mirror of
https://github.com/luxfi/broker.git
synced 2026-09-24 00:25:18 +00:00
zeekayandHanzo Dev
c2ca958a5f
`go mod download` failed inside the image build:
verifying github.com/hanzoai/[email protected].5: checksum mismatch
SECURITY ERROR
Three faults compounded. github.com/hanzoai/* is private, but the Dockerfile
said "No GOPRIVATE -- public modules resolve via the immutable public proxy",
which stopped being true when that repo went private; Go therefore asked the
proxy, which still serves the pre-privatisation zip. The credential arrived as
`ARG GITHUB_TOKEN` and the workflow passed neither build-args nor secrets, so it
expanded to `https://@github.com/` and authenticated nothing. And an ARG is
recorded in image history, so had a token ever been supplied that way it would
have shipped inside the published image.
Now: GOPRIVATE names hanzoai only, and the token arrives as a mounted secret
scoped to the one RUN -- the same `--mount=type=secret,id=gh_token` shape used
across the estate. luxfi/* stays public on purpose, so the proxy keeps it pinned
to bytes the checksum database signed.
go.sum is untouched: it holds the direct hash, which is the correct one here.
Co-authored-by: Hanzo Dev <[email protected]>
49 lines
2.0 KiB
Docker
49 lines
2.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM golang:1.26.5-alpine AS builder
|
|
ENV GOTOOLCHAIN=auto
|
|
|
|
RUN apk add --no-cache git ca-certificates
|
|
|
|
# github.com/hanzoai/* is PRIVATE and must be fetched direct. Without GOPRIVATE
|
|
# Go asks the public proxy, which for [email protected] still serves the bits from
|
|
# before that repo went private -- a different zip than the tag points at now --
|
|
# so `go mod download` died against a go.sum that records the direct hash:
|
|
#
|
|
# verifying github.com/hanzoai/[email protected]: checksum mismatch
|
|
# SECURITY ERROR
|
|
#
|
|
# go.sum is CORRECT and must not be "fixed" to the proxy value; verified by
|
|
# measuring both ways. luxfi/* is deliberately absent here -- it is public, and
|
|
# resolving it through the proxy is what pins it to bytes the sumdb signed.
|
|
ENV GOPRIVATE=github.com/hanzoai/*
|
|
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
|
|
# The credential arrives as a mounted secret, not ARG GITHUB_TOKEN. Two reasons
|
|
# the old form could not work: the workflow passed neither build-args nor
|
|
# secrets, so the value was empty and the rewrite expanded to a useless
|
|
# `https://@github.com/`; and a build ARG is recorded in image history, so a real
|
|
# token would have shipped inside the published image. The mount exists only for
|
|
# the lifetime of this RUN.
|
|
RUN --mount=type=secret,id=gh_token \
|
|
if [ -s /run/secrets/gh_token ]; then \
|
|
git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
|
|
else \
|
|
echo "gh_token secret is empty; private github.com/hanzoai/* modules will not resolve" >&2; \
|
|
fi; \
|
|
go mod download
|
|
COPY . .
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o brokerd ./cmd/brokerd/
|
|
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates
|
|
COPY --from=builder /app/brokerd /usr/local/bin/brokerd
|
|
EXPOSE 8090 9090
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:8090/healthz || exit 1
|
|
|
|
ENTRYPOINT ["brokerd"]
|