Install the git-gate gitleaks binary for the build's target arch #408

2026-07-17T22:15:49-04:00

didericis-claude commented

2026-07-17 22:15:49 -04:00

Closes #407.

Summary

Dockerfile.gateway hardcoded the x86_64 gitleaks download (gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz), so a gateway image built on/for aarch64 baked in an x86_64 binary. It sat quiet until the git-gate pre-receive hook first ran it, where the kernel refused the foreign-arch exec (gitleaks: Exec format error), failing every push through that gateway.

Now the asset + pinned SHA256 are picked from the build's target architecture:

TARGETARCH (auto-populated by BuildKit), falling back to dpkg --print-architecture under a legacy builder
hard-fail on any unsupported arch
each arch keeps its own SHA256 verification, so no supply-chain regression

Verification

The existing integration test test_gateway_image.py::test_gitleaks_binary_present_and_versioned execs gitleaks version in the built image, so it now passes on arm64 instead of hitting the same error. Confirmed end-to-end on an arm64 host: build resolves TARGETARCH=arm64 -> linux_arm64, SHA checks OK, and /usr/bin/gitleaks version -> 8.30.1.

Closes #407. ## Summary `Dockerfile.gateway` hardcoded the x86_64 gitleaks download (`gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz`), so a gateway image built on/for aarch64 baked in an x86_64 binary. It sat quiet until the git-gate pre-receive hook first ran it, where the kernel refused the foreign-arch exec (`gitleaks: Exec format error`), failing every push through that gateway. Now the asset + pinned SHA256 are picked from the build's target architecture: - `TARGETARCH` (auto-populated by BuildKit), falling back to `dpkg --print-architecture` under a legacy builder - hard-fail on any unsupported arch - each arch keeps its own SHA256 verification, so no supply-chain regression ## Verification The existing integration test `test_gateway_image.py::test_gitleaks_binary_present_and_versioned` execs `gitleaks version` in the built image, so it now passes on arm64 instead of hitting the same error. Confirmed end-to-end on an arm64 host: build resolves `TARGETARCH=arm64` -> `linux_arm64`, SHA checks OK, and `/usr/bin/gitleaks version` -> `8.30.1`.

didericis-claude added 1 commit 2026-07-17 22:15:50 -04:00

fix(git-gate): install the gitleaks binary for the build's target arch 2aec30e501

The gateway Dockerfile hardcoded the linux_x64 gitleaks download, so an
image built on/for aarch64 (Apple Silicon) baked in an x86_64 binary.
It sat quiet until the git-gate pre-receive hook first invoked it, where
the kernel refused the foreign-arch exec — `gitleaks: Exec format error`
— failing every push through that gateway.

Pick the asset + pinned SHA from the build's target architecture:
TARGETARCH (auto-populated by BuildKit) with a `dpkg --print-architecture`
fallback for a legacy builder, and hard-fail on any unsupported arch.
Each arch keeps its own SHA256 verification, so no supply-chain regression.

The existing integration test test_gateway_image.py::
test_gitleaks_binary_present_and_versioned execs `gitleaks version` in the
built image, so it now passes on arm64 instead of hitting the same error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

didericis merged commit 2aec30e501 into main

2026-07-17 22:30:59 -04:00

didericis deleted branch fix-gateway-gitleaks-arch

2026-07-17 22:31:00 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#408