git-gate gateway bakes in wrong-arch gitleaks (Exec format error on push) #407

New Issue

2026-07-17T22:15:26-04:00

didericis-claude commented

2026-07-17 22:15:26 -04:00

Summary

Dockerfile.gateway hardcoded the x86_64 gitleaks release asset (gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz). An image built on/for aarch64 (Apple Silicon) therefore bakes in an x86_64 gitleaks binary.

The mismatch is silent at build time. It only surfaces when the git-gate pre-receive hook first invokes gitleaks, where the kernel refuses to exec the foreign-arch binary:

gitleaks: Exec format error

Every push through an arm64-built gateway then fails. This is not a per-sandbox / push-logic issue — it is the gateway image being built for the wrong architecture. Branches that "pushed fine" did so through an x86_64 gateway or a cached layer.

Fix

Select the gitleaks asset + pinned SHA256 from the build's target architecture:

TARGETARCH (auto-populated by BuildKit), with a dpkg --print-architecture fallback for a legacy builder
hard-fail on any unsupported arch
each arch keeps its own SHA256 verification (no supply-chain regression)

The existing integration test test_gateway_image.py::test_gitleaks_binary_present_and_versioned execs gitleaks version inside the built image, so it now passes on arm64 instead of hitting the same error.

Verified end-to-end on an arm64 host: build resolves TARGETARCH=arm64 -> linux_arm64, SHA checks OK, and /usr/bin/gitleaks version -> 8.30.1 (no exec-format error).

## Summary `Dockerfile.gateway` hardcoded the **x86_64** gitleaks release asset (`gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz`). An image built on/for **aarch64** (Apple Silicon) therefore bakes in an x86_64 gitleaks binary. The mismatch is silent at build time. It only surfaces when the git-gate **pre-receive** hook first invokes gitleaks, where the kernel refuses to exec the foreign-arch binary: ``` gitleaks: Exec format error ``` Every push through an arm64-built gateway then fails. This is not a per-sandbox / push-logic issue — it is the gateway image being built for the wrong architecture. Branches that "pushed fine" did so through an x86_64 gateway or a cached layer. ## Fix Select the gitleaks asset + pinned SHA256 from the build's target architecture: - `TARGETARCH` (auto-populated by BuildKit), with a `dpkg --print-architecture` fallback for a legacy builder - hard-fail on any unsupported arch - each arch keeps its own SHA256 verification (no supply-chain regression) The existing integration test `test_gateway_image.py::test_gitleaks_binary_present_and_versioned` execs `gitleaks version` inside the built image, so it now passes on arm64 instead of hitting the same error. Verified end-to-end on an arm64 host: build resolves `TARGETARCH=arm64` -> `linux_arm64`, SHA checks OK, and `/usr/bin/gitleaks version` -> `8.30.1` (no exec-format error).

didericis-claude referenced a pull request that will close this issue

2026-07-17 22:15:49 -04:00

Install the git-gate gitleaks binary for the build's target arch #408

didericis added the Kind/Bug label 2026-07-17 22:27:51 -04:00

didericis closed this issue

2026-07-17 22:31:00 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#407