Conversation
jmthomas
requested review from
EmilyRagan,
clayandgen,
mcosgriff,
ryan-pratt and
ryanmelt
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2486 +/- ##
==========================================
- Coverage 79.66% 79.65% -0.01%
==========================================
Files 658 658
Lines 50418 50420 +2
Branches 736 736
==========================================
- Hits 40163 40160 -3
- Misses 10175 10180 +5
Partials 80 80
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| COPY --chown=1001 minio-${OPENC3_MINIO_RELEASE}.tar.gz /go/minio.tar.gz | ||
| RUN tar -xzf minio.tar.gz --strip-components=1 && \ |
There was a problem hiding this comment.
Including a .tar.gz in the repo doesn't make me feel great. Could we instead do ADD https://github.com/minio/minio/archive/refs/tags/${OPENC3_MINIO_RELEASE}.tar.gz ./? (Maybe ./ is wrong, but) ADD will download the file and untar it
Our build process doesn't work offline anyway
|
Please undo the ADD. Hard links like that break builds in offline environments |
As @ryan-pratt said, we can't build in a completely offline env anyway. Although some offline envs like to mirror the big package repos (npm, rubygems, etc) but would fail for an individual link like this. |
|
This change will break the ci/cd builds in a program you are on. Undo. |
This reverts commit feea269.
|
|
We should have something in our CI pipeline that verifies the integrity of this file, then. A tar file in the repo is a very easy attack surface |
Not sure how to "verify" a tar file. They don't give any hash information. We control the file and I have added to the update script a flag about when we need to update this. |
3 participants
No description provided.