dmitrii Spichakov <[email protected]>
WalkthroughThe Dockerfile was updated to download and extract the mainnet version of the Cronos v1.4.7 binary instead of the testnet version. The filename and URL for the binary archive were changed accordingly, while the extraction and installation steps remained the same. Changes
Possibly related PRs
Poem
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure ✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
Dockerfile (1)
7-8: Verify release integrity and parameterize the version
It’s best practice to pin the Cronos version via a build argument and verify the archive’s checksum (or GPG signature) before unpacking. This guards against upstream tampering and makes future upgrades smoother. For example:ARG CRONOS_VERSION=1.4.7 ARG CRONOS_SHA256=<sha256sum-for-v1.4.7> WORKDIR /tmp RUN set -eux; \ wget -O cronos.tar.gz \ https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz; \ echo "${CRONOS_SHA256} cronos.tar.gz" | sha256sum -c -; \ tar -xzf cronos.tar.gz; \ mv ./* /home/cronos/; \ rm cronos.tar.gz🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: guardrails/scan
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.7_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.7_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.7_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
Remove --no-check-certificate to enforce secure downloads
Disabling certificate validation (--no-check-certificate) opens the build process to potential man-in-the-middle attacks by accepting unverified TLS certificates. Please drop this flag and rely on the base image’s CA bundle, or switch to a secure curl --fail --location approach instead.
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile lines 7 to 8, remove the wget flag `--no-check-certificate` to
enforce TLS certificate validation for secure downloads. Replace the wget
command with a secure curl command using `curl --fail --location` to download
the file, ensuring the base image's CA certificates are used for verification.
Adjust the command to download, extract, and clean up the archive accordingly
without disabling certificate checks.
OPS-4930 Cronos v1.4.7 Upgrades across clusters
Summary by CodeRabbit