If a digest SHA is used in a Dockerfile, PRs are not superseded when newer SHAs are created #7387
Comments
|
We observed the same problem. After removal of the tag dependabot even fails with error (see zalando/skipper#2546) The Dockerfile docs https://docs.docker.com/engine/reference/builder/#from allow: forms. Dependabot neither supports undocumented (see moby/moby#37866) |
Dependabot fails to update registry.opensource.zalan.do/library/alpine-3 base image hash, see dependabot/dependabot-core#7387 This change * removes image hash and re-introduces latest label. For multiarch and ghcr.io builds base image is specified via BASE_IMAGE build argument and also uses latest label. * uses COPY instead of ADD following https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#add-or-copy * prints alpine release version during build * removes redundant commands * does not touch Dockerfile.arm64 and Dockerfile.armv7 - they are almost identical to Dockerfile and we may unify and use a single Dockerfile for all builds later. Followup on #2546 Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
Dependabot fails to update registry.opensource.zalan.do/library/alpine-3 base image hash, see dependabot/dependabot-core#7387 This change removes image hash and re-introduces latest label. For multiarch and ghcr.io builds base image is specified via BASE_IMAGE build argument and also uses latest label. Followup on #2546 Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
Dependabot fails to update registry.opensource.zalan.do/library/alpine-3 base image hash, see dependabot/dependabot-core#7387 This change removes image hash and re-introduces latest label. For multiarch and ghcr.io builds base image is specified via BASE_IMAGE build argument and also uses latest label. Followup on #2546 Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
Dependabot fails to update registry.opensource.zalan.do/library/alpine-3 base image hash, see dependabot/dependabot-core#7387 This change removes image hash and re-introduces latest label. For multiarch and ghcr.io builds base image is specified via BASE_IMAGE build argument and also uses latest label. Followup on #2546 Signed-off-by: Alexander Yastrebov <alexander.yastrebov@zalando.de>
|
@cp-fabian-pittroff when attempting to run Dependabot on your sample repo, it seems to update correctly for me: Could it maybe have been resolved since this issue was opened? @AlexanderYastrebov what's the best way to reproduce the issue you were running into, is there a specific sha in the repo you referenced that I can check? |
|
@jurre Hello. It failed on FROM registry.opensource.zalan.do/library/alpine-3@sha256:2213d4d74c39af5313b631cbde2630b4007755b280f0f6b98867f66103b76113 AS defaultNote that we attempted to remove tag (and only use hash) within zalando/skipper#2546 because dependabot stopped updating hash and said that "Pull request already exists for library/alpine-3 with latest version latest": |
|
Hello @jurre I manually triggered a dependabot rebase and the sha got updated. But the scheduled update with dependabot doesn't update the pr: Now the current latest sha is: 6681332e3f616b2610f582ef8ec345d116d914c0deb76a8e419d9e970aacea15 
In 2-3 hours the docker sha should be changed again and also the pr should update with the next dependabot schedule. I'll report back after the next docker sha change. |
|
Hello, sha changed to 044c5c03c0d8aeb0a9e510dd4c57e6392409cb45a0ded6734fe9d8ac540b36f7. Triggered dependabot schedule update, same log and no updated pr. |
|
Any updates on a potential repro for this? |
|
@deivid-rodriguez I think #7387 (comment) has all information and references a PR that shows the problem. If you need more let us know. |
|
After a closer look, my PR only fixes the last error you mentioned, but I don't think it will fix the original issue. My understanding is that the original issue is that, when pinned to a SHA reference, Dependabot is able to create an initial PR, but then subsequent scheduled runs won't update the initial PR with newer SHAs like it happens with regular version updates. I think that's still an issue. You can workaround it as mentioned above with Something I'm not clear about is that, according to my investigation, the last error mentioned happened due to |
|
Would it help if I update the provided repository with a ci workflow, to manually update a docker image? Recreating the PR or merging it works. |
deivid-rodriguez
changed the title
|
@deivid-rodriguez I am not sure if you can access https://github.com/zalando/skipper/security/code-scanning/117 , but if so the reason why not to use "latest" tag is because OpenSSF scorecard says we should "pin by hash" and not use "latest" tag. Here a picture of the recommendation: |
|
I can't access that but my point was not to advice not using "latest" as the consumer of the image, but that under my testing, the "latest" label for the |
|
So, to try better explain the problem. While https://registry.opensource.zalan.do/v2/library/alpine-3/tags/list does not list "latest", the "latest" tag does exist as per https://registry.opensource.zalan.do/v2/library/alpine-3/manifests/latest. This confuses dependabot. If I completely remove the line that checks whether the "latest" tag is listed: diff --git a/docker/lib/dependabot/docker/update_checker.rb b/docker/lib/dependabot/docker/update_checker.rb
index 91fddf714..e831bca37 100644
--- a/docker/lib/dependabot/docker/update_checker.rb
+++ b/docker/lib/dependabot/docker/update_checker.rb
@@ -214,8 +214,6 @@ module Dependabot
end
def latest_digest
- return unless tags_from_registry.map(&:name).include?("latest")
-
digest_of("latest")
endthen the update succeeds just fine. Regardless of this, I suspect the issue original reported here (and the one the title currently describes) is a separate issue, independent from the registry implementation. |
|
@deivid-rodriguez my and @AlexanderYastrebov problem is that we would like to use pinned hash, not latest. |
|
Are you able to get a PR bumping the pinned hash at all? I assume not for the @cp-fabian-pittroff can get PRs bumping pinned hashes, but once a PR is created is not updated or superseded with newer hashes. |
That is correct. I have a combination of tag and pinned hash (nginx:stable-alpine@sha256:fc9b8c25953467e406a95ab7b65cbfa9f56b6f24cffcd5ba07b30c2d388490b6). With the example, I would expect dependabot to search for stable-alpine and figure out if there is another sha associated with it. Without a tag, dependabot can't really decide what the desired update target should be, can it? So from my point of view, there are only two options:
Unfortunately docker doesn't provide more information about a pinned image (RepoTags are empty). docker inspect...
docker image inspect nginx@sha256:fc9b8c25953467e406a95ab7b65cbfa9f56b6f24cffcd5ba07b30c2d388490b6
[
{
"Id": "sha256:6dae3976ee053bb83177d82f6d05d91d669423bab48a9db94805e0b7808065c5",
"RepoTags": [],
"RepoDigests": [
"nginx@sha256:fc9b8c25953467e406a95ab7b65cbfa9f56b6f24cffcd5ba07b30c2d388490b6"
],
"Parent": "",
"Comment": "",
"Created": "2023-08-09T02:16:04.742143271Z",
"Container": "2c525ecdd2ce275fc8fcbb28650a821965558907fee45bae682fffb7bb0c4594",
"ContainerConfig": {
"Hostname": "",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": {
"80/tcp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NGINX_VERSION=1.24.0",
"PKG_RELEASE=1",
"NJS_VERSION=0.7.12"
],
"Cmd": [
"/bin/sh",
"-c",
"set -x && apkArch=\"$(cat /etc/apk/arch)\" && nginxPackages=\" nginx=${NGINX_VERSION}-r${PKG_RELEASE} nginx-module-xslt=${NGINX_VERSION}-r${PKG_RELEASE} nginx-module-geoip=${NGINX_VERSION}-r${PKG_RELEASE} nginx-module-image-filter=${NGINX_VERSION}-r${PKG_RELEASE} nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${PKG_RELEASE} \" && apk add --no-cache --virtual .checksum-deps openssl && case \"$apkArch\" in x86_64|aarch64) set -x && KEY_SHA512=\"e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655\" && wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub && if echo \"$KEY_SHA512 */tmp/nginx_signing.rsa.pub\" | sha512sum -c -; then echo \"key verification succeeded!\"; mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; else echo \"key verification failed!\"; exit 1; fi && apk add -X \"https://nginx.org/packages/alpine/v$(egrep -o '^[0-9]+\\.[0-9]+' /etc/alpine-release)/main\" --no-cache $nginxPackages ;; *) set -x && tempDir=\"$(mktemp -d)\" && chown nobody:nobody $tempDir && apk add --no-cache --virtual .build-deps gcc libc-dev make openssl-dev pcre2-dev zlib-dev linux-headers libxslt-dev gd-dev geoip-dev libedit-dev bash alpine-sdk findutils && su nobody -s /bin/sh -c \" export HOME=${tempDir} && cd ${tempDir} && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz && PKGOSSCHECKSUM=\\\"dc47dbaeb1c0874b264d34ddfec40e7d2b814e7db48d144e12d5991c743ef5fcf780ecbab72324e562dd84bb9c0e4dd71d14850b20ceaf470c46f8fe7510275b *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\\\" && if [ \\\"\\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\\\" = \\\"\\$PKGOSSCHECKSUM\\\" ]; then echo \\\"pkg-oss tarball checksum verification succeeded!\\\"; else echo \\\"pkg-oss tarball checksum verification failed!\\\"; exit 1; fi && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} && cd alpine && make module-geoip module-image-filter module-njs module-xslt && apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \" && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ && apk del .build-deps && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages ;; esac && apk del .checksum-deps && if [ -n \"$tempDir\" ]; then rm -rf \"$tempDir\"; fi && if [ -n \"/etc/apk/keys/abuild-key.rsa.pub\" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi && if [ -n \"/etc/apk/keys/nginx_signing.rsa.pub\" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi && apk add --no-cache curl ca-certificates"
],
"Image": "sha256:90751f73663d6fc8df8afc448d7d65eaddd4c815176a4738891ad948fa4d5f62",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": null,
"OnBuild": null,
"Labels": {
"maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>"
},
"StopSignal": "SIGQUIT"
},
"DockerVersion": "20.10.23",
"Author": "",
"Config": {
"Hostname": "",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"ExposedPorts": {
"80/tcp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NGINX_VERSION=1.24.0",
"PKG_RELEASE=1",
"NJS_VERSION=0.7.12"
],
"Cmd": [
"nginx",
"-g",
"daemon off;"
],
"Image": "sha256:90751f73663d6fc8df8afc448d7d65eaddd4c815176a4738891ad948fa4d5f62",
"Volumes": null,
"WorkingDir": "",
"Entrypoint": [
"/docker-entrypoint.sh"
],
"OnBuild": null,
"Labels": {
"maintainer": "NGINX Docker Maintainers <docker-maint@nginx.com>"
},
"StopSignal": "SIGQUIT"
},
"Architecture": "amd64",
"Os": "linux",
"Size": 41111276,
"VirtualSize": 41111276,
"GraphDriver": {
"Data": {
"LowerDir": "/var/lib/docker/overlay2/25e5b92b8de9804d2ee5e5b20149bd6baa6ad225614cbc22a535d75c98220543/diff:/var/lib/docker/overlay2/e0bcb5fb8198eb72cb27e9d48e8d1dce0796a769c2a5f21453ecea9091497866/diff:/var/lib/docker/overlay2/0eefeec894cc90d2ba5e030bca61f188806c71415b6f1c41b20095054c8f4817/diff:/var/lib/docker/overlay2/e00b71a2a5d74a8ddac531808b8fe41dab094314619e0bbedc92125f312c23be/diff:/var/lib/docker/overlay2/648c56736d8f9c1ccea7d8bb1cb911665125a00c3642aa61d63fc41d10c7e6ea/diff:/var/lib/docker/overlay2/a860c0e9e194db3c4f049bea0e3387e2f1f707eea2aae71c9e8cd3677772bfc2/diff",
"MergedDir": "/var/lib/docker/overlay2/c69f82298e2d2efdb8653a6beff36879fe8c357bddb8429f4fc92203d58886c6/merged",
"UpperDir": "/var/lib/docker/overlay2/c69f82298e2d2efdb8653a6beff36879fe8c357bddb8429f4fc92203d58886c6/diff",
"WorkDir": "/var/lib/docker/overlay2/c69f82298e2d2efdb8653a6beff36879fe8c357bddb8429f4fc92203d58886c6/work"
},
"Name": "overlay2"
},
"RootFS": {
"Type": "layers",
"Layers": [
"sha256:36b50b131297b8860da51b2d2b24bb4c08dfbdf2789b08e3cc0f187c98637a19",
"sha256:57b608dd7b54de578dfd642a64f3fdd97382b9e6f64048f2e2d2f2f0b5fba106",
"sha256:9c01e5b3bd66a2fa68d3fc86561e62bee7ac4ba0d48cca885118946ba066d21f",
"sha256:bb0903fd6f90dc5fa5718236a89f8df7a415a61a595254bb266691c3b1a6d25c",
"sha256:4c6a1307a10bbd3f947505ba405d43a04e97f1fe5fd23c01a36534cc4f5ca3b0",
"sha256:2b60bbe779e0616bf50d09b65ce80914ced19ea227d90c81b73bd4d63d3b227b",
"sha256:194b12cb5e855dd336c7aacf8cb6e9475d9795676ef37b589a62bccc50c757fe"
]
},
"Metadata": {
"LastTagTime": "0001-01-01T00:00:00Z"
}
}
] |
|
Yes, we currently fallback to the latest tag. The problem is that when checking if a PR is already opened for the latest version, we don't seem to consider SHAs, that's why you won't get the PR superseded with another PR when there's a newer SHA available. |
In such case tag is ignored, see moby/moby#37866 |
|
FYI: we got an update zalando/skipper#2635 |
|
Yes. Your problem is specific to the |
Is there an existing issue for this?
Package ecosystem
Docker
Package manager version
n/a
Language version
n/a
Manifest location and content before the Dependabot update
FROM steamcmd/steamcmd:ubuntu-22@sha256:091eb51de70e22deacb316671f90d526e253721d391138df82c5541ced75c2f9dependabot.yml content
Updated dependency
FROM steamcmd/steamcmd:ubuntu-22@sha256:04e690a1c1b15e808967a0a7f243f0ce3833df872a2cbb45efb2b980edf4aaaaWhat you expected to see, versus what you actually saw
I would expect that the previous pr gets updated with the new SHA-digest of the newest available docker image.
The pr doesn't get an update. If the pr gets created, it works (fixed with this issue: #6150)
Note: the steamcmd/steamcmd image gets an update every 6 hours.
Native package manager behavior
n/a
Images of the diff or a link to the PR, issue, or logs
Dependabot Output:
Smallest manifest that reproduces the issue
https://github.com/cp-fabian-pittroff/dependabot-docker-sha-digest-pr-update-issue
The text was updated successfully, but these errors were encountered: