Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docker: Update ossfuzz docker image #11938

Merged
merged 4 commits into from
Sep 15, 2021
Merged

Docker: Update ossfuzz docker image #11938

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3e86598
Docker: Update ossfuzz docker image to pull in clang-14.
bshastry Sep 13, 2021
08a7eac
Upgrade python pip and sphinx
bshastry Sep 13, 2021
479cd33
Update scripts/docker/buildpack-deps/Dockerfile.ubuntu1604.clang.ossfuzz
bshastry Sep 15, 2021
9a8fc60
Update scripts/docker/buildpack-deps/Dockerfile.ubuntu1604.clang.ossfuzz
bshastry Sep 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions scripts/docker/buildpack-deps/Dockerfile.ubuntu1604.clang.ossfuzz
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,10 @@
# You should have received a copy of the GNU General Public License
# along with solidity. If not, see <http://www.gnu.org/licenses/>
#
# (c) 2016-2019 solidity contributors.
# (c) 2016-2021 solidity contributors.
#------------------------------------------------------------------------------
FROM gcr.io/oss-fuzz-base/base-clang as base
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this pulls latest base-clang because there's no tag used here? I think we should use a tag with a specific version - to prevent this layer from being taken from cache when we want version to change and also to make it obvious that we're relying on a specific version that should be bumped from time to time.

Copy link
Contributor Author

@bshastry bshastry Sep 15, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good point. I notice that Google uses the tag latest to refer to the most recent base-clang image. I'm not sure why if pull by tag, even the tag is cached or if the newer tag is fetched.

FROM gcr.io/oss-fuzz-base/base-clang:latest as base

So, if the latest one month later points to an image with a different digest, the change may not be fetched (or reflected in the dockerfile).

As a solution to make it explicit we rely on a specific version, we could pull by digest. Pulling the current digest would look like

FROM gcr.io/oss-fuzz-base/base-clang@sha256:a964dcd3a66bd3898e82869c720a74553d7fe77cfa5d0b87618d59ec7d4f0314 as base

List of base-clang images hosted by Google here: https://console.cloud.google.com/gcr/images/oss-fuzz-base/GLOBAL/base-clang

Notice that they are updated almost on a daily basis!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, looks like they are not tagging them with versions.

I think that our CI builds without cache so it's not a big issue. Might be a bigger one if image was meant to be built locally. The bigger problem for me is that the base image really gets updated on any modification to the Dockerfile but it's not very obvious. It gets updated even if you just bump the version. Hard-coding a hash is not great because it's tedious to update and it does not really tell you what you are updating to. So I guess not much we can do here unless Google decides to start tagging it.

In this case I think I'd just add latest to make this more obvious.

LABEL version="11"
LABEL version="12"

ARG DEBIAN_FRONTEND=noninteractive

Expand All @@ -33,12 +33,13 @@ RUN apt-get update; \
ninja-build git wget \
libbz2-dev zlib1g-dev git curl uuid-dev \
pkg-config openjdk-8-jdk liblzma-dev unzip mlton m4; \
apt-get install -qy python-pip python-sphinx;
apt-get install -qy python3-pip;

# Install cmake 3.14 (minimum requirement is cmake 3.10)
RUN wget https://github.com/Kitware/CMake/releases/download/v3.14.5/cmake-3.14.5-Linux-x86_64.sh; \
chmod +x cmake-3.14.5-Linux-x86_64.sh; \
./cmake-3.14.5-Linux-x86_64.sh --skip-license --prefix="/usr"
# Install cmake 3.21.2 (minimum requirement is cmake 3.10)
RUN wget https://github.com/Kitware/CMake/releases/download/v3.21.2/cmake-3.21.2-Linux-x86_64.sh; \
test "$(sha256sum cmake-3.21.2-Linux-x86_64.sh)" = "3310362c6fe4d4b2dc00823835f3d4a7171bbd73deb7d059738494761f1c908c cmake-3.21.2-Linux-x86_64.sh"; \
chmod +x cmake-3.21.2-Linux-x86_64.sh; \
./cmake-3.21.2-Linux-x86_64.sh --skip-license --prefix="/usr"

FROM base AS libraries

Expand Down Expand Up @@ -92,7 +93,7 @@ RUN set -ex; \
# EVMONE
RUN set -ex; \
cd /usr/src; \
git clone --branch="v0.8.0" --recurse-submodules https://github.com/ethereum/evmone.git; \
git clone --branch="v0.8.2" --recurse-submodules https://github.com/ethereum/evmone.git; \
cd evmone; \
mkdir build; \
cd build; \
Expand Down