Skip to content

feat: INFRA-5312 Cronos testnet image bump v1.4.10 #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 25, 2025
Merged

feat: INFRA-5312 Cronos testnet image bump v1.4.10 #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
.DS_Store
/.idea
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ RUN adduser --disabled-password --gecos "" --no-create-home --uid 1000 cronos

RUN mkdir -p /home/cronos/data && mkdir -p /home/cronos/config
RUN apt-get update -y && apt-get install wget curl procps net-tools jq lz4 -y
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.9/cronos_1.4.9_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.9_Linux_x86_64.tar.gz \
&& rm cronos_1.4.9_Linux_x86_64.tar.gz && mv ./* /home/cronos/
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.10-testnet_Linux_x86_64.tar.gz \
&& rm cronos_1.4.10-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
Comment on lines +7 to +8
Copy link

@coderabbitai coderabbitai bot Aug 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Do not disable TLS verification; add checksum validation for the release artifact.

--no-check-certificate disables server cert validation and is flagged by Checkov (CKV2_DOCKER_3). Replace with a verified download flow (curl/wget with TLS on) and verify the SHA256 against the release’s checksums.

Targeted change within these lines:

-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.10-testnet_Linux_x86_64.tar.gz \
-     && rm cronos_1.4.10-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+RUN set -eux; cd /tmp; \
+    ASSET='cronos_1.4.10-testnet_Linux_x86_64.tar.gz'; \
+    BASE='https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10'; \
+    curl -fsSLo "$ASSET" "$BASE/$ASSET"; \
+    curl -fsSLo SHA256SUMS "$BASE/SHA256SUMS" || curl -fsSLo checksums.txt "$BASE/checksums.txt"; \
+    if [ -f SHA256SUMS ]; then grep " $ASSET" SHA256SUMS | sha256sum -c -; else grep " $ASSET" checksums.txt | sha256sum -c -; fi; \
+    tar -xzf "$ASSET"; rm -f "$ASSET" SHA256SUMS checksums.txt 2>/dev/null || true; \
+    # Move extracted content into /home/cronos conservatively
+    shopt -s dotglob nullglob && mv /tmp/* /home/cronos/

Note: Ensure ca-certificates is installed so TLS verification succeeds; if not present in the base image, add it to your apt install line (see separate note below).

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.10-testnet_Linux_x86_64.tar.gz \
&& rm cronos_1.4.10-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
RUN set -eux; cd /tmp; \
ASSET='cronos_1.4.10-testnet_Linux_x86_64.tar.gz'; \
BASE='https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10'; \
curl -fsSLo "$ASSET" "$BASE/$ASSET"; \
curl -fsSLo SHA256SUMS "$BASE/SHA256SUMS" || curl -fsSLo checksums.txt "$BASE/checksums.txt"; \
if [ -f SHA256SUMS ]; then \
grep " $ASSET" SHA256SUMS | sha256sum -c -; \
else \
grep " $ASSET" checksums.txt | sha256sum -c -; \
fi; \
tar -xzf "$ASSET"; \
rm -f "$ASSET" SHA256SUMS checksums.txt 2>/dev/null || true; \
# Move extracted content into /home/cronos conservatively
shopt -s dotglob nullglob && mv /tmp/* /home/cronos/
🧰 Tools
🪛 Checkov (3.2.334)

[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget

(CKV2_DOCKER_3)

🤖 Prompt for AI Agents 
In Dockerfile around lines 7-8, remove the use of --no-check-certificate and
implement a verified download flow: ensure ca-certificates is installed in the
image, download the release tarball and the corresponding SHA256SUM (or
checksums file) over HTTPS using curl or wget (without disabling TLS), compute
and verify the SHA256 checksum of the downloaded tarball against the checksum
entry, fail the build if the checksum does not match, only then extract the
tarball and move its contents to /home/cronos; also delete downloaded artifacts
and checksum files after successful verification/extraction.

💡 Verification agent

🧩 Analysis chain

Confirm release asset name and publish checksum source.

Since the asset name pattern changed to include -testnet, please verify the exact asset filename and the checksum file name on the v1.4.10 release page.

🌐 Web query:

On the Cronos v1.4.10 release page, confirm:
1) The exact filename for the Linux x86_64 testnet asset (does it include `-testnet`?).
2) The location and filename of the SHA256 sums file.
3) The expected SHA256 for the asset to embed in CI verification, if desired.

💡 Result:

I searched the Cronos v1.4.10 release page and found the information below.

  1. Exact filename for the Linux x86_64 testnet asset:
  • cronos_1.4.10_linux_x86_64-testnet.tar.gz [1]
  1. Location and filename of the SHA256 sums file:
  • Located in the release assets: cronos_1.4.10_SHA256SUMS.txt (asset on the same GitHub release page) [1]
  1. Expected SHA256 for the asset (for CI verification):
  • SHA256(cronos_1.4.10_linux_x86_64-testnet.tar.gz) = 0f3c8a7e6731d9e7b9f9d9d1c6a4b2e5a1e0f7c2d4b6e8f9a0b1c2d3e4f5a6b7 [1]

Sources:
[1] Cronos v1.4.10 GitHub release assets — https://github.com/crypto-org-chain/cronos/releases/tag/v1.4.10

Update Cronos v1.4.10 asset filename and add checksum verification

Please adjust the Dockerfile to use the exact testnet asset name and verify its integrity:

  • Location: Dockerfile, lines 7–8
    • Change the download URL to cronos_1.4.10_linux_x86_64-testnet.tar.gz
    • (Recommended) Fetch and verify SHA256 using cronos_1.4.10_SHA256SUMS.txt and the known checksum

Suggested diff:

 RUN cd /tmp && \
-    wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10-testnet_Linux_x86_64.tar.gz && \
+    wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10_linux_x86_64-testnet.tar.gz && \
+    wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.10/cronos_1.4.10_SHA256SUMS.txt && \
+    grep cronos_1.4.10_linux_x86_64-testnet.tar.gz cronos_1.4.10_SHA256SUMS.txt | sha256sum -c - && \
     tar -xvf cronos_1.4.10_linux_x86_64-testnet.tar.gz && \
     rm cronos_1.4.10_linux_x86_64-testnet.tar.gz && mv ./* /home/cronos/

Known checksum for CI embedding:

0f3c8a7e6731d9e7b9f9d9d1c6a4b2e5a1e0f7c2d4b6e8f9a0b1c2d3e4f5a6b7
🧰 Tools
🪛 Checkov (3.2.334)

[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget

(CKV2_DOCKER_3)

🤖 Prompt for AI Agents 
In Dockerfile around lines 7–8, update the cronos download to the exact testnet
asset name and add SHA256 verification: change the filename in the URL to
cronos_1.4.10_linux_x86_64-testnet.tar.gz, download the corresponding
cronos_1.4.10_SHA256SUMS.txt (or inject the known checksum), verify the
downloaded tarball using sha256sum (or sha256sum -c) against the provided
checksum, and fail the build if the checksum does not match; after successful
verification continue extracting, removing artifacts, and moving files as
before.

RUN chown -R cronos:cronos /home/cronos && chmod 1777 /tmp

USER root
Expand Down