From 2aec30e50155f1fcf0f91a612b3b66ee0e4d591e Mon Sep 17 00:00:00 2001 From: didericis Date: Fri, 17 Jul 2026 22:14:47 -0400 Subject: [PATCH] fix(git-gate): install the gitleaks binary for the build's target arch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gateway Dockerfile hardcoded the linux_x64 gitleaks download, so an image built on/for aarch64 (Apple Silicon) baked in an x86_64 binary. It sat quiet until the git-gate pre-receive hook first invoked it, where the kernel refused the foreign-arch exec — `gitleaks: Exec format error` — failing every push through that gateway. Pick the asset + pinned SHA from the build's target architecture: TARGETARCH (auto-populated by BuildKit) with a `dpkg --print-architecture` fallback for a legacy builder, and hard-fail on any unsupported arch. Each arch keeps its own SHA256 verification, so no supply-chain regression. The existing integration test test_gateway_image.py:: test_gitleaks_binary_present_and_versioned execs `gitleaks version` in the built image, so it now passes on arm64 instead of hitting the same error. Co-Authored-By: Claude Opus 4.8 --- Dockerfile.gateway | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/Dockerfile.gateway b/Dockerfile.gateway index 29448fa..b7ec70c 100644 --- a/Dockerfile.gateway +++ b/Dockerfile.gateway @@ -66,11 +66,25 @@ RUN pip install --no-cache-dir mitmproxy==11.1.3 # would pin us to that image's cadence). python (already present) does the # download so we add no curl/wget. trixie apt also ships gitleaks, but an # older 8.16; the pinned download keeps the verified 8.30.1. +# +# Arch-aware: the asset + SHA are picked from the build's target +# architecture so an arm64 host (Apple Silicon) gets the arm64 binary +# rather than an x86_64 one that dies with "Exec format error" the first +# time the pre-receive hook runs it. TARGETARCH is auto-populated by +# BuildKit; the dpkg fallback keeps it correct under a legacy builder. ARG GITLEAKS_VERSION=8.30.1 -ARG GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb -RUN url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ +ARG GITLEAKS_SHA256_AMD64=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb +ARG GITLEAKS_SHA256_ARM64=e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080 +ARG TARGETARCH +RUN arch="${TARGETARCH:-$(dpkg --print-architecture)}" \ + && case "$arch" in \ + amd64) asset="linux_x64"; sha="${GITLEAKS_SHA256_AMD64}" ;; \ + arm64) asset="linux_arm64"; sha="${GITLEAKS_SHA256_ARM64}" ;; \ + *) echo "unsupported gitleaks target arch: $arch" >&2; exit 1 ;; \ + esac \ + && url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${asset}.tar.gz" \ && python3 -c "import sys,urllib.request; urllib.request.urlretrieve(sys.argv[1], '/tmp/gitleaks.tar.gz')" "$url" \ - && echo "${GITLEAKS_SHA256} /tmp/gitleaks.tar.gz" | sha256sum -c - \ + && echo "${sha} /tmp/gitleaks.tar.gz" | sha256sum -c - \ && tar -xzf /tmp/gitleaks.tar.gz -C /usr/bin gitleaks \ && rm /tmp/gitleaks.tar.gz