Cronos image upgrade v1.4.8 #75
Conversation
Signed-off-by: Dmitrii Spichakov <dmitrii.spichakov@chainstack.com>
WalkthroughThe Dockerfile has been updated to install Cronos version 1.4.8 instead of 1.4.7. This involved changing the version number in the download URL, tarball filename, and extracted file paths. No other installation steps or configurations were altered. Changes
Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
Dockerfile (1)
7-8: IntroduceARG CRONOS_VERSIONto simplify future upgrades
The version appears four times; parameterising it once reduces copy-paste risk and makes future bumps a single-line change.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: guardrails/scan
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.8_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
🛠️ Refactor suggestion
TLS verification is disabled – re-enable it and add checksum/GPG verification
wget --no-check-certificate nullifies HTTPS protection, leaving the build vulnerable to MITM or supply-chain attacks. The tarball is also extracted without any integrity check.
Refactor example:
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8_Linux_x86_64.tar.gz \
- && rm cronos_1.4.8_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+ARG CRONOS_VERSION=1.4.8
+RUN set -eux; \
+ cd /tmp; \
+ wget -q https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz; \
+ wget -q https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_checksums.txt; \
+ grep "cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz" cronos_${CRONOS_VERSION}_checksums.txt | sha256sum -c -; \
+ tar -xzf cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz; \
+ mv cronos_${CRONOS_VERSION}/. /home/cronos/; \
+ rm -rf /tmp/*Benefits:
• Restores TLS verification.
• Verifies artifact integrity.
• Uses ARG to avoid duplicating the version string.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8_Linux_x86_64.tar.gz \ | |
| && rm cronos_1.4.8_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | |
| ARG CRONOS_VERSION=1.4.8 | |
| RUN set -eux; \ | |
| cd /tmp; \ | |
| wget -q https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz; \ | |
| wget -q https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_checksums.txt; \ | |
| grep "cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz" cronos_${CRONOS_VERSION}_checksums.txt | sha256sum -c -; \ | |
| tar -xzf cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz; \ | |
| mv cronos_${CRONOS_VERSION}/. /home/cronos/; \ | |
| rm -rf /tmp/* |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile lines 7 to 8, the wget command disables TLS verification with
--no-check-certificate and extracts the tarball without verifying its integrity,
which is insecure. Remove the --no-check-certificate flag to re-enable TLS
verification, add a checksum or GPG signature verification step after
downloading the tarball to ensure its integrity, and use a build ARG to define
the version string to avoid duplication and improve maintainability.
Cronos image upgrade v1.4.8
INFRA-4559 Cronos v1.4.8 Upgrades across clusters
Summary by CodeRabbit