Skip to content

feat: INFRA-6582 Cronos testnet image upgrade v1.6.0 #92

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Spich3000 merged 1 commit into from
Dec 1, 2025
Merged

feat: INFRA-6582 Cronos testnet image upgrade v1.6.0 #92

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ RUN mkdir -p /home/cronos/data && mkdir -p /home/cronos/config
RUN apt-get update -y && apt-get install wget curl procps net-tools jq lz4 -y

# Download and verify tarball
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.5.4/cronos_1.5.4_Linux_x86_64.tar.gz && tar -xvf cronos_1.5.4_Linux_x86_64.tar.gz \
&& rm cronos_1.5.4_Linux_x86_64.tar.gz && mv ./* /home/cronos/
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.6.0/cronos_1.6.0-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.0-testnet_Linux_x86_64.tar.gz \
&& rm cronos_1.6.0-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
Comment on lines +11 to +12
Copy link

@coderabbitai coderabbitai bot Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Remove --no-check-certificate from wget to prevent MITM attacks.

The --no-check-certificate flag disables SSL/TLS certificate validation during the download, which introduces a vulnerability to man-in-the-middle attacks. This is a security best practice violation and should be removed.

The debian:bullseye-slim base image includes certificate bundles by default, so certificate validation should work without additional configuration.

Apply this diff to remove the --no-check-certificate flag:

 # Download and verify tarball
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.6.0/cronos_1.6.0-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.0-testnet_Linux_x86_64.tar.gz \
+RUN cd /tmp && wget https://github.com/crypto-org-chain/cronos/releases/download/v1.6.0/cronos_1.6.0-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.0-testnet_Linux_x86_64.tar.gz \
      && rm cronos_1.6.0-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/

If certificate validation fails due to missing or expired certificates in the container, consider updating the certificate bundle (ca-certificates package) rather than disabling validation.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 Checkov (3.2.334)

[high] 11-12: Ensure that certificate validation isn't disabled with wget

(CKV2_DOCKER_3)

🤖 Prompt for AI Agents 
In Dockerfile around lines 11 to 12, the wget invocation uses the insecure
--no-check-certificate flag; remove that flag so TLS certificates are validated,
and ensure the image has up-to-date root CAs by installing or updating the
ca-certificates package (e.g., add an apt-get update && apt-get install -y
ca-certificates step earlier in the Dockerfile if not already present) so the
download succeeds without disabling certificate checks.


# Set permissions
RUN chown -R cronos:cronos /home/cronos && chmod 1777 /tmp
Expand Down