7 Commits
Author SHA1 Message Date
Max KainovandClaude Opus 4.8 77973364a7 Roll out in-region apt mirror to all arm64 CI docker images
The mirror override was only applied to a subset of images. Every other
arm64 CI image built directly `FROM ubuntu` still resolved through
`ports.ubuntu.com` and was subject to the same failure.

Add a generic `build_args` field to `Docker.Config` and pass the
in-region AWS mirror (`apt_archive` / `apt_ports_archive`, set literally in
`ci/defs/defs.py`) to the Ubuntu-based CI images on the command line.
`ci/praktika/docker.py` stays generic - it just forwards `build_args` and
knows nothing about apt or the region. Images that don't declare the args
ignore them.

Dockerfile defaults stay canonical so local builds are unchanged, and the
remaining direct-`ubuntu` arm64 images (`style-test`, `install-deb-test`,
`sqlancer-test`, `mysql_dotnet_client`, `postgresql-java-client`) get a
`ports`- and deb822-aware rewrite so the passed mirror reaches arm64.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-17 13:33:50 +02:00
Rahul 44e91268e0 ci: trigger rebuild of client Docker images with SBOM/provenance attestations
Add a comment to each client integration Dockerfile to change their
digest and force a rebuild via master CI. This is needed because the
per-platform images were last built on Feb 20 (before the SBOM/provenance
pipeline was fixed) and will never be rebuilt automatically since no
Dockerfile has changed since then.

Once rebuilt, master CI will produce OCI image indices with attestation
manifests, improving Docker Scout supply chain security scores.

Follows #97903 (enable SBOM/provenance in docker.py) and #98511 (fix
incompatible --builder default and inline cache flags).
2026-03-03 09:46:15 -08:00
Rahul 0598247fde fix: restore test compatibility in upgraded Docker images
- Fix CLASSPATH regression in postgresql-java-client and mysql-java-client:
  add leading '.' so javac-compiled .class files are found at runtime
- Downgrade MySQL Connector/J 9.2.0 → 8.4.0 to avoid 9.x breaking changes
  (useSSL=false removed, type mapping changes)
- Revert mysql2 → mysql in JS client; test expects mysql package error message
  for sha256_password auth
- Downgrade go-sql-driver/mysql v1.8.1 → v1.6.0 to preserve error message
  format (v1.7+ adds SQL state prefix breaking exact-match assertions)
- Revert ClickHouse.Client 7.14.0 → 4.1.0 to match dotnet.reference output
  (type representations and date formats changed in major version jumps)
2026-02-19 09:12:28 -08:00
Rahul 717c43d9ff fix: address code review issues in Tier 3 Docker images
- dotnet_client: sync csproj package version (4.1.0→7.14.0) to match Dockerfile ARG
- postgresql_java_client: drop build-essential (not needed for javac), add
  --no-install-recommends, fix CLASSPATH to not reference unset env var
- mysql_java_client: fix CLASSPATH to not reference unset env var
- mysql_js_client: pin npm@11 (was npm@latest), switch mysql→mysql2
  (mysql package abandoned since 2020; mysql2 is API-compatible drop-in)
- mysql_golang_client: simplify apk upgrade to single --no-cache flag
- docs-builder: pin npm@11, remove redundant g++ and make (already in
  build-essential), remove yarn registry config (sets the default, dead code)
2026-02-19 07:22:54 -08:00
Rahul 51bfce4027 fix: iterative CVE remediation based on docker scout results
Follow-up to initial base-image upgrades after running docker scout
cves --only-severity critical,high on all 7 patched images.

- postgresql-java-client: JDBC driver 42.7.5 → 42.7.7 (fixes CVE-2025-49146, Improper Authentication, CVSS 8.2)
- mysql-golang-client: golang:1.23-alpine → golang:1.24-alpine + apk upgrade (fixes 2 Critical + 10 High in stdlib and openssl)
- mysql-js-client: npm install -g npm@latest (reduces npm-internal tar/minimatch Highs from 10 → 2)
- docs-builder: npm install -g npm@latest (reduces npm-internal tar/minimatch Highs from 10 → 2)

Final scout results (all images, --only-severity critical,high):
  postgresql-java-client  0C 0H
  dotnet-client           0C 4H (MSBuild/System.Net.Http in SDK base, unfixable without SDK bump)
  mysql-java-client       0C 1H (libpng - not fixed upstream in Alpine)
  mysql-golang-client     0C 0H
  mysql-js-client         0C 2H (npm-internal minimatch/tar, fix not yet in npm release)
  mysql-php-client        0C 4H (Alpine tar - not fixed upstream)
  docs-builder            0C 2H (npm-internal minimatch/tar, fix not yet in npm release)

All images: 0 Critical, High < 10.
2026-02-18 18:00:27 -08:00
Rahul 599e25fafa fix: upgrade Tier 3 integration Docker base images to eliminate EOL CVEs
Addresses critical/high CVE exposure across 7 integration test images
whose base images were EOL or removed from Docker Hub entirely.

Changes:
- postgresql-java-client: ubuntu:18.04 → ubuntu:24.04, openjdk-8-jdk → openjdk-21-jdk, JDBC driver 42.2.12 → 42.7.5
- dotnet-client: dotnet/sdk:3.1 → dotnet/sdk:8.0, ClickHouse.Client 4.1.0 → 7.14.0, netcoreapp3.1 → net8.0
- mysql-java-client: openjdk:8-jdk-alpine → eclipse-temurin:21-jdk-alpine, mysql-connector-j 8.1.0 → 9.2.0
- mysql-golang-client: golang:1.17 → golang:1.23-alpine, go-sql-driver/mysql commit pin → v1.8.1
- mysql-js-client: node:16.14.2 → node:22-alpine
- mysql-php-client: php:8-cli-alpine → php:8.4-cli-alpine (pin floating tag)
- docs-builder: node:20-bookworm-slim → node:22-bookworm-slim, add apt-get upgrade

Pre-patch baseline build results:
- ubuntu:18.04 (postgresql-java-client): BUILD FAILURE — apt repos EOL, packages unavailable
- openjdk:8-jdk-alpine (mysql-java-client): BUILD FAILURE — image removed from Docker Hub
2026-02-18 12:08:34 -08:00
Max Kainov 3b843c7400 CI: Move docker files and remove reprecated ci scripts 2025-06-20 19:14:36 +02:00