CI: Build linux binaries using ubuntu 20-04 and add vulnerabilities check #1043
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Alenar
changed the title
Alenar
force-pushed
the
djo/874-1037/ci-ubuntu.20-04.build-add-vulnerabilities-check
branch
2 times, most recently
from
0df0ad7 to
3675535
Compare
The goal of this is to have binaries that depends on earlier version of glibc to be compatible with more systems. Using 22.04 (libc 2.35) we are compatible with debian Bookworm (12, libc 2.36.9) minimum, the latest version released. Using 20.04 (libc 2.31) we are also compatible with debian Bulleye (11, libc 2.31.13).
Alenar
force-pushed
the
djo/874-1037/ci-ubuntu.20-04.build-add-vulnerabilities-check
branch
from
3675535 to
7e38bbf
Compare
Alenar
commented
Jul 11, 2023
| @@ -4,10 +4,13 @@ hide_title: true | |||
| hide_table_of_contents: true | |||
| --- | |||
|
|
|||
| ## Download compiled binary | |||
There was a problem hiding this comment.
Sadly this title did not show in the sidebars (and it's level wasn't always appropriate) so I had to remove it from this common file to put it manually each time this file is used.
Alenar
force-pushed
the
djo/874-1037/ci-ubuntu.20-04.build-add-vulnerabilities-check
branch
from
aa817e1 to
288f9fc
Compare
ghubertpalo
reviewed
Jul 11, 2023
| @@ -37,7 +29,7 @@ RUN /app/target/release/mithril-aggregator --version | |||
| ############################### | |||
| # STEP 2: build a small image | |||
| ############################### | |||
| FROM ubuntu:22.04 | |||
| FROM debian:11-slim | |||
There was a problem hiding this comment.
why isn't the ubuntu-20.04 image used (the same as the CI)?
There was a problem hiding this comment.
Two reasons:
- I want to use debian in the dockerfiles as "compatibility test" to check that our ubuntu 20.04 built binaries are compatible with a later version of debian.
- this allow for the "dev" dockerfiles (the one without the
.cisuffix) to use the rust builder images that are debian based, allowing a simplification of the builder step.
ghubertpalo
approved these changes
Jul 11, 2023
jpraynaud
approved these changes
Jul 11, 2023
Already done locally using debian 11 as the image base and the binaries built by this branch CI :). |
In order to not collide with previous cache that are based on a ubuntu 22.04 since we are now building with 20.04.
Since it's now bundled alongside our binaries
Alenar
force-pushed
the
djo/874-1037/ci-ubuntu.20-04.build-add-vulnerabilities-check
branch
from
288f9fc to
8b7eb3c
Compare
Alenar
deleted the
djo/874-1037/ci-ubuntu.20-04.build-add-vulnerabilities-check
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Content
This PR changes the ubuntu version used to build the linux binaries in order to depends on a earlier version of glibc (2.31 instead of 2.35) to be compatible with more systems.
The minimum required version is now stated in the documentation.
It also add the dependency-review action to our check step.
Pre-submit checklist
Comments
This PR also update the documentation regarding the fact that sqlite is not required anymore to build & run the binaries (see #837).
Issue(s)
Closes #874, Closes #1037, Relates to #834 and #837