chore(deps): update dependency sheeki03/tirith to v0.3.3 #5618
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -144,7 +144,7 @@ RUN apt-get update \ | |
| # Pinned version + sha256 checksum for supply chain safety. | ||
| # To update: bump TIRITH_VERSION and TIRITH_SHA256_{AMD64,ARM64} from the checksums.txt | ||
| # in the GitHub release: https://github.com/sheeki03/tirith/releases | ||
| ARG TIRITH_VERSION=0.3.3 | ||
| ARG TIRITH_SHA256_AMD64=571e6a300e4c444293476537a322666069e561c7f05283d6650f5b8ef83db3ac | ||
|
There was a problem hiding this comment. [high] supply-chain integrity TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums for both amd64 (line 148) and arm64 (line 149) were not updated. The checksums still correspond to the v0.3.1 binaries. The build will fail at the sha256sum -c step because the downloaded v0.3.3 tarball will not match the stale hashes. The inline comment on lines 145-146 documents the required procedure: bump both TIRITH_VERSION and TIRITH_SHA256_{AMD64,ARM64} together from the release checksums.txt. This issue was flagged in the prior review and remains unfixed. Suggested fix: Update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 to the correct checksums from the v0.3.3 release checksums.txt file at https://github.com/sheeki03/tirith/releases/tag/v0.3.3. There was a problem hiding this comment. [high] supply-chain integrity TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums on lines 148-149 (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. They still contain the hashes for the v0.3.1 tarballs. The build will fail at the sha256sum -c step because the downloaded v0.3.3 tarballs will not match the stale v0.3.1 hashes. This is confirmed by the build-base CI check, which is currently failing. The inline comment on lines 145-146 documents the required procedure: bump both TIRITH_VERSION and TIRITH_SHA256_{AMD64,ARM64} together from the releases checksums.txt. This issue was flagged in the prior review and remains unfixed. Suggested fix: Download checksums.txt from https://github.com/sheeki03/tirith/releases/tag/v0.3.3 and update TIRITH_SHA256_AMD64 (line 148) to the SHA256 of tirith-x86_64-unknown-linux-gnu.tar.gz, and TIRITH_SHA256_ARM64 (line 149) to the SHA256 of tirith-aarch64-unknown-linux-gnu.tar.gz from that release. There was a problem hiding this comment. [high] supply-chain integrity TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but TIRITH_SHA256_AMD64 (line 148) and TIRITH_SHA256_ARM64 (line 149) still contain the v0.3.1 hashes. The build downloads v0.3.3 tarballs but verifies them against stale v0.3.1 checksums, causing the sha256sum -c step to fail. This issue was flagged in the prior review and remains unfixed. Suggested fix: Download checksums.txt from the v0.3.3 release (https://github.com/sheeki03/tirith/releases/tag/v0.3.3), extract the sha256 hashes for tirith-x86_64-unknown-linux-gnu.tar.gz and tirith-aarch64-unknown-linux-gnu.tar.gz, and update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 accordingly. There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. The checksums 571e6a3... (amd64) and 0462fe5... (arm64) correspond to v0.3.1 artifacts. The build downloads v0.3.3 tarballs and verifies them against these stale checksums, causing sha256sum -c to fail and the build to abort. This issue was flagged in the prior review and remains unfixed. Suggested fix: Fetch checksums.txt from the v0.3.3 GitHub release at https://github.com/sheeki03/tirith/releases/tag/v0.3.3, extract the sha256 hashes for tirith-x86_64-unknown-linux-gnu.tar.gz and tirith-aarch64-unknown-linux-gnu.tar.gz, and update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 accordingly. There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. The checksums still correspond to v0.3.1 artifacts. The RUN block downloads v0.3.3 tarballs and verifies them against the old v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. The Containerfile's own comments (lines 145-146) document that both the version and checksums must be updated together. This issue was flagged in the prior review and remains unfixed. Suggested fix: Download checksums.txt from the v0.3.3 GitHub release (https://github.com/sheeki03/tirith/releases/tag/v0.3.3), extract the sha256 hashes for tirith-x86_64-unknown-linux-gnu.tar.gz and tirith-aarch64-unknown-linux-gnu.tar.gz, and update TIRITH_SHA256_AMD64 (line 148) and TIRITH_SHA256_ARM64 (line 149) accordingly. There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 were not updated. The checksums still correspond to v0.3.1 artifacts (verified against the v0.3.3 GitHub release). The RUN block downloads v0.3.3 tarballs and verifies them against the stale v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. The Containerfile own comments (lines 145-146) document that both the version and checksums must be updated together. This issue was flagged in the prior review and remains unfixed. Suggested fix: Update the checksum ARGs to the v0.3.3 values from checksums.txt (https://github.com/sheeki03/tirith/releases/tag/v0.3.3): There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. The checksums still correspond to v0.3.1 artifacts. The RUN block downloads v0.3.3 tarballs and verifies them against the stale v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. The Containerfile's own comments (lines 145-146) document that both the version and checksums must be updated together. This issue was flagged in the prior review and remains unfixed. Suggested fix: Update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 to the v0.3.3 values from checksums.txt at https://github.com/sheeki03/tirith/releases/download/v0.3.3/checksums.txt. The prior review identified these as: TIRITH_SHA256_AMD64=6cdbe35e8f9ccf42e70ad95b501c93cd218ac18201c3df958d54f6ba0d995ce2 and TIRITH_SHA256_ARM64=c784233083003a6a1533db9ebba30b1a7bb7cefaa239db6ca121598b384cca1a. Verify these against the release checksums.txt before committing. There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. The checksums still correspond to v0.3.1 artifacts. The RUN block downloads v0.3.3 tarballs and verifies them against the stale v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. The Containerfile's own comments (lines 145–146) document that both the version and checksums must be updated together. This issue was flagged in the prior review and remains unfixed. Suggested fix: Update the checksum ARGs to the v0.3.3 values from checksums.txt at https://github.com/sheeki03/tirith/releases/download/v0.3.3/checksums.txt. The prior review identified these as: TIRITH_SHA256_AMD64=6cdbe35e8f9ccf42e70ad95b501c93cd218ac18201c3df958d54f6ba0d995ce2 TIRITH_SHA256_ARM64=c784233083003a6a1533db9ebba30b1a7bb7cefaa239db6ca121598b384cca1a There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. The checksums still correspond to v0.3.1 artifacts. The RUN block downloads v0.3.3 tarballs and verifies them against the stale v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. The Containerfile's own comments (lines 145-146) document that both the version and checksums must be updated together. This issue was flagged in the prior review and remains unfixed. Suggested fix: Update the checksum ARGs to the v0.3.3 values from the checksums.txt in the GitHub release: https://github.com/sheeki03/tirith/releases/download/v0.3.3/checksums.txt There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64) were not updated. The checksums still correspond to v0.3.1 artifacts. The RUN block downloads v0.3.3 tarballs and verifies them against the stale v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. This issue was flagged in the prior review and remains unfixed. Suggested fix: Update the checksum ARGs to the v0.3.3 values from checksums.txt at https://github.com/sheeki03/tirith/releases/download/v0.3.3/checksums.txt. There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 on line 148 and TIRITH_SHA256_ARM64 on line 149) were not updated. The RUN block downloads v0.3.3 tarballs and verifies them against the stale v0.3.1 hashes, so sha256sum -c will fail and the container build will abort. This is a known Renovate limitation — the regex manager only captures the version string, and automerge is explicitly disabled for tirith because checksums must be updated manually. This issue was flagged in the prior review and remains unfixed. Suggested fix: Download the checksums.txt from the v0.3.3 GitHub release (https://github.com/sheeki03/tirith/releases/download/v0.3.3/checksums.txt) and update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 to the sha256 hashes of tirith-x86_64-unknown-linux-gnu.tar.gz and tirith-aarch64-unknown-linux-gnu.tar.gz respectively. There was a problem hiding this comment. [high] checksum mismatch TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums (TIRITH_SHA256_AMD64 on line 148 and TIRITH_SHA256_ARM64 on line 149) were not updated. They still contain the v0.3.1 hashes. The RUN block downloads v0.3.3 tarballs and verifies them with sha256sum -c against these stale hashes, so the container build will unconditionally fail. This issue was flagged in the prior review and remains unfixed. Suggested fix: Fetch the v0.3.3 checksums from https://github.com/sheeki03/tirith/releases/download/v0.3.3/checksums.txt and update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 on lines 148-149 to the correct values for the x86_64 and aarch64 tarballs respectively. |
||
| ARG TIRITH_SHA256_ARM64=0462fe5083b4c72c45a8de918d5413e21d17aa8077aa7dbe53c0876b112847bb | ||
| RUN case "$TARGETARCH" in \ | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[high] supply-chain integrity
TIRITH_VERSION was bumped from 0.3.1 to 0.3.3 but the SHA256 checksums for both amd64 (line 148) and arm64 (line 149) were not updated. The checksums still correspond to v0.3.1 binaries. The build will fail at the sha256sum -c step because the downloaded v0.3.3 tarball will not match the stale hash. The inline comment on lines 145-146 documents the required procedure: bump both TIRITH_VERSION and TIRITH_SHA256_{AMD64,ARM64} together from the release's checksums.txt.
Suggested fix: Update TIRITH_SHA256_AMD64 and TIRITH_SHA256_ARM64 to the correct checksums from the v0.3.3 release's checksums.txt at https://github.com/sheeki03/tirith/releases/tag/v0.3.3.