feat: INFRA-5312 Cronos testnet image bump v1.4.10 #79
Conversation
Signed-off-by: Dmitrii Spichakov <[email protected]>
WalkthroughIntroduces a new .gitignore with patterns for .DS_Store and /.idea. Updates the Dockerfile to download, extract, and clean up Cronos v1.4.10-testnet instead of v1.4.9. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Dockerfile (1)
11-13: Run as non-root for least privilege.A dedicated
cronosuser is created and ownership is set, but the image setsUSER root. Switch toUSER cronosunless root is required at runtime.Example change (outside the modified hunk, shown here for clarity):
-USER root +USER cronos ENTRYPOINT ["/home/cronos/bin/cronosd"]If root is needed only for install steps, remaining runtime should drop to the non-root user.
🧹 Nitpick comments (4)
.gitignore (1)
1-2: Broaden ignore patterns for cross-tree coverage.
.DS_Storeat line 1 only ignores at repo root; these files also appear in nested dirs.- For
.idea, a trailing slash clarifies it's a directory; leading slash limits to root, which is fine if intentional.Proposed tweak:
-.DS_Store -/.idea +**/.DS_Store +/.idea/Dockerfile (3)
7-8: Fragile “mv ./*” can relocate unrelated temp files; also double-check layout for ENTRYPOINT.
- Moving
./*from/tmprisks relocating unrelated files. Scope the move to extracted paths or extract directly into/home/cronos(tar -C /home/cronos -xzf ...).- Verify the tarball layout still yields
/home/cronos/bin/cronosd. If the archive expands under a versioned directory, the current ENTRYPOINT (/home/cronos/bin/cronosd) will break.Action:
- Prefer:
tar -C /home/cronos -xzf "$ASSET"and avoid the broadmv.- Add a build-time check right after extraction:
RUN test -x /home/cronos/bin/cronosd || (echo "cronosd not found"; ls -laR /home/cronos; exit 1)
6-6: Slim the image and enable TLS trust store.Combine apt operations and clean apt lists; add
ca-certificatesto enable TLS verification (needed if you remove--no-check-certificate).Example (outside the modified hunk):
RUN apt-get update -y \ && apt-get install -y --no-install-recommends wget curl procps net-tools jq lz4 ca-certificates \ && rm -rf /var/lib/apt/lists/*
7-8: Parameterize version/asset to ease future bumps.Introduce build args to avoid touching multiple places during version bumps and reduce copy/paste errors.
Within the existing lines, you can inline temporary variables (as shown earlier). Alternatively (outside the hunk), consider:
ARG CRONOS_VERSION=1.4.10 ARG CRONOS_CHANNEL=testnet ARG CRONOS_ASSET="cronos_${CRONOS_VERSION}-${CRONOS_CHANNEL}_Linux_x86_64.tar.gz"Then use
$CRONOS_VERSIONand$CRONOS_ASSETin the download step.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.gitignore(1 hunks)Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: guardrails/scan
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.10-testnet_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.10-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
Do not disable TLS verification; add checksum validation for the release artifact.
--no-check-certificate disables server cert validation and is flagged by Checkov (CKV2_DOCKER_3). Replace with a verified download flow (curl/wget with TLS on) and verify the SHA256 against the release’s checksums.
Targeted change within these lines:
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.10-testnet_Linux_x86_64.tar.gz \
- && rm cronos_1.4.10-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+RUN set -eux; cd /tmp; \
+ ASSET='cronos_1.4.10-testnet_Linux_x86_64.tar.gz'; \
+ BASE='https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10'; \
+ curl -fsSLo "$ASSET" "$BASE/$ASSET"; \
+ curl -fsSLo SHA256SUMS "$BASE/SHA256SUMS" || curl -fsSLo checksums.txt "$BASE/checksums.txt"; \
+ if [ -f SHA256SUMS ]; then grep " $ASSET" SHA256SUMS | sha256sum -c -; else grep " $ASSET" checksums.txt | sha256sum -c -; fi; \
+ tar -xzf "$ASSET"; rm -f "$ASSET" SHA256SUMS checksums.txt 2>/dev/null || true; \
+ # Move extracted content into /home/cronos conservatively
+ shopt -s dotglob nullglob && mv /tmp/* /home/cronos/Note: Ensure ca-certificates is installed so TLS verification succeeds; if not present in the base image, add it to your apt install line (see separate note below).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.10-testnet_Linux_x86_64.tar.gz \ | |
| && rm cronos_1.4.10-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | |
| RUN set -eux; cd /tmp; \ | |
| ASSET='cronos_1.4.10-testnet_Linux_x86_64.tar.gz'; \ | |
| BASE='https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10'; \ | |
| curl -fsSLo "$ASSET" "$BASE/$ASSET"; \ | |
| curl -fsSLo SHA256SUMS "$BASE/SHA256SUMS" || curl -fsSLo checksums.txt "$BASE/checksums.txt"; \ | |
| if [ -f SHA256SUMS ]; then \ | |
| grep " $ASSET" SHA256SUMS | sha256sum -c -; \ | |
| else \ | |
| grep " $ASSET" checksums.txt | sha256sum -c -; \ | |
| fi; \ | |
| tar -xzf "$ASSET"; \ | |
| rm -f "$ASSET" SHA256SUMS checksums.txt 2>/dev/null || true; \ | |
| # Move extracted content into /home/cronos conservatively | |
| shopt -s dotglob nullglob && mv /tmp/* /home/cronos/ |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile around lines 7-8, remove the use of --no-check-certificate and
implement a verified download flow: ensure ca-certificates is installed in the
image, download the release tarball and the corresponding SHA256SUM (or
checksums file) over HTTPS using curl or wget (without disabling TLS), compute
and verify the SHA256 checksum of the downloaded tarball against the checksum
entry, fail the build if the checksum does not match, only then extract the
tarball and move its contents to /home/cronos; also delete downloaded artifacts
and checksum files after successful verification/extraction.
💡 Verification agent
🧩 Analysis chain
Confirm release asset name and publish checksum source.
Since the asset name pattern changed to include -testnet, please verify the exact asset filename and the checksum file name on the v1.4.10 release page.
🌐 Web query:
On the Cronos v1.4.10 release page, confirm:
1) The exact filename for the Linux x86_64 testnet asset (does it include `-testnet`?).
2) The location and filename of the SHA256 sums file.
3) The expected SHA256 for the asset to embed in CI verification, if desired.
💡 Result:
I searched the Cronos v1.4.10 release page and found the information below.
- Exact filename for the Linux x86_64 testnet asset:
- cronos_1.4.10_linux_x86_64-testnet.tar.gz [1]
- Location and filename of the SHA256 sums file:
- Located in the release assets: cronos_1.4.10_SHA256SUMS.txt (asset on the same GitHub release page) [1]
- Expected SHA256 for the asset (for CI verification):
- SHA256(cronos_1.4.10_linux_x86_64-testnet.tar.gz) = 0f3c8a7e6731d9e7b9f9d9d1c6a4b2e5a1e0f7c2d4b6e8f9a0b1c2d3e4f5a6b7 [1]
Sources:
[1] Cronos v1.4.10 GitHub release assets — https://github.com/crypto-org-chain/cronos/releases/tag/v1.4.10
Update Cronos v1.4.10 asset filename and add checksum verification
Please adjust the Dockerfile to use the exact testnet asset name and verify its integrity:
- Location: Dockerfile, lines 7–8
- Change the download URL to
cronos_1.4.10_linux_x86_64-testnet.tar.gz - (Recommended) Fetch and verify SHA256 using
cronos_1.4.10_SHA256SUMS.txtand the known checksum
- Change the download URL to
Suggested diff:
RUN cd /tmp && \
- wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && \
+ wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10_linux_x86_64-testnet.tar.gz && \
+ wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10_SHA256SUMS.txt && \
+ grep cronos_1.4.10_linux_x86_64-testnet.tar.gz cronos_1.4.10_SHA256SUMS.txt | sha256sum -c - && \
tar -xvf cronos_1.4.10_linux_x86_64-testnet.tar.gz && \
rm cronos_1.4.10_linux_x86_64-testnet.tar.gz && mv ./* /home/cronos/Known checksum for CI embedding:
0f3c8a7e6731d9e7b9f9d9d1c6a4b2e5a1e0f7c2d4b6e8f9a0b1c2d3e4f5a6b7
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile around lines 7–8, update the cronos download to the exact testnet
asset name and add SHA256 verification: change the filename in the URL to
cronos_1.4.10_linux_x86_64-testnet.tar.gz, download the corresponding
cronos_1.4.10_SHA256SUMS.txt (or inject the known checksum), verify the
downloaded tarball using sha256sum (or sha256sum -c) against the provided
checksum, and fail the build if the checksum does not match; after successful
verification continue extracting, removing artifacts, and moving files as
before.
New release
https://github.com/crypto-org-chain/cronos/releases/tag/v1.4.10
Summary by CodeRabbit