Skip to content

chore(deps): Bump the docker-images group across 1 directory with 2 updates #1194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): Bump the docker-images group across 1 directory with 2 updates #1194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.breg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& install -m 0644 /workspace/THIRD_PARTY_NOTICES /workspace/runtime-root/licenses/breg/THIRD_PARTY_NOTICES \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the guarded Distroless release state

All five runtime Dockerfiles now use this new Distroless digest, while release/scripts/check-debian13-images.py:67-70 and the five advisory baselines still bind the old base and layer identities. The image-contract command invoked by .github/workflows/ci.yml:131 and .github/workflows/release-candidate.yml:219 therefore fails immediately; after updating the policy constant, advisory verification will also reject the changed base until its security evidence is explicitly reviewed and renewed. Carry those guarded release updates with the digest bump.

AGENTS.md reference: AGENTS.md:L416-L418

Useful? React with 👍 / 👎.


LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.builder
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e

FROM rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3 AS builder
FROM rust:1.97-trixie@sha256:b1b3c9c0d921d7fa0a6d1f9ec7e4eab87f8c8ec97644c3d791450f131dec813f AS builder

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Synchronize the canonical release-builder identity

This recipe now builds under the Rust 1.97 base, but .github/workflows/release-candidate.yml:19, release/scripts/build-release-binaries.sh:220, and release/scripts/registry-release:147-150 still require and record the Rust 1.95 image. Consequently check-debian13-images.py fails, and if that check were bypassed the resulting binaries would be stamped with incorrect builder provenance. Update every canonical builder pin and provenance marker together with this base change.

AGENTS.md reference: AGENTS.md:L416-L418

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the required DCO sign-off

Commit 76289b00032dbfdcee4fe166efbf17aad64da177 has no Signed-off-by: trailer, so it violates the repository's mandatory DCO policy and cannot be accepted as-is; recreate the commit with git commit -s before merging.

AGENTS.md reference: AGENTS.md:L405-L407

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the maintained adopter images on the shared bases

This grouped update changes both shared image identities only under release/docker, leaving docker/Dockerfile:25,60,99 on the old Rust builder and Distroless runtime digests even though check-debian13-images.py explicitly requires that maintained adopter Dockerfile to use the same RUST_BUILDER and DISTROLESS_RUNTIME values. Once the policy constants are updated for these new pins, CI will still fail on the adopter images, and docker/README.md:61-63 will describe stale versions; update that maintained Dockerfile and its version documentation in the same change.

AGENTS.md reference: AGENTS.md:L416-L418

Useful? React with 👍 / 👎.


# pg_query 6.1.1 always invokes bindgen and regenerates its Rust protobuf types
# when Cargo exposes a protoc command. Freeze the archive and build packages so
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.casework
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-casework/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.discovery
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& install -m 0644 /workspace/LICENSE /workspace/runtime-root/licenses/discovery/LICENSE \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.evidence
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-evidence/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.relay
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/relay/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:c31ff9abcb1910f3ab25c7957bdaf0bfe12a01eb546e8df2282f1c8f682b606c AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
Loading