zmuxuny opened a new pull request, #5380: URL: https://github.com/apache/rocketmq-dashboard/pull/5380
### Summary Refs #5378. Verify the existing Node 20.19.2, Maven 3.9.9 and MySQL Connector/J 9.7.0 downloads against committed upstream checksums before extraction or runtime placement. Preserve versions, mirror URLs and licensing separation. Add provenance/update guidance and offline shell-level regression checks to backend CI. ### Verification - 5 focused tests / 18 shell scenarios pass; the original Dockerfile fails all 18 due to missing checksum gates - 15 total Python script tests pass, including existing license/Grafana checks - Actual official artifacts independently rehashed; Node/MySQL mirror copies match official bytes and committed digests - All Dockerfile RUN shell blocks pass sh -n; git diff --check passes - Independent read-only code/provenance review completed The tests use real shell/checksum programs with synthetic download bytes and mocked extraction/CLI execution. No downloaded binaries were executed. No Docker client/daemon is available in the local runner, so both full server image targets remain unrun. ### Limits Initial checksum sources were official HTTPS; publisher-signing-key verification is not claimed. Rolling base images, OS packages and exact npm dependency locking remain separate follow-ups in #5378. This does not make the complete image reproducible or close that broader issue. AI assistance was used for implementation, regression tests and review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
