Pin expected commit when building Leiningen from source#290
Merged
Conversation
Collaborator
Author
|
@Quantisan Going to go ahead and merge to free up the lein version bump, but let me know if you'd like to see any changes in here. |
docker-library/official-images asked that we verify the clone's checked-out commit matches the expected SHA, in case an upstream tag is ever moved (belt-and-suspenders with git verify-tag). Record the expected HEAD commit per Leiningen release in lein/release-commits and assert it after cloning.
cap10morgan
force-pushed
the
lein/verify-clone-commit
branch
from
49d99dd to
d963a6e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses official-images feedback from @yosifkit on the Leiningen 2.13.0 source-build:
What
After
git clone --branch $LEIN_VERSION+git verify-tag, also assert the checked-outHEADmatches the expected commit:so a moved or re-pointed upstream tag can't slip a different commit past us (belt-and-suspenders with the existing GPG tag verification).
The expected commit is recorded per release in
lein/release-commitsand threaded into the template; an unknown version throws at generation time rather than silently building an unverifiable image.Verification
refs/tags/2.13.0^{}on Codeberg dereferences tod703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030(whatgit rev-parse HEADresolves to after checkout).bb dockerfiles); cljfmt clean;bb test12 tests / 51 assertions, 0 failures.lein versionreports Leiningen 2.13.0.