mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 23:16:30 +01:00
Alex Goodman
9e520d1442
`archive.ubuntu.com/ubuntu/pool/main` only keeps the current version of a package, so the pinned `zlib1g 1:1.3.dfsg-3.1ubuntu2.1` URL started 404ing. `curl` without `-f` wrote the error page into `zlib1g.deb` and exited 0, so the fixture image built clean and just contained a non-deb, failing `TestDpkgArchiveCataloger` only when the fixture cache was cold. Now points at the launchpad `+files` URL, which is immutable. Also added `-f` to the other fixture Dockerfiles that curl a pinned artifact so the next bit of URL rot fails the build instead of quietly poisoning a fixture. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
11 lines
358 B
Docker
11 lines
358 B
Docker
FROM ubuntu:22.04 AS downloader
|
|
|
|
RUN apt-get update && apt-get install -y curl
|
|
|
|
# launchpad's +files URLs are immutable, unlike pool/main which only keeps the current version
|
|
RUN curl -fsSL -o zlib1g.deb https://launchpad.net/ubuntu/+archive/primary/+files/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb
|
|
|
|
FROM scratch
|
|
|
|
COPY --from=downloader /zlib1g.deb /zlib1g.deb
|