Skip to content

fix(bootstrap): refresh Alpine base for patched OS packages #204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antoinetoussaint-byte merged 1 commit into from
Oct 28, 2026
Merged

fix(bootstrap): refresh Alpine base for patched OS packages #204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions bootstrap-image.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
{
"base": {
"image": "alpine",
"version": "3.21.8",
"digest": "sha256:ce64758a109eb420d874a118f87920e625e12d3634e03b4a5573fd9f6e5d3507"
"version": "3.21.9",
"digest": "sha256:ee16d92f96db08d9d2d07da48555a27f3a69d8f0759021dbc601195ed0d2b5bd"
},
"packages": {
"repositories": [
Expand Down
10 changes: 10 additions & 0 deletions docs/bootstrap-migrate.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,16 @@ provenance. Normal context hashing includes the staged source files. The build
copies only the compiled executable and cleaned bootstrap artifacts into the
runtime, so an SBOM describes shipped code rather than unused parent manifests.

The bootstrap OS is maintained separately from the migrate executable and the
PostgreSQL server image in `runtime-image.json`. The Alpine 3.21.9 bootstrap base
updates libcrypto3/libssl3 to 3.3.7-r2, musl/musl-utils to 1.2.5-r12 and zlib to
1.3.2-r1 on both architectures, addressing the fixable OS findings in the prior
3.21.8 base. This stays on the same Alpine branch and PostgreSQL 17 client. Resolve
the base with the full lock updater; do not add an unpinned `apk upgrade` to
consumer Dockerfiles. Rebuilding with an older agent retains its embedded lock,
so consumers must select the corrected source artifact or subsequent release.
Package inspection of the base is not a scan of the final migration images.

Use `.github/scripts/update-bootstrap-migrate.py` to resolve the migrate portion
of the lock without Docker. It reads migrate's version from `go.mod`, retains the
existing exact compiler tag, verifies the registry manifest digest and checks
Expand Down
Loading