sadpandajoe commented on code in PR #44124:
URL: https://github.com/apache/superset/pull/44124#discussion_r3976384596
##########
docker/apt-install.sh:
##########
@@ -38,6 +38,14 @@ RESET='\033[0m'
echo -e "${GREEN}Updating package lists...${RESET}"
apt-get update -qq
+# The base image's already-installed packages can lag behind the latest
+# point release available in its own configured repos between rebuilds of
+# that image tag. Applying available updates at build time, not just
+# whatever shipped with the base image, keeps every already-installed
+# package current too, not only the ones this call adds.
+echo -e "${GREEN}Applying available package updates...${RESET}"
+apt-get upgrade -yqq
Review Comment:
Registry-backed BuildKit caching keys this `RUN` on Docker inputs, not the
current APT repository, so a scheduled or release rebuild can reuse the old
layer and skip both `update` and `upgrade`—the exact between-base-rebuild gap
this change is meant to close. Could the refresh path deliberately invalidate
this stage before republishing images?
##########
scripts/docker-build-extra-flags.sh:
##########
@@ -42,7 +42,7 @@ IMAGE_TAG="${2:?usage: docker-build-extra-flags.sh
<build_preset> <image_tag>}"
EXTRA_FLAGS="--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG"
if [ "$BUILD_PRESET" != "py311" ] && [ "$BUILD_PRESET" != "py312" ]; then
- EXTRA_FLAGS="--build-arg PY_VER=3.11.14-slim-trixie $EXTRA_FLAGS"
+ EXTRA_FLAGS="--build-arg PY_VER=3.11.16-slim-trixie $EXTRA_FLAGS"
Review Comment:
This bump never reaches the release or scheduled-refresh publishers: both
invoke `supersetbot docker` without this helper, and the installed
`supersetbot` still emits `--build-arg PY_VER=3.10-slim-bookworm`, overriding
the Dockerfile default. Could the 3.11.16 override be shared with those
publishing paths and covered by the assembled-command check so released images
actually get the CVE fix?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
