Copilot commented on code in PR #3826:
URL: https://github.com/apache/avro/pull/3826#discussion_r3448117956
##########
share/docker/Dockerfile:
##########
@@ -178,46 +185,51 @@ RUN case "${BUILDARCH:?}" in \
&& for url in \
https://downloads.python.org/pypy/pypy3.11-v7.3.20-"$pypyarch".tar.bz2 \
https://downloads.python.org/pypy/pypy3.10-v7.3.19-"$pypyarch".tar.bz2 \
- ; do curl -fsSL "$url" | tar -xvjpf -; \
+ ; do curl -fsSL "$url" | tar -xjpf -; \
done \
&& ln -s pypy3.11* pypy3.11 && ln -s pypy3.10* pypy3.10
# Note: python3-distutils was removed with Python 3.12; see here for migration
advise: https://peps.python.org/pep-0632/#migration-advice
-RUN apt-get -qqy install --no-install-recommends mypy \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+ apt-get -qqy update \
+ && apt-get -qqy install --no-install-recommends mypy \
python3 \
python3.10 \
python3.11 \
python3.12 \
python3.13 \
python3.14 \
python3.14-dev \
- && apt-get -qqy clean \
- && curl -LsSf https://astral.sh/uv/0.10.4/install.sh | sh
+ && curl -LsSf https://astral.sh/uv/0.11.23/install.sh | sh
Review Comment:
The `curl | sh` pattern here has the same pipeline-exit-status issue as
other steps: if `curl` fails, `sh` may still exit successfully and the image
can be built without `uv` installed. Download the installer to a file and
execute it explicitly so a fetch failure fails the build.
##########
share/docker/Dockerfile:
##########
@@ -155,18 +164,16 @@ RUN apt-get -qqy install --no-install-recommends
libcompress-raw-zlib-perl \
libregexp-common-perl \
libtest-exception-perl \
libtest-pod-perl \
- libtry-tiny-perl \
- && apt-get -qqy clean
+ libtry-tiny-perl
-RUN curl -sSL https://cpanmin.us \
+RUN --mount=type=cache,target=/root/.cpanm \
+ curl -sSL https://cpanmin.us \
| perl - --self-upgrade \
- && cpanm --mirror https://www.cpan.org/ install Compress::Zstd \
- Module::Install::Repository \
- && rm -rf .cpanm
+ && cpanm --mirror https://www.cpan.org/ Compress::Zstd \
+ Module::Install::Repository
Review Comment:
This step uses `curl | perl` to bootstrap `cpanm`. With `/bin/sh` the
pipeline exit code is from `perl`, so a failed download can be missed and lead
to a silently incomplete Perl toolchain. Download the script first and run it
so the build fails if the fetch fails.
##########
share/docker/Dockerfile:
##########
@@ -99,28 +103,30 @@ RUN set -eux; \
ENV PATH="/opt/maven/bin:${PATH}"
# Install nodejs
-RUN curl -sSL https://deb.nodesource.com/setup_24.x \
- | bash \
- && apt-get -qqy install nodejs \
- && apt-get -qqy clean \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+ --mount=type=cache,target=/root/.npm \
+ curl -sSL https://deb.nodesource.com/setup_24.x | bash \
+ && apt-get -qqy install --no-install-recommends nodejs \
Review Comment:
The NodeSource setup script is executed via a `curl | bash` pipeline. In
`/bin/sh` (dash) the pipeline exit status is from `bash`, so a failed `curl`
(or a truncated download) can still lead to a successful build and potentially
install Ubuntu’s default `nodejs` instead of the intended NodeSource version.
Download the script to a file and execute it so failures are properly detected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
