mirror of
https://github.com/coollabsio/coolify.git
synced 2026-10-28 17:44:36 +08:00
Andras BacsaiandClaude Opus 5.5
1e4431f53d
Pin every helper download by SHA256 and the base images by digest, drop the curl | bash installers, and add scripts/helper-checksums to refresh the checksums. Update Alpine to 3.24, Docker CLI 29.9.2, Compose 5.6.1, Buildx 0.38.1, pack 0.40.10, Railpack 0.43.0, and mise 2026.10.14. Bump the helper to 1.0.19. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
3.7 KiB
Bash
Executable File
86 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Update the SHA256SUMS block in docker/coolify-helper/Dockerfile.
|
|
# Change the ARG versions in the Dockerfile first, then run this script.
|
|
# It downloads every file, compares it with the upstream checksum file where one exists, and writes the new block.
|
|
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
DOCKERFILE="$ROOT_DIR/docker/coolify-helper/Dockerfile"
|
|
GH=https://github.com
|
|
|
|
arg() {
|
|
sed -n "s/^ARG $1=//p" "$DOCKERFILE"
|
|
}
|
|
|
|
DOCKER_VERSION=$(arg DOCKER_VERSION)
|
|
DOCKER_COMPOSE_VERSION=$(arg DOCKER_COMPOSE_VERSION)
|
|
DOCKER_BUILDX_VERSION=$(arg DOCKER_BUILDX_VERSION)
|
|
PACK_VERSION=$(arg PACK_VERSION)
|
|
NIXPACKS_VERSION=$(arg NIXPACKS_VERSION)
|
|
RAILPACK_VERSION=$(arg RAILPACK_VERSION)
|
|
MISE_VERSION=$(arg MISE_VERSION)
|
|
|
|
railpack_mise=$(curl -fsSL "https://raw.githubusercontent.com/railwayapp/railpack/v${RAILPACK_VERSION}/core/mise/version.txt")
|
|
if [[ $railpack_mise != "$MISE_VERSION" ]]; then
|
|
echo "MISE_VERSION is $MISE_VERSION, but Railpack $RAILPACK_VERSION pins mise $railpack_mise." >&2
|
|
exit 1
|
|
fi
|
|
|
|
WORK_DIR=$(mktemp -d)
|
|
trap 'rm -rf "$WORK_DIR"' EXIT
|
|
|
|
lines=()
|
|
|
|
# add <name> <url> [upstream checksum file URL]
|
|
add() {
|
|
local name=$1 url=$2 sums_url=${3:-} sum upstream
|
|
curl -fsSL --proto '=https' --tlsv1.2 --retry 3 -o "$WORK_DIR/$name" "$url"
|
|
sum=$(sha256sum "$WORK_DIR/$name" | cut -d' ' -f1)
|
|
|
|
if [[ -n $sums_url ]]; then
|
|
upstream=$(curl -fsSL "$sums_url" | grep -F "${url##*/}" | awk '{print $1}' | head -1)
|
|
if [[ $upstream != "$sum" ]]; then
|
|
echo "Checksum mismatch for $url (upstream: ${upstream:-not found}, downloaded: $sum)." >&2
|
|
exit 1
|
|
fi
|
|
echo "verified $name"
|
|
else
|
|
echo "no upstream checksum $name"
|
|
fi
|
|
|
|
lines+=("$sum $name")
|
|
}
|
|
|
|
for arch in amd64 arm64; do
|
|
case $arch in
|
|
amd64) DOCKER_ARCH=x86_64; PACK_SUFFIX=""; NIXPACKS_ARCH=x86_64; RAILPACK_ARCH=x86_64; MISE_ARCH=x64 ;;
|
|
arm64) DOCKER_ARCH=aarch64; PACK_SUFFIX="-arm64"; NIXPACKS_ARCH=aarch64; RAILPACK_ARCH=arm64; MISE_ARCH=arm64 ;;
|
|
esac
|
|
|
|
add "docker-$arch.tgz" \
|
|
"https://download.docker.com/linux/static/stable/$DOCKER_ARCH/docker-$DOCKER_VERSION.tgz"
|
|
add "docker-compose-$arch" \
|
|
"$GH/docker/compose/releases/download/v$DOCKER_COMPOSE_VERSION/docker-compose-linux-$DOCKER_ARCH" \
|
|
"$GH/docker/compose/releases/download/v$DOCKER_COMPOSE_VERSION/checksums.txt"
|
|
add "docker-buildx-$arch" \
|
|
"$GH/docker/buildx/releases/download/v$DOCKER_BUILDX_VERSION/buildx-v$DOCKER_BUILDX_VERSION.linux-$arch" \
|
|
"$GH/docker/buildx/releases/download/v$DOCKER_BUILDX_VERSION/checksums.txt"
|
|
add "pack-$arch.tgz" \
|
|
"$GH/buildpacks/pack/releases/download/v$PACK_VERSION/pack-v$PACK_VERSION-linux$PACK_SUFFIX.tgz" \
|
|
"$GH/buildpacks/pack/releases/download/v$PACK_VERSION/pack-v$PACK_VERSION-linux$PACK_SUFFIX.tgz.sha256"
|
|
add "nixpacks-$arch.tgz" \
|
|
"$GH/railwayapp/nixpacks/releases/download/v$NIXPACKS_VERSION/nixpacks-v$NIXPACKS_VERSION-$NIXPACKS_ARCH-unknown-linux-musl.tar.gz"
|
|
add "railpack-$arch.tgz" \
|
|
"$GH/railwayapp/railpack/releases/download/v$RAILPACK_VERSION/railpack-v$RAILPACK_VERSION-$RAILPACK_ARCH-unknown-linux-musl.tar.gz" \
|
|
"$GH/railwayapp/railpack/releases/download/v$RAILPACK_VERSION/checksums.txt"
|
|
add "mise-$arch" \
|
|
"$GH/jdx/mise/releases/download/v$MISE_VERSION/mise-v$MISE_VERSION-linux-$MISE_ARCH-musl" \
|
|
"$GH/jdx/mise/releases/download/v$MISE_VERSION/SHASUMS256.txt"
|
|
done
|
|
|
|
block=$(printf '%s\n' "${lines[@]}" | sort -k2)
|
|
BLOCK="$block" perl -0pi -e 's/(COPY <<.EOF. \/tmp\/SHA256SUMS\n).*?(\nEOF\n)/$1$ENV{BLOCK}$2/s' "$DOCKERFILE"
|
|
|
|
echo "Updated SHA256SUMS in $DOCKERFILE"
|