oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 16:48:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

pin php apache fixture to debian snapshot (#5043)

Browse Source 
the plain version pin drifted out from under us: debian mirrors only keep
the latest point release, so 8.2.31 became uninstallable once 8.2.32 shipped
and apt pulled the unpinned transitive php8.2-cli at 8.2.32. pointing apt at
snapshot.debian.org keeps the exact point release installable so the fixture
(and its test expectations) stay reproducible.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman 2026-07-06 11:01:44 -04:00 committed by GitHub
parent e4f5df936c
commit f1457f2554
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
syft/pkg/cataloger/php/testdata/image-apache/Dockerfile vendored
View File

@ -1,5 +1,19 @@
FROM --platform=linux/amd64 httpd:2.4.63-bookworm AS builder
# pin apt to a debian snapshot so the exact php8.2 point release stays installable.
# a plain version pin drifts out from under us: debian's mirrors only keep the latest
# point release, so 8.2.31 disappears once 8.2.32 ships. snapshot.debian.org archives
# every version forever, which is what actually keeps the fixture (and its test
# expectations) reproducible. timestamp is any point where 8.2.31 was current
# (8.2.31: 2026-05-08, 8.2.32: 2026-07-04).
ARG SNAPSHOT=20260701T000000Z
RUN rm -f /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources && \
printf '%s\n' \
"deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${SNAPSHOT}/ bookworm main" \
"deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${SNAPSHOT}/ bookworm-updates main" \
"deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/${SNAPSHOT}/ bookworm-security main" \
> /etc/apt/sources.list
# pin php8.2 packages to avoid version drift when debian publishes security updates
ARG PHP_VERSION=8.2.31-1~deb12u1
RUN apt update -y && apt install -y \