From d7b63f298ceafad63278cb41bb06b12601af809e Mon Sep 17 00:00:00 2001 From: Nick Schonning Date: Thu, 24 Sep 2026 23:20:58 -0400 Subject: [PATCH 1/2] build: use official Musl builds for x64 and fallback --- 22/alpine3.23/Dockerfile | 49 ++++++++++++++------------- 22/alpine3.24/Dockerfile | 49 ++++++++++++++------------- 24/alpine3.23/Dockerfile | 49 ++++++++++++++------------- 24/alpine3.24/Dockerfile | 49 ++++++++++++++------------- 26/alpine3.23/Dockerfile | 53 +++++++++++++++-------------- 26/alpine3.24/Dockerfile | 53 +++++++++++++++-------------- Dockerfile-alpine.template | 39 ++++++++++++---------- update.sh | 68 ++++++++++++++------------------------ 8 files changed, 205 insertions(+), 204 deletions(-) diff --git a/22/alpine3.23/Dockerfile b/22/alpine3.23/Dockerfile index 9bef63d2f9..899f0e69ec 100644 --- a/22/alpine3.23/Dockerfile +++ b/22/alpine3.23/Dockerfile @@ -7,37 +7,20 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ - x86_64) ARCH='x64' CHECKSUM="9b177f0c140a82a3d247e8f54586a65dbdf91e5e3a01f04708dabfdc9e0e01c4" OPENSSL_ARCH=linux-x86_64;; \ + x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; \ aarch64) OPENSSL_ARCH=linux-aarch64;; \ arm*) OPENSSL_ARCH=linux-armv4;; \ s390x) OPENSSL_ARCH=linux-s390x;; \ *) echo "unsupported architecture"; exit 1 ;; \ esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ - else \ - echo "Building from source" \ - # backup build - && apk add --no-cache --virtual .build-deps-full \ - binutils-gold \ - g++ \ - gcc \ - gnupg \ - libgcc \ - linux-headers \ - make \ - python3 \ - py-setuptools \ # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 && export GNUPGHOME="$(mktemp -d)" \ # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ && for key in \ 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ @@ -48,9 +31,30 @@ RUN addgroup -g 1000 node \ 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD \ A363A499291CBBC940DD62E41F10027AF002F8B0 \ ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -67,7 +71,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/22/alpine3.24/Dockerfile b/22/alpine3.24/Dockerfile index 47fa209447..c31025afdd 100644 --- a/22/alpine3.24/Dockerfile +++ b/22/alpine3.24/Dockerfile @@ -7,37 +7,20 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ - x86_64) ARCH='x64' CHECKSUM="9b177f0c140a82a3d247e8f54586a65dbdf91e5e3a01f04708dabfdc9e0e01c4" OPENSSL_ARCH=linux-x86_64;; \ + x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; \ aarch64) OPENSSL_ARCH=linux-aarch64;; \ arm*) OPENSSL_ARCH=linux-armv4;; \ s390x) OPENSSL_ARCH=linux-s390x;; \ *) echo "unsupported architecture"; exit 1 ;; \ esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ - else \ - echo "Building from source" \ - # backup build - && apk add --no-cache --virtual .build-deps-full \ - binutils-gold \ - g++ \ - gcc \ - gnupg \ - libgcc \ - linux-headers \ - make \ - python3 \ - py-setuptools \ # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 && export GNUPGHOME="$(mktemp -d)" \ # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ && for key in \ 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ @@ -48,9 +31,30 @@ RUN addgroup -g 1000 node \ 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD \ A363A499291CBBC940DD62E41F10027AF002F8B0 \ ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -67,7 +71,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/24/alpine3.23/Dockerfile b/24/alpine3.23/Dockerfile index 434067862a..498944c5b1 100644 --- a/24/alpine3.23/Dockerfile +++ b/24/alpine3.23/Dockerfile @@ -7,36 +7,19 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ - x86_64) ARCH='x64' CHECKSUM="dd5ca647e656c8200c873f45098a16623129c47f2387829f0a15a6de1dac1220" OPENSSL_ARCH=linux-x86_64;; \ + x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; \ aarch64) OPENSSL_ARCH=linux-aarch64;; \ s390x) OPENSSL_ARCH=linux-s390x;; \ *) echo "unsupported architecture"; exit 1 ;; \ esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ - else \ - echo "Building from source" \ - # backup build - && apk add --no-cache --virtual .build-deps-full \ - binutils-gold \ - g++ \ - gcc \ - gnupg \ - libgcc \ - linux-headers \ - make \ - python3 \ - py-setuptools \ # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 && export GNUPGHOME="$(mktemp -d)" \ # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ && for key in \ 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ @@ -47,9 +30,30 @@ RUN addgroup -g 1000 node \ 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD \ A363A499291CBBC940DD62E41F10027AF002F8B0 \ ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -66,7 +70,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/24/alpine3.24/Dockerfile b/24/alpine3.24/Dockerfile index f51805a497..84500819b2 100644 --- a/24/alpine3.24/Dockerfile +++ b/24/alpine3.24/Dockerfile @@ -7,36 +7,19 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ - x86_64) ARCH='x64' CHECKSUM="dd5ca647e656c8200c873f45098a16623129c47f2387829f0a15a6de1dac1220" OPENSSL_ARCH=linux-x86_64;; \ + x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; \ aarch64) OPENSSL_ARCH=linux-aarch64;; \ s390x) OPENSSL_ARCH=linux-s390x;; \ *) echo "unsupported architecture"; exit 1 ;; \ esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ - else \ - echo "Building from source" \ - # backup build - && apk add --no-cache --virtual .build-deps-full \ - binutils-gold \ - g++ \ - gcc \ - gnupg \ - libgcc \ - linux-headers \ - make \ - python3 \ - py-setuptools \ # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 && export GNUPGHOME="$(mktemp -d)" \ # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ && for key in \ 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ @@ -47,9 +30,30 @@ RUN addgroup -g 1000 node \ 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD \ A363A499291CBBC940DD62E41F10027AF002F8B0 \ ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -66,7 +70,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/26/alpine3.23/Dockerfile b/26/alpine3.23/Dockerfile index 8f209ab096..e09422b128 100644 --- a/26/alpine3.23/Dockerfile +++ b/26/alpine3.23/Dockerfile @@ -7,37 +7,18 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ - x86_64) ARCH='x64' CHECKSUM="e91679de73f48e4f107fc968bec351dea6676c7f54af004280a7baaf5c6d88c5" OPENSSL_ARCH=linux-x86_64;; \ + x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; \ aarch64) OPENSSL_ARCH=linux-aarch64;; \ *) echo "unsupported architecture"; exit 1 ;; \ esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ - else \ - echo "Building from source" \ - # backup build - && apk add --no-cache --virtual .build-deps-full \ - binutils-gold \ - g++ \ - gcc \ - gnupg \ - libgcc \ - linux-headers \ - make \ - python3 \ - py-setuptools \ - rust \ - cargo \ # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 && export GNUPGHOME="$(mktemp -d)" \ # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ && for key in \ 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ @@ -48,9 +29,32 @@ RUN addgroup -g 1000 node \ 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD \ A363A499291CBBC940DD62E41F10027AF002F8B0 \ ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ + rust \ + cargo \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -67,7 +71,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/26/alpine3.24/Dockerfile b/26/alpine3.24/Dockerfile index dd624094e9..b8e5ec6f47 100644 --- a/26/alpine3.24/Dockerfile +++ b/26/alpine3.24/Dockerfile @@ -7,37 +7,18 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ - x86_64) ARCH='x64' CHECKSUM="e91679de73f48e4f107fc968bec351dea6676c7f54af004280a7baaf5c6d88c5" OPENSSL_ARCH=linux-x86_64;; \ + x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; \ aarch64) OPENSSL_ARCH=linux-aarch64;; \ *) echo "unsupported architecture"; exit 1 ;; \ esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ - else \ - echo "Building from source" \ - # backup build - && apk add --no-cache --virtual .build-deps-full \ - binutils-gold \ - g++ \ - gcc \ - gnupg \ - libgcc \ - linux-headers \ - make \ - python3 \ - py-setuptools \ - rust \ - cargo \ # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 && export GNUPGHOME="$(mktemp -d)" \ # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ && for key in \ 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 \ DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 \ @@ -48,9 +29,32 @@ RUN addgroup -g 1000 node \ 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD \ A363A499291CBBC940DD62E41F10027AF002F8B0 \ ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + else \ + echo "Building from source" \ + && apk add --no-cache --virtual .build-deps-full \ + binutils-gold \ + g++ \ + gcc \ + libgcc \ + linux-headers \ + make \ + python3 \ + py-setuptools \ + rust \ + cargo \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -67,7 +71,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template index 94be2c1449..6ca4a6dd5b 100644 --- a/Dockerfile-alpine.template +++ b/Dockerfile-alpine.template @@ -7,25 +7,38 @@ RUN addgroup -g 1000 node \ && apk add --no-cache \ libstdc++ \ && apk add --no-cache --virtual .build-deps \ + gnupg \ curl \ && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" \ && case "${alpineArch##*-}" in \ "${ALPINE_ARCH[@]}" esac \ - && if [ -n "${CHECKSUM}" ]; then \ - set -eu; \ - curl -fsSLO --compressed "https://unofficial-builds.nodejs.org/download/release/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz"; \ - echo "$CHECKSUM node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" | sha256sum -c - \ - && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ - && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ + # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 + && export GNUPGHOME="$(mktemp -d)" \ + # gpg keys listed at https://github.com/nodejs/node#release-keys + && set -ex \ + && for key in \ + "${NODE_KEYS[@]}" + ; do \ + { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ + { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ + done \ + && if [ "$ARCH" = "x64" ]; then \ + curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ + && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ + && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ + && gpgconf --kill all \ + && rm -rf "$GNUPGHOME" \ + && grep " node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz\$" SHASUMS256.txt | sha256sum -c - \ + && tar -xJf "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \ + && rm "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \ + && ln -s /usr/local/bin/node /usr/local/bin/nodejs; \ else \ echo "Building from source" \ - # backup build && apk add --no-cache --virtual .build-deps-full \ binutils-gold \ g++ \ gcc \ - gnupg \ libgcc \ linux-headers \ make \ @@ -33,15 +46,6 @@ RUN addgroup -g 1000 node \ py-setuptools \ rust \ cargo \ - # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150 - && export GNUPGHOME="$(mktemp -d)" \ - # gpg keys listed at https://github.com/nodejs/node#release-keys - && for key in \ - "${NODE_KEYS[@]}" - ; do \ - { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \ - { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \ - done \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \ && curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \ && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \ @@ -58,7 +62,6 @@ RUN addgroup -g 1000 node \ && rm -Rf "node-v$NODE_VERSION" \ && rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \ fi \ - && rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \ # Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451 && find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \ && apk del .build-deps \ diff --git a/update.sh b/update.sh index f3041d87c0..e76eae74ed 100755 --- a/update.sh +++ b/update.sh @@ -8,30 +8,22 @@ function usage() { Update the node docker images. Usage: - $0 [-s] [MAJOR_VERSION(S)] [VARIANT(S)] + $0 [MAJOR_VERSION(S)] [VARIANT(S)] Examples: - update.sh # Update all images - - update.sh -s # Update all images, skip updating Alpine if the musl build is unavailable - update.sh 22,24 # Update all variants of version 22 and 24 - - update.sh -s 24 # Update all variants of version 24, except skip updating Alpine if the musl build is unavailable - update.sh 24 alpine3.23,alpine3.24 # Update only alpine3.23 & alpine3.24 variants for version 24 - update.sh . trixie,trixie-slim # Update only trixie & trixie-slim Debian variants for all versions OPTIONS: - -s Security update; allows Debian updates even if musl build for Alpine is unavailable -h Show this message EOF } -SKIP_ALPINE=false -while getopts "sh" opt; do +while getopts "h" opt; do case "${opt}" in - s) - SKIP_ALPINE=true - shift - ;; h) usage exit @@ -145,41 +137,29 @@ function update_node_version() { if is_alpine "${variant}"; then alpine_version="${variant#*alpine}" - checksum=$( - curl -sSL --compressed "https://unofficial-builds.nodejs.org/download/release/v${nodeVersion}/SHASUMS256.txt" | grep "node-v${nodeVersion}-linux-x64-musl.tar.xz" | cut -d' ' -f1 - ) - if [ -z "$checksum" ]; then - rm -f "${dockerfile}-tmp" - if [ "${SKIP_ALPINE}" = true ]; then - echo "${nodeVersion} is missing the musl build for ${variant}, but skipping for security release!" - else - fatal "Failed to fetch checksum for musl build version ${nodeVersion}" - fi - else - sed -Ei -e "s/(alpine:)0.0/\\1${alpine_version}/" "${dockerfile}-tmp" - - alpine_arch='' - local -a arches - arches=$(jq -r ".\"${version}\".variants.\"alpine${alpine_version}\" | @sh" "versions.json") - if [[ "${arches[0]}" == *"amd64"* ]]; then - alpine_arch+='x86_64) ARCH='"'"'x64'"'"' CHECKSUM="'${checksum}'" OPENSSL_ARCH=linux-x86_64;; \\\n ' - fi - if [[ "${arches[0]}" == *"arm64v8"* ]]; then - alpine_arch+='aarch64) OPENSSL_ARCH=linux-aarch64;; \\\n ' - fi - if [[ "${arches[0]}" == *"arm32"* ]]; then - alpine_arch+='arm*) OPENSSL_ARCH=linux-armv4;; \\\n ' - fi - if [[ "${arches[0]}" == *"ppc64le"* ]]; then - alpine_arch+='ppc64le) OPENSSL_ARCH=linux-ppc64le;; \\\n ' - fi - if [[ "${arches[0]}" == *"s390x"* ]]; then - alpine_arch+='s390x) OPENSSL_ARCH=linux-s390x;; \\\n ' - fi - # shellcheck disable=SC1003 - alpine_arch+='*) echo "unsupported architecture"; exit 1 ;; \\' - sed -Ei -e "s/\"\\$\{ALPINE_ARCH\[@\]\}\"/${alpine_arch}/" "${dockerfile}-tmp" + sed -Ei -e "s/(alpine:)0.0/\\1${alpine_version}/" "${dockerfile}-tmp" + + alpine_arch='' + local -a arches + arches=$(jq -r ".\"${version}\".variants.\"alpine${alpine_version}\" | @sh" "versions.json") + if [[ "${arches[0]}" == *"amd64"* ]]; then + alpine_arch+='x86_64) ARCH='"'"'x64'"'"' OPENSSL_ARCH=linux-x86_64;; \\\n ' + fi + if [[ "${arches[0]}" == *"arm64v8"* ]]; then + alpine_arch+='aarch64) OPENSSL_ARCH=linux-aarch64;; \\\n ' fi + if [[ "${arches[0]}" == *"arm32"* ]]; then + alpine_arch+='arm*) OPENSSL_ARCH=linux-armv4;; \\\n ' + fi + if [[ "${arches[0]}" == *"ppc64le"* ]]; then + alpine_arch+='ppc64le) OPENSSL_ARCH=linux-ppc64le;; \\\n ' + fi + if [[ "${arches[0]}" == *"s390x"* ]]; then + alpine_arch+='s390x) OPENSSL_ARCH=linux-s390x;; \\\n ' + fi + # shellcheck disable=SC1003 + alpine_arch+='*) echo "unsupported architecture"; exit 1 ;; \\' + sed -Ei -e "s/\"\\$\{ALPINE_ARCH\[@\]\}\"/${alpine_arch}/" "${dockerfile}-tmp" elif is_debian "${variant}"; then sed -Ei -e "s/(buildpack-deps:)name/\\1${variant}/" "${dockerfile}-tmp" deb_arch='' From 1508029e4fc294ebcae88647e8ac0ebec5456846 Mon Sep 17 00:00:00 2001 From: Nick Schonning Date: Fri, 25 Sep 2026 00:08:39 -0400 Subject: [PATCH 2/2] ci: remove CHECKSUM check --- .github/workflows/missing-checksum.yml | 23 ----------------------- 1 file changed, 23 deletions(-) delete mode 100644 .github/workflows/missing-checksum.yml diff --git a/.github/workflows/missing-checksum.yml b/.github/workflows/missing-checksum.yml deleted file mode 100644 index fc27e1f2ce..0000000000 --- a/.github/workflows/missing-checksum.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: Check Alpine CHECKSUM - -on: - pull_request: - paths: - - '.github/workflows/missing-checksum.yml' - - '**/alpine*/Dockerfile' - -permissions: - contents: read - -jobs: - test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Count number of Alpine Dockersfiles without CHECKSUM - run: | - git grep -n 'CHECKSUM=""' -- '*alpine*/Dockerfile' | sed -E 's/^([^:]+):([^:]+):\s*/::error file=\1,line=\2::Missing pre-built checksum/' - if [ "${PIPESTATUS[0]}" -eq 0 ]; then - exit 1 - fi