bitflicker64 commented on code in PR #784:
URL:
https://github.com/apache/hugegraph-toolchain/pull/784#discussion_r4207005592
##########
.github/scripts/verify_candidate_image_sdk.py:
##########
@@ -20,10 +20,14 @@
import argparse
import hashlib
import json
+import os
+import re
+from functools import lru_cache
+import urllib.request
from pathlib import Path
REPOSITORY = "apache/hugegraph"
-COMMIT = "d9abcd4317fb36128e7e4d209139ec7f3a28cdfc"
+COMMIT = "d9abcd"
Review Comment:
Important: This PR replaces every full 40-character source pin with a
six-character prefix (`d9abcd` here, in both Dockerfiles, `setup-candidate-sdk`
defaults, `ci.yml` and `java17-images-ci.yml`; `b12425` for the 1.7.0 tag
check). The full identity is resolved at build time through `GET
/repos/apache/hugegraph/commits/<prefix>`. That endpoint resolves prefixes
across the whole GitHub fork network, not just apache/hugegraph. When two
objects share a prefix it returns HTTP 422 (`No commit found for SHA`). This
already happens today: `d9abc`, `73980` and `2313c` are unique among the 85k
objects of a local apache/hugegraph clone (`git rev-parse --disambiguate=<p>`
prints one object), yet the API returns 422 for all three. A 24-bit prefix is
also cheap to brute-force. Any GitHub user can fork apache/hugegraph and push a
commit starting with `d9abcd`, and from then on `resolve.cjs`,
`checkout-server.sh` and this verifier fail. Every Toolchain CI run breaks, and
so does every direct `do
cker build` of the Loader and Hubble images, including builds from a released
source tree, which cannot be patched later. The direct Docker path also makes
three unauthenticated API calls per image: the checkout resolver, plus this
verifier twice, because `CANDIDATE_SOURCE_COMMIT` is not set there and
`lru_cache` is per process. That makes offline or NAT/shared-IP builds depend
on the 60 requests per hour anonymous limit. Please keep the full SHA as the
pinned identity in `COMMIT`, the Dockerfile arguments, the action defaults and
the workflow inputs. Shorten only the log output, which the PR already does
with `[:6]` / `${X:0:6}`. With a full SHA, `checkout-server.sh` fetches
directly with no API call, and the verifier compares against a constant with no
network access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
