luxfi/kms
1
0
Fork 0
mirror of https://github.com/luxfi/kms.git synced 2026-07-27 03:38:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

build: drop GOPRIVATE from Dockerfiles — use immutable public proxy+sumdb

Browse Source 
The Docker builds set GOPRIVATE=luxfi/*,hanzoai/* which routes module fetches
'direct' (git) and bypasses sum.golang.org. After luxfi/keys@v1.1.0 was
force-republished, the git tag content diverged from the immutable proxy/sumdb
hash — so 'go mod download' fetched bits that no longer matched the (correct,
sumdb-canonical) go.sum, failing every image build with SECURITY ERROR checksum
mismatch. These modules are public; resolving them through the default public
proxy + sumdb yields the canonical immutable hash that matches go.sum and a
re-publish can no longer break. GITHUB_TOKEN insteadOf stays for the direct
fallback.
This commit is contained in:
hanzo-dev
2026-06-28 14:15:10 -07:00
parent 5ac2347a04
commit a20bc707f1
4 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+3 -1
View File
@@ -18,7 +18,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
ARG GITHUB_TOKEN
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC, so go resolves them via the
# default public proxy + sumdb (immutable hashes a force-moved tag can't break).
# GOPRIVATE would route them `direct` (git) and re-introduce go.sum poisoning.
WORKDIR /build
COPY go.mod go.sum ./
Dockerfile.operator
+2 -1
View File
@@ -5,7 +5,8 @@ FROM golang:1.26.4-bookworm AS builder
ENV GOTOOLCHAIN=auto
ARG GITHUB_TOKEN
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates tzdata \
Dockerfile.server
+2 -1
View File
@@ -11,7 +11,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
ARG GITHUB_TOKEN
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
# No GOPRIVATE — luxfi/hanzoai Go modules are PUBLIC; resolve via public proxy +
# sumdb (immutable). GOPRIVATE would route `direct` and re-poison go.sum.
WORKDIR /build
COPY go.mod go.sum ./
Dockerfile.web
+19
View File
@@ -0,0 +1,19 @@
# syntax=docker/dockerfile:1.7
# Unified lux-kms: prebuilt frontend (go:embed cmd/kms/web) + CGO sqlcipher server.
FROM golang:1.26.4-bookworm AS build
RUN apt-get update && apt-get install -y --no-install-recommends \
libsqlcipher-dev gcc libc6-dev pkg-config git ca-certificates && rm -rf /var/lib/apt/lists/*
ARG GITHUB_TOKEN
RUN git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
# No GOPRIVATE — public modules resolve via the immutable public proxy + sumdb.
ENV GOFLAGS=-mod=mod
WORKDIR /build
COPY . .
RUN CGO_ENABLED=1 go build -tags "sqlite_fts5 sqlcipher" -ldflags="-s -w" -o /usr/local/bin/kms ./cmd/kms
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends libsqlcipher0 ca-certificates curl && rm -rf /var/lib/apt/lists/*
COPY --from=build /usr/local/bin/kms /usr/local/bin/kms
RUN mkdir -p /data/kms
EXPOSE 8080
HEALTHCHECK --interval=10s --timeout=3s --retries=5 CMD curl -f http://localhost:8080/healthz || exit 1
ENTRYPOINT ["kms","serve","--http=0.0.0.0:8080"]