Testnet v1.4.8 #73
Testnet v1.4.8 #73
Conversation
Update testnet v1.0.0 rc3
Update client to v1.0.0-rc4
Update client to v1.0.2
…t-1.0.5 cronos testnet image upgrade
…t-image-upgrade cronos testnet image upgrade
feature/cronos-testnet-v1.0.11
…c0-again bump 1.1.0-rc0
Fix panic on testnet
Updated testnet image to 1.4.0-rc4
WalkthroughThe Dockerfile was updated to use a specific immutable Debian base image digest, switch the working directory for Cronos binary operations from Changes
Sequence Diagram(s)sequenceDiagram
participant Docker Build
participant Debian Base Image
participant Cronos Binary Source
Docker Build->>Debian Base Image: Pull specific digest image
Docker Build->>Docker Build: Set working dir to /home/cronos
Docker Build->>Cronos Binary Source: Download v1.4.8-testnet tar.gz
Docker Build->>Docker Build: Extract files in /home/cronos
Docker Build->>Docker Build: Continue build steps (user, permissions, entrypoint)
Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 8-9: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: guardrails/scan
🔇 Additional comments (1)
Dockerfile (1)
1-1: Great move: pinning the base image to a digest increases build reproducibility
Usingdebian:bullseye-slim@sha256:…guarantees the exact image is pulled in every build.
| USER cronos | ||
|
|
||
| ENTRYPOINT ["/home/cronos/bin/cronosd"] | ||
| ENTRYPOINT ["/home/cronos/bin/cronosd"] |
There was a problem hiding this comment.
ENTRYPOINT path may be wrong – container will fail to start
After the extraction step you do not move the files, so the binary likely resides at
/home/cronos/cronos_1.4.8-testnet_Linux_x86_64/bin/cronosd (or, with the suggested --strip-components=1, at /home/cronos/bin/cronosd).
However, the ENTRYPOINT points to /home/cronos/bin/cronosd without guaranteeing that path exists.
Please either:
- Keep the current extraction layout and adjust ENTRYPOINT:
-ENTRYPOINT ["/home/cronos/bin/cronosd"]
+ENTRYPOINT ["/home/cronos/cronos_1.4.8-testnet_Linux_x86_64/bin/cronosd"]- Or adopt the
--strip-components=1refactor above and leave the ENTRYPOINT as-is.
Without this fix the image will exit with “file not found”.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ENTRYPOINT ["/home/cronos/bin/cronosd"] | |
| ENTRYPOINT ["/home/cronos/cronos_1.4.8-testnet_Linux_x86_64/bin/cronosd"] |
🤖 Prompt for AI Agents
In Dockerfile at line 15, the ENTRYPOINT path points to
/home/cronos/bin/cronosd, but the binary is not guaranteed to be there after
extraction. To fix this, either adjust the ENTRYPOINT to the actual extracted
path /home/cronos/cronos_1.4.8-testnet_Linux_x86_64/bin/cronosd if you keep the
extraction layout as is, or modify the extraction step to use
--strip-components=1 so the binary is placed directly in /home/cronos/bin/,
allowing the ENTRYPOINT to remain unchanged.
| RUN cd /home/cronos && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Remove --no-check-certificate and add integrity checks for the binary download
Disabling TLS validation (--no-check-certificate) opens the build to MITM attacks.
At a minimum, keep certificate verification enabled and verify the tarball’s checksum:
-RUN cd /home/cronos && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \
- && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz
+RUN set -eu; \
+ cd /home/cronos; \
+ wget --https-only https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz; \
+ echo "<SHA256 expected> cronos_1.4.8-testnet_Linux_x86_64.tar.gz" | sha256sum -c -; \
+ tar --strip-components=1 -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz; \
+ rm cronos_1.4.8-testnet_Linux_x86_64.tar.gzThis keeps TLS verification, checks the archive hash, flattens the directory (--strip-components=1) and cleans up in a single layer.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /home/cronos && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | |
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz | |
| RUN set -eu; \ | |
| cd /home/cronos; \ | |
| wget --https-only https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz; \ | |
| echo "<SHA256 expected> cronos_1.4.8-testnet_Linux_x86_64.tar.gz" | sha256sum -c -; \ | |
| tar --strip-components=1 -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz; \ | |
| rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 8-9: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile lines 8 to 9, remove the wget option `--no-check-certificate` to
re-enable TLS certificate verification and add a step to verify the downloaded
tarball's checksum using a known hash value. Also, update the tar extraction
command to include `--strip-components=1` to flatten the directory structure.
Ensure all these steps are combined in a single RUN layer and clean up the
tarball after verification and extraction.
Summary by CodeRabbit