Copilot commented on code in PR #3826:
URL: https://github.com/apache/avro/pull/3826#discussion_r3448155854
##########
share/docker/Dockerfile:
##########
@@ -178,46 +187,53 @@ RUN case "${BUILDARCH:?}" in \
&& for url in \
https://downloads.python.org/pypy/pypy3.11-v7.3.20-"$pypyarch".tar.bz2 \
https://downloads.python.org/pypy/pypy3.10-v7.3.19-"$pypyarch".tar.bz2 \
- ; do curl -fsSL "$url" | tar -xvjpf -; \
+ ; do curl -fsSL "$url" | tar -xjpf -; \
done \
&& ln -s pypy3.11* pypy3.11 && ln -s pypy3.10* pypy3.10
# Note: python3-distutils was removed with Python 3.12; see here for migration
advise: https://peps.python.org/pep-0632/#migration-advice
-RUN apt-get -qqy install --no-install-recommends mypy \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+ apt-get -qqy update \
+ && apt-get -qqy install --no-install-recommends mypy \
python3 \
python3.10 \
python3.11 \
python3.12 \
python3.13 \
python3.14 \
python3.14-dev \
- && apt-get -qqy clean \
- && curl -LsSf https://astral.sh/uv/0.10.4/install.sh | sh
+ && curl -fsSL -o /tmp/uv-install.sh https://astral.sh/uv/0.11.23/install.sh \
+ && sh /tmp/uv-install.sh \
+ && rm /tmp/uv-install.sh
Review Comment:
The uv installation runs a downloaded installer script from the network (`sh
/tmp/uv-install.sh`) without verifying a checksum/signature. Even though the
version is pinned in the URL, this still leaves the build susceptible to
upstream compromise; consider downloading a specific release artifact and
verifying its SHA256 (or installing from a trusted package repo).
##########
share/docker/Dockerfile:
##########
@@ -99,28 +103,32 @@ RUN set -eux; \
ENV PATH="/opt/maven/bin:${PATH}"
# Install nodejs
-RUN curl -sSL https://deb.nodesource.com/setup_24.x \
- | bash \
- && apt-get -qqy install nodejs \
- && apt-get -qqy clean \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+ --mount=type=cache,target=/root/.npm \
+ curl -fsSL -o /tmp/nodesource_setup.sh
https://deb.nodesource.com/setup_24.x \
+ && bash /tmp/nodesource_setup.sh \
+ && rm /tmp/nodesource_setup.sh \
+ && apt-get -qqy install --no-install-recommends nodejs \
Review Comment:
The Node.js install step downloads and executes a remote setup script
(nodesource.com) without any integrity verification. This is a supply-chain
risk for the build image; prefer adding the NodeSource apt repo via a pinned
GPG key/fingerprint (or use Ubuntu’s packaged nodejs) rather than executing an
unverified script.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
