From aeb5e80e988882d26141c13d9c73023fb4a4d3c6 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sat, 24 Oct 2026 01:27:13 +0800 Subject: [PATCH 1/2] test: align canonical script copy expectation --- scripts/check-server-performance-env.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-server-performance-env.sh b/scripts/check-server-performance-env.sh index 5d720afbd88..defd15127fd 100644 --- a/scripts/check-server-performance-env.sh +++ b/scripts/check-server-performance-env.sh @@ -71,7 +71,7 @@ check 'MariaDB startup verifies live readback' \ has_marker server/artifacts/mysql.sh 'verify_mariadb_performance_settings' check 'incremental release image installs the canonical scripts' \ has_marker server/Dockerfile.web-compose-release \ - 'COPY --chmod=0755 artifacts/cattle.sh artifacts/mysql.sh artifacts/performance-env.sh /usr/share/cattle/' + 'COPY --chmod=0755 artifacts/cattle.sh artifacts/mysql.sh artifacts/performance-env.sh artifacts/verify-engine-archive.sh /usr/share/cattle/' check 'external-DB image keeps the Java helper dependency' \ has_marker server/Dockerfile.externaldb \ 'COPY --chmod=0755 artifacts/cattle.sh artifacts/performance-env.sh /usr/share/cattle/' From f5d3823e2564359a6b6253b1b64e908468254b6e Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sat, 24 Oct 2026 01:28:26 +0800 Subject: [PATCH 2/2] build: count the base layer and reuse verified bootstrap tar --- scripts/test-current-server-packaging-contract.py | 3 ++- scripts/test-engine-archive-contract.py | 4 +++- server/Dockerfile.web-compose-release | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py index 91e375b4ba2..6380f19fc62 100644 --- a/scripts/test-current-server-packaging-contract.py +++ b/scripts/test-current-server-packaging-contract.py @@ -1038,7 +1038,8 @@ def test_eighteen_component_inputs_keep_exact_sha_fetch_and_separate_jdk_stage(s self.assertEqual(len(re.findall(r'^FROM ', FILES[DOCKER], re.M)), 6) self.assertIn('FROM scratch AS component_input', FILES[DOCKER]) final = FILES[DOCKER].rsplit('FROM ${BASE_IMAGE}', 1)[1] - self.assertLessEqual(len(re.findall(r'^(RUN|COPY|ADD)\b', final, re.M)), 32) + # The already-flattened base contributes one real layer too. + self.assertLessEqual(1 + len(re.findall(r'^(RUN|COPY|ADD)\b', final, re.M)), 32) self.assertEqual(len(re.findall(r'^\s+fetch-server-component ', FILES[DOCKER], re.M)), 16) self.assertIn('"${release_url%/}/v${version}/${artifact}" "${artifact}" "${archive_sha}"', FILES[DOCKER]) release_stage = FILES[DOCKER].split('FROM ${ARTIFACT_HELPER_IMAGE} AS release_artifacts', 1)[1].split('FROM ${UBUNTU_SECURITY_IMAGE}', 1)[0] diff --git a/scripts/test-engine-archive-contract.py b/scripts/test-engine-archive-contract.py index e12f1751429..1e103bb60be 100644 --- a/scripts/test-engine-archive-contract.py +++ b/scripts/test-engine-archive-contract.py @@ -105,7 +105,9 @@ def test_shared_wiring_and_no_extra_layer_or_stale_variable(self): self.assertNotIn('${listing}', engine_run) self.assertNotIn('listing=', engine_run) final = re.split(r'(?m)^FROM ', docker)[-1] - self.assertEqual(len(re.findall(r'(?m)^(?:RUN|COPY|ADD) ', final)), 32) + self.assertLessEqual(1 + len(re.findall(r'(?m)^(?:RUN|COPY|ADD) ', final)), 32) + self.assertNotIn('COPY --from=runtime_security_packages /out/tar /usr/bin/tar', final) + self.assertIn('sha256sum -c SHA256SUMS; \\\n install -m 0755 tar /usr/bin/tar; \\\n dpkg -i packages/*.deb;', final) if __name__ == '__main__': diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release index 2dfd967b0df..9e504dafa18 100644 --- a/server/Dockerfile.web-compose-release +++ b/server/Dockerfile.web-compose-release @@ -729,12 +729,12 @@ ARG MACHINE_DRIVER_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428 ARG PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100 COPY --from=runtime_security_packages /out/ /tmp/pasturestack-runtime-security/ -COPY --from=runtime_security_packages /out/tar /usr/bin/tar COPY scripts/install-ubuntu-security-updates.sh security/ubuntu-security-packages.lock /tmp/pasturestack-security-input/ RUN set -eux; \ printf '%s\n' "${WEB_CONSOLE_COMMIT}" | grep -Eq '^[0-9a-f]{40}$'; \ cd /tmp/pasturestack-runtime-security; \ sha256sum -c SHA256SUMS; \ + install -m 0755 tar /usr/bin/tar; \ dpkg -i packages/*.deb; \ install -D -m 0644 /tmp/pasturestack-security-input/ubuntu-security-packages.lock /usr/share/pasturestack/security/ubuntu-security-packages.lock; \ sh /tmp/pasturestack-security-input/install-ubuntu-security-updates.sh /usr/share/pasturestack/security/ubuntu-security-packages.lock /tmp/pasturestack-runtime-security/security-updates; \