From b992b12e4b57442126e7b366875e426b1727198d Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Wed, 22 Jul 2026 16:57:11 +0300 Subject: [PATCH] fix: build restic with patched grpc-go --- Dockerfile.backup | 16 ++++++++++++++-- README.md | 6 +++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/Dockerfile.backup b/Dockerfile.backup index 1cb0019..ea1ddf4 100644 --- a/Dockerfile.backup +++ b/Dockerfile.backup @@ -1,6 +1,18 @@ FROM golang:1.26.5-alpine3.23@sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc AS restic -RUN CGO_ENABLED=0 go install github.com/restic/restic/cmd/restic@v0.19.1 +ENV GOTOOLCHAIN=local + +WORKDIR /src + +RUN go mod init who-need-help/restic-build \ + && go get github.com/restic/restic/cmd/restic@v0.19.1 \ + && go get google.golang.org/grpc@v1.82.1 \ + && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "v1.82.1" \ + && CGO_ENABLED=0 go build \ + -trimpath \ + -ldflags="-s -w" \ + -o /out/restic \ + github.com/restic/restic/cmd/restic FROM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 @@ -13,7 +25,7 @@ RUN apk add --no-cache \ postgresql18-client=18.4-r0 \ zlib=1.3.2-r0 -COPY --from=restic /go/bin/restic /usr/local/bin/restic +COPY --from=restic /out/restic /usr/local/bin/restic ENTRYPOINT [] USER 10001:10001 diff --git a/README.md b/README.md index 9d52724..06721bc 100644 --- a/README.md +++ b/README.md @@ -110,9 +110,9 @@ Compose starts Traefik, PostGIS, Mailpit, a migration runner, 2 web replicas, and 2 Oban worker replicas. It waits for readiness and verifies a PubSub message broadcast from a different BEAM node. Registration emails appear in Mailpit. The Traefik image is reproducibly built from the checksum-pinned upstream -`v3.7.8` source with `grpc-go 1.82.1`. The Caddy edge is built from upstream -`v2.11.4` with the same dependency pin. Both latest upstream dependency graphs -still contain older `grpc-go` versions affected by +`v3.7.8` source with `grpc-go 1.82.1`. The Caddy edge and backup image build +upstream Caddy `v2.11.4` and restic `v0.19.1` with the same dependency pin. +Those latest upstream dependency graphs still contain older `grpc-go` versions affected by [GHSA-hrxh-6v49-42gf](https://github.com/advisories/GHSA-hrxh-6v49-42gf). Four deployment settings in the ignored environment select the runtime without