Skip to content

[publish images] bootstrap: rebake CI images to refresh prefetched deps #30095

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jarred-Sumner wants to merge 2 commits into
base: main
Choose a base branch
from
+23 −24
Open

[publish images] bootstrap: rebake CI images to refresh prefetched deps #30095

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd7247f
[build images] bootstrap: bump image version to rebake prefetched deps
Jarred-Sumner May 2, 2026
09d5408
[build images] gcc-13: install from mirrored .debs instead of Launchp…
Jarred-Sumner May 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions .buildkite/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
software-properties-common apt-transport-https \
ca-certificates gnupg lsb-release unzip xz-utils \
libxml2-dev ruby ruby-dev bison gawk perl make golang ccache qemu-user-static \
&& add-apt-repository ppa:ubuntu-toolchain-r/test \
&& apt-get update \
&& apt-get install -y gcc-13 g++-13 libgcc-13-dev libstdc++-13-dev \
libasan6 libubsan1 libatomic1 libtsan0 liblsan0 \
libgfortran5 libc6-dev \
libc6-dev \
# gcc-13 on focal: Launchpad ppa:ubuntu-toolchain-r/test times out / 503s
# often enough to break image builds, so install from a mirrored snapshot
# of the PPA's .debs instead. See oven-sh/WebKit release gcc-13-focal-debs.
&& mkdir /tmp/gcc13 \
&& wget -qO- "https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-${TARGETARCH}.tar.gz" \
| tar -xz -C /tmp/gcc13 \
&& apt-get install -y --no-install-recommends /tmp/gcc13/*.deb \
Comment on lines +35 to +37

@coderabbitai coderabbitai Bot May 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
# Verify release assets expose checksum material you can pin in Docker args.
curl -fsSL "https://api.github.com/repos/oven-sh/WebKit/releases/tags/gcc-13-focal-debs" \
  | jq -r '.assets[].name'

Repository: oven-sh/bun

Length of output: 107

🏁 Script executed:

cat -n .buildkite/Dockerfile | sed -n '25,45p'

Repository: oven-sh/bun

Length of output: 1192

🏁 Script executed:

#!/bin/bash
# Query GitHub API for release details including assets with checksums
curl -fsSL "https://api.github.com/repos/oven-sh/WebKit/releases/tags/gcc-13-focal-debs" \
  | jq '.assets[] | {name, browser_download_url, size, id}'

Repository: oven-sh/bun

Length of output: 469

🏁 Script executed:

#!/bin/bash
# Check if release page includes checksums or hashes in description/body
curl -fsSL "https://api.github.com/repos/oven-sh/WebKit/releases/tags/gcc-13-focal-debs" \
  | jq -r '.body'

Repository: oven-sh/bun

Length of output: 774

Verify GCC tarball integrity before installing .deb packages.

Lines 35-37 install externally downloaded packages without checksum verification. Add SHA-256 verification before extraction/install to reduce supply-chain risk.

The release notes for gcc-13-focal-debs already expose checksums that can be pinned:

  • amd64: a2b3b6e10b175bbaaefeb3e9e703ca26a97ed6c1f19ca842d3e0b0c8f941e65b
  • arm64: be19db90d94c52c6061280bbadcaad9b09db1e9f2e77a12f8c18c5425d2eb056
Proposed hardening diff 
+ARG GCC13_FOCAL_AMD64_SHA256="a2b3b6e10b175bbaaefeb3e9e703ca26a97ed6c1f19ca842d3e0b0c8f941e65b"
+ARG GCC13_FOCAL_ARM64_SHA256="be19db90d94c52c6061280bbadcaad9b09db1e9f2e77a12f8c18c5425d2eb056"
 RUN apt-get update && apt-get install -y --no-install-recommends \
   wget curl git python3 python3-pip ninja-build \
   software-properties-common apt-transport-https \
   ca-certificates gnupg lsb-release unzip xz-utils \
   libxml2-dev ruby ruby-dev bison gawk perl make golang ccache qemu-user-static \
   libc6-dev \
   # gcc-13 on focal: Launchpad ppa:ubuntu-toolchain-r/test times out / 503s
   # often enough to break image builds, so install from a mirrored snapshot
   # of the PPA's .debs instead. See oven-sh/WebKit release gcc-13-focal-debs.
   && mkdir /tmp/gcc13 \
-  && wget -qO- "https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-${TARGETARCH}.tar.gz" \
-     | tar -xz -C /tmp/gcc13 \
+  && wget -qO /tmp/gcc13.tar.gz "https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-${TARGETARCH}.tar.gz" \
+  && GCC13_SHA256=$([ "$TARGETARCH" = "arm64" ] && echo "$GCC13_FOCAL_ARM64_SHA256" || echo "$GCC13_FOCAL_AMD64_SHA256") \
+  && echo "${GCC13_SHA256}  /tmp/gcc13.tar.gz" | sha256sum -c - \
+  && tar -xzf /tmp/gcc13.tar.gz -C /tmp/gcc13 \
   && apt-get install -y --no-install-recommends /tmp/gcc13/*.deb \
-  && rm -rf /tmp/gcc13 \
+  && rm -rf /tmp/gcc13 /tmp/gcc13.tar.gz \
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.buildkite/Dockerfile around lines 35 - 37, The Dockerfile currently pipes
the remote gcc-13-focal-${TARGETARCH}.tar.gz straight into tar and installs .deb
files from /tmp/gcc13 without verifying integrity; change the steps to download
the tarball to a file (e.g., /tmp/gcc-13-focal-${TARGETARCH}.tar.gz), compute
its SHA-256 checksum with sha256sum, compare it against the pinned checksums for
amd64 and arm64 (use TARGETARCH to select the expected hash), fail the build if
the checksum does not match, then extract to /tmp/gcc13 and run apt-get install
-y --no-install-recommends /tmp/gcc13/*.deb and cleanup; ensure failures return
non-zero so the build aborts on mismatch.

&& rm -rf /tmp/gcc13 \
&& wget https://apt.llvm.org/llvm.sh \
&& chmod +x llvm.sh \
&& ./llvm.sh ${LLVM_VERSION} all \
Expand Down
2 changes: 1 addition & 1 deletion scripts/bootstrap.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Version: 19
# Version: 20
# A script that installs the dependencies needed to build and test Bun on Windows.
# Supports both x64 and ARM64 using Scoop for package management.
# Used by Azure [build images] pipeline.
Expand Down
31 changes: 13 additions & 18 deletions scripts/bootstrap.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/sh
# Version: 34
# Version: 35

# A script that installs the dependencies needed to build and test Bun.
# This should work on macOS and Linux with a POSIX shell.
Expand Down Expand Up @@ -1191,23 +1191,18 @@ install_gcc() {
return
fi

# Taken from WebKit's Dockerfile.
# https://github.com/oven-sh/WebKit/blob/816a3c02e0f8b53f8eec06b5ed911192589b51e2/Dockerfile

execute_sudo add-apt-repository ppa:ubuntu-toolchain-r/test -y
execute_sudo apt update -y
execute_sudo apt install -y \
"gcc-$gcc_version" \
"g++-$gcc_version" \
"libgcc-$gcc_version-dev" \
"libstdc++-$gcc_version-dev" \
libasan6 \
libubsan1 \
libatomic1 \
libtsan0 \
liblsan0 \
libgfortran5 \
libc6-dev
# gcc-13 on focal: Launchpad ppa:ubuntu-toolchain-r/test times out / 503s
# often enough to break image builds, so install from a mirrored snapshot
# of the PPA's .debs instead. See oven-sh/WebKit release gcc-13-focal-debs.
case "$arch" in
x64) gcc_deb_arch="amd64" ;;
aarch64) gcc_deb_arch="arm64" ;;
esac
gcc_deb_url="https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-$gcc_deb_arch.tar.gz"
gcc_deb_dir="$(create_tmp_directory)"
fetch "$gcc_deb_url" | execute tar -xz -C "$gcc_deb_dir"
execute_sudo apt-get install -y --no-install-recommends "$gcc_deb_dir"/*.deb libc6-dev
execute rm -rf "$gcc_deb_dir"
Comment on lines +1194 to +1205

@coderabbitai coderabbitai Bot May 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
# List release assets to source per-arch checksums you can pin in bootstrap.sh
curl -fsSL "https://api.github.com/repos/oven-sh/WebKit/releases/tags/gcc-13-focal-debs" \
  | jq -r '.assets[].name'

Repository: oven-sh/bun

Length of output: 107

🏁 Script executed:

rg "download_and_verify_file" scripts/bootstrap.sh

Repository: oven-sh/bun

Length of output: 291

🏁 Script executed:

sed -n '1194,1205p' scripts/bootstrap.sh

Repository: oven-sh/bun

Length of output: 704

🏁 Script executed:

# Check if there are SHA256 checksums documented for these assets
rg "gcc-13-focal" scripts/bootstrap.sh -A 5 -B 5

Repository: oven-sh/bun

Length of output: 719

Use download_and_verify_file for the GCC .deb tarball to add integrity verification.

External .deb artifacts are downloaded and extracted without verification. The download_and_verify_file helper already exists in this script (used for age tarball) and supports this pattern.

Implementation approach 
  case "$arch" in
  x64) gcc_deb_arch="amd64" ;;
  aarch64) gcc_deb_arch="arm64" ;;
  esac
  gcc_deb_url="https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-$gcc_deb_arch.tar.gz"
+ case "$gcc_deb_arch" in
+ amd64) gcc_deb_sha256="<fill-from-release>" ;;
+ arm64) gcc_deb_sha256="<fill-from-release>" ;;
+ esac
  gcc_deb_dir="$(create_tmp_directory)"
- fetch "$gcc_deb_url" | execute tar -xz -C "$gcc_deb_dir"
+ gcc_deb_tar="$(download_and_verify_file "$gcc_deb_url" "$gcc_deb_sha256")"
+ execute tar -xzf "$gcc_deb_tar" -C "$gcc_deb_dir"
  execute_sudo apt-get install -y --no-install-recommends "$gcc_deb_dir"/*.deb libc6-dev

Obtain the SHA256 checksums from the gcc-13-focal-debs release assets (confirmed: gcc-13-focal-amd64.tar.gz and gcc-13-focal-arm64.tar.gz exist).

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# gcc-13 on focal: Launchpad ppa:ubuntu-toolchain-r/test times out / 503s
# often enough to break image builds, so install from a mirrored snapshot
# of the PPA's .debs instead. See oven-sh/WebKit release gcc-13-focal-debs.
case "$arch" in
x64) gcc_deb_arch="amd64" ;;
aarch64) gcc_deb_arch="arm64" ;;
esac
gcc_deb_url="https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-$gcc_deb_arch.tar.gz"
gcc_deb_dir="$(create_tmp_directory)"
fetch "$gcc_deb_url" | execute tar -xz -C "$gcc_deb_dir"
execute_sudo apt-get install -y --no-install-recommends "$gcc_deb_dir"/*.deb libc6-dev
execute rm -rf "$gcc_deb_dir"
# gcc-13 on focal: Launchpad ppa:ubuntu-toolchain-r/test times out / 503s
# often enough to break image builds, so install from a mirrored snapshot
# of the PPA's .debs instead. See oven-sh/WebKit release gcc-13-focal-debs.
case "$arch" in
x64) gcc_deb_arch="amd64" ;;
aarch64) gcc_deb_arch="arm64" ;;
esac
gcc_deb_url="https://github.com/oven-sh/WebKit/releases/download/gcc-13-focal-debs/gcc-13-focal-$gcc_deb_arch.tar.gz"
case "$gcc_deb_arch" in
amd64) gcc_deb_sha256="<fill-from-release>" ;;
arm64) gcc_deb_sha256="<fill-from-release>" ;;
esac
gcc_deb_dir="$(create_tmp_directory)"
gcc_deb_tar="$(download_and_verify_file "$gcc_deb_url" "$gcc_deb_sha256")"
execute tar -xzf "$gcc_deb_tar" -C "$gcc_deb_dir"
execute_sudo apt-get install -y --no-install-recommends "$gcc_deb_dir"/*.deb libc6-dev
execute rm -rf "$gcc_deb_dir"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@scripts/bootstrap.sh` around lines 1194 - 1205, The script currently fetches
and extracts the GCC .deb tarball without integrity checks; replace the
fetch/pipe sequence by using the existing download_and_verify_file helper (same
pattern used for the age tarball) to download the URL held in gcc_deb_url into a
temporary path (created via create_tmp_directory or a temp file), verify it
against the appropriate SHA256 checksum (use the release's
gcc-13-focal-amd64.tar.gz / gcc-13-focal-arm64.tar.gz checksums), then extract
the verified tarball into gcc_deb_dir and proceed with execute_sudo apt-get
install; ensure you still remove gcc_deb_dir on cleanup. Use the same
variables/functions (gcc_deb_url, gcc_deb_dir, create_tmp_directory,
download_and_verify_file, execute, execute_sudo) so the replacement is local and
preserves install/cleanup behavior.


execute_sudo update-alternatives \
--install /usr/bin/gcc gcc "/usr/bin/gcc-$gcc_version" 130 \
Expand Down
Loading