v1.4.8-testnet #74
v1.4.8-testnet #74
Conversation
WalkthroughThe Dockerfile was updated to install Cronos version 1.4.8-testnet instead of the previous 1.4.7 release. This involved changing the download URL, tarball filename, and related extraction commands to reference the new version. No other installation or configuration steps were altered. Changes
Sequence Diagram(s)sequenceDiagram
participant Dockerfile
participant Cronos Source Server
Dockerfile->>Cronos Source Server: Download cronos_1.4.8-testnet_Linux_x86_64.tar.gz
Dockerfile->>Dockerfile: Extract tarball
Dockerfile->>Dockerfile: Move binary to destination
Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
Dockerfile (1)
7-8: Consider parameterising the version with a build‐time ARGHard-coding the version requires editing the Dockerfile for every upgrade. Introducing an ARG improves maintainability:
ARG CRONOS_VERSION=1.4.8-testnet RUN cd /tmp \ && wget -q https://github.com/crypto-org-chain/cronos/releases/download/v${CRONOS_VERSION}/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz \ ...
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: guardrails/scan
Dockerfile
Outdated
| @@ -4,8 +4,8 @@ RUN adduser --disabled-password --gecos "" --no-create-home --uid 1000 cronos | |||
|
|
|||
| RUN mkdir -p /home/cronos/data && mkdir -p /home/cronos/config | |||
| RUN apt-get update -y && apt-get install wget curl procps net-tools jq lz4 -y | |||
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.7_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.7_Linux_x86_64.tar.gz \ | |||
| && rm cronos_1.4.7_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | |||
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | |||
There was a problem hiding this comment.
--no-check-certificate disables TLS verification
Disabling certificate checks defeats HTTPS and exposes the supply-chain to MITM attacks. Remove the flag and, ideally, verify a SHA-256 checksum or GPG signature instead.
-wget --no-check-certificate https://github.com/crypto-org-chain/…
+wget -q https://github.com/crypto-org-chain/…
+# OPTIONAL: echo "<sha256> cronos_1.4.8-testnet_Linux_x86_64.tar.gz" | sha256sum -c -📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | |
| RUN cd /tmp && \ | |
| wget -q https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && \ | |
| # OPTIONAL: echo "<sha256> cronos_1.4.8-testnet_Linux_x86_64.tar.gz" | sha256sum -c - && \ | |
| tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile at line 7, remove the --no-check-certificate flag from the wget
command to re-enable TLS verification. Additionally, after downloading the file,
add a step to verify its integrity by checking the SHA-256 checksum or
validating a GPG signature before extracting the archive. This ensures the
downloaded file is authentic and secure.
Download URL points to old tag ‒ build will 404
The path still uses releases/download/v1.4.7/…1.4.8-testnet….
Because GitHub release assets are nested under the matching tag, the image will fail at build time with 404: Not Found.
-https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.8-testnet_Linux_x86_64.tar.gz
+https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8-testnet/cronos_1.4.8-testnet_Linux_x86_64.tar.gz📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | |
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8-testnet/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile at line 7, the download URL uses the old tag v1.4.7 while trying
to fetch a v1.4.8-testnet asset, causing a 404 error. Update the URL path to use
the correct tag v1.4.8 so the release asset matches the tag and the build can
successfully download the file.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.7_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.7_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.7_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | ||
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.7/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Wildcard mv ./* may relocate unrelated /tmp files
After extraction, mv ./* /home/cronos/ moves everything currently in /tmp, which can unintentionally include unrelated temporary artefacts. Limit the move to the extracted directory contents:
-&& rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+&& rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz \
+&& mv cronos_1.4.8-testnet_Linux_x86_64/* /home/cronos/ \
+&& rmdir cronos_1.4.8-testnet_Linux_x86_64📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | |
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | |
| && mv cronos_1.4.8-testnet_Linux_x86_64/* /home/cronos/ \ | |
| && rmdir cronos_1.4.8-testnet_Linux_x86_64 |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In Dockerfile at line 8, the command `mv ./* /home/cronos/` moves all files in
the current directory, which may include unrelated temporary files. Modify this
to move only the extracted directory or specific extracted files by replacing
the wildcard with the exact extracted folder name or pattern to avoid moving
unrelated files.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (3)
Dockerfile (3)
7-7: Download URL still points to the wrong tag – will 404 at build timeThe asset is published under
v1.4.8-testnet, but the path usesv1.4.8. Update the tag or the build will fail.-wget .../releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz +wget .../releases/download/v1.4.8-testnet/cronos_1.4.8-testnet_Linux_x86_64.tar.gz
7-7:--no-check-certificatedisables TLS verification – remove itKeeping this flag defeats HTTPS and re-opens the supply chain to MITM. Drop the flag and add a SHA-256 or GPG check instead.
8-8: Wildcardmv ./*moves unrelated files and leaves nested dirMoving everything from
/tmpcan grab other artefacts and results in/home/cronos/cronos_1.4.8-testnet_Linux_x86_64/, while the image expects/home/cronos/bin/…. Restrict the move:-&& mv ./* /home/cronos/ +&& mv cronos_1.4.8-testnet_Linux_x86_64/* /home/cronos/ \ +&& rmdir cronos_1.4.8-testnet_Linux_x86_64
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: guardrails/scan
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | ||
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ |
There was a problem hiding this comment.
🛠️ Refactor suggestion
ENTRYPOINT path mismatch – container may not start
With the corrected move, cronosd ends up in /home/cronos/ (or in bin/ depending on tar layout). Align one of the two:
-ENTRYPOINT ["/home/cronos/bin/cronosd"]
+ENTRYPOINT ["/home/cronos/cronosd"]
# or preserve hierarchy:
+# RUN mv cronos_1.4.8-testnet_Linux_x86_64/bin/* /home/cronos/bin/📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz \ | |
| && rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz && mv ./* /home/cronos/ | |
| # unchanged download & extraction step | |
| RUN cd /tmp && \ | |
| wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.8/cronos_1.4.8-testnet_Linux_x86_64.tar.gz && \ | |
| tar -xvf cronos_1.4.8-testnet_Linux_x86_64.tar.gz && \ | |
| rm cronos_1.4.8-testnet_Linux_x86_64.tar.gz && \ | |
| mv ./* /home/cronos/ | |
| # adjust ENTRYPOINT to match the moved binary | |
| ENTRYPOINT ["/home/cronos/cronosd"] |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 7-8: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🤖 Prompt for AI Agents
In the Dockerfile around lines 7 to 8, the RUN command moves extracted files to
/home/cronos/, but the ENTRYPOINT path likely points elsewhere causing container
startup issues. To fix this, verify where the cronosd binary is located after
extraction (either directly in /home/cronos/ or in a subdirectory like bin/) and
update the ENTRYPOINT path accordingly to match that location, ensuring the
container can start correctly.
Summary by CodeRabbit