feat: INFRA-5557 Cronos testnet image bump v1.5.0 #82
Conversation
Signed-off-by: Dmitrii Spichakov <dmitrii.spichakov@chainstack.com>
WalkthroughSwitched the Dockerfile’s Cronos binary download from a mainnet artifact to the testnet v1.5.0 tarball. Updated the URL, extracted tarball name, cleanup target, and move destination accordingly. No other Dockerfile instructions changed. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[high] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: guardrails/scan
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.5.0/cronos_1.5.0-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.5.0-testnet_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.5.0-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
🧩 Analysis chain
Remove TLS bypass; verify artifact; extract safely to target dir (avoid mv ./*).
Using wget --no-check-certificate is a supply‑chain risk and flagged by Checkov (CKV2_DOCKER_3). Also, extracting into /tmp then mv ./* can move unintended files and may break the expected /home/cronos/bin/cronosd path. Switch to a validated download and extract directly into /home/cronos; add -z to tar.
Apply this diff to Lines 7‑8:
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.5.0/cronos_1.5.0-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.5.0-testnet_Linux_x86_64.tar.gz \
- && rm cronos_1.5.0-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+RUN set -eux; \
+ cd /tmp; \
+ curl -fsSLo cronos_1.5.0-testnet_Linux_x86_64.tar.gz https://github.com/crypto-org-chain/cronos/releases/download/v1.5.0/cronos_1.5.0-testnet_Linux_x86_64.tar.gz; \
+ tar -xzf cronos_1.5.0-testnet_Linux_x86_64.tar.gz -C /home/cronos; \
+ rm -f cronos_1.5.0-testnet_Linux_x86_64.tar.gzAdditionally, ensure CA trust is present (update Line 6 accordingly) and trim apt lists:
RUN apt-get update -y && apt-get install -y --no-install-recommends wget curl procps net-tools jq lz4 ca-certificates && rm -rf /var/lib/apt/lists/*Optional but recommended: verify integrity by checking a known SHA256 (set CRONOS_SHA256 from the release):
ARG CRONOS_SHA256=<paste_sha256_here>
RUN echo "${CRONOS_SHA256} cronos_1.5.0-testnet_Linux_x86_64.tar.gz" | sha256sum -c -Please confirm the archive layout exposes bin/cronosd at the archive root so /home/cronos/bin/cronosd remains valid after direct extraction. If not, add --strip-components=1 to the tar command.
🏁 Script executed:
#!/bin/bash
set -euxo pipefail
# find Dockerfile
DOCKER_PATH=$(find . -type f -iname Dockerfile | head -n1 || true)
if [ -z "$DOCKER_PATH" ]; then
echo "No Dockerfile found"
exit 0
fi
echo "Using Dockerfile: $DOCKER_PATH"
echo "=== Dockerfile (lines 1..120) ==="
nl -ba "$DOCKER_PATH" | sed -n '1,120p' || true
echo "=== Search for patterns: wget --no-check-certificate, mv ./* /home/cronos, tar -xvf, apt-get install ==="
grep -n -E "wget --no-check-certificate|--no-check-certificate|mv \.\*/ /home/cronos|mv \.\* /home/cronos|tar -xv|tar -xvf|apt-get install" "$DOCKER_PATH" || true
# extract URL to tar.gz from Dockerfile (first match)
URL=$(grep -oE 'https?://[^ ]+cronos[^ ]+\.tar\.gz' "$DOCKER_PATH" | head -n1 || true)
echo "Detected URL: $URL"
if [ -n "$URL" ]; then
TMPDIR=$(mktemp -d)
ARCH="$TMPDIR/cronos.tar.gz"
echo "Downloading $URL -> $ARCH"
curl -fsSL -o "$ARCH" "$URL"
echo "Downloaded file info:"
ls -lh "$ARCH" || true
echo "=== Tarball top-level prefixes (count) ==="
tar -tzf "$ARCH" | awk -F/ '{print $1}' | uniq -c | sort -rn || true
echo "=== Sample tar listing (first 200 lines) ==="
tar -tzf "$ARCH" | sed -n '1,200p' || true
fi
echo "=== Done ==="Length of output: 2722
Remove TLS bypass; extract directly to /home/cronos; add CA and integrity check.
File: Dockerfile (lines ~6–8)
wget --no-check-certificate is a supply‑chain risk — replace with a verified download, extract directly into /home/cronos (avoid mv ./*), install CA trust, and validate the archive checksum.
Apply this diff to Lines 7‑8:
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.5.0/cronos_1.5.0-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.5.0-testnet_Linux_x86_64.tar.gz \
- && rm cronos_1.5.0-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+RUN set -eux; \
+ cd /tmp; \
+ curl -fsSLo cronos_1.5.0-testnet_Linux_x86_64.tar.gz https://github.com/crypto-org-chain/cronos/releases/download/v1.5.0/cronos_1.5.0-testnet_Linux_x86_64.tar.gz; \
+ tar -xzf cronos_1.5.0-testnet_Linux_x86_64.tar.gz -C /home/cronos; \
+ rm -f cronos_1.5.0-testnet_Linux_x86_64.tar.gzEnsure CA trust is installed (update the apt line) and trim apt lists:
RUN apt-get update -y && apt-get install -y --no-install-recommends wget curl procps net-tools jq lz4 ca-certificates && rm -rf /var/lib/apt/lists/*Optional but recommended: verify integrity with a known SHA256:
ARG CRONOS_SHA256=<paste_sha256_here>
RUN echo "${CRONOS_SHA256} cronos_1.5.0-testnet_Linux_x86_64.tar.gz" | sha256sum -c -Verified: the archive contains ./bin/cronosd at the archive root, so direct extraction into /home/cronos will produce /home/cronos/bin/cronosd — no --strip-components required. Address the above changes before merging.
🧰 Tools
🪛 Checkov (3.2.334)
[high] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile around lines 7–8, remove the --no-check-certificate usage and
avoid moving files after extraction: update the apt-get install line to include
ca-certificates and use rm -rf /var/lib/apt/lists/* to trim caches; download the
cronos tarball without bypassing TLS (use wget/curl default), place a build ARG
for CRONOS_SHA256 and run a sha256sum -c check against the downloaded file, then
extract the archive directly into /home/cronos (so files land at
/home/cronos/bin/...) instead of extracting to /tmp and mv-ing; ensure the
commands fail on checksum mismatch and remove the downloaded archive after
verification.
INFRA-5557 Cronos v1.5.0 Upgrades across clusters
Summary by CodeRabbit