From 1ae12955f3468aaca25bb29bf652c560fa37696c Mon Sep 17 00:00:00 2001 From: Alix-007 Date: Thu, 16 Jul 2026 18:42:07 +0800 Subject: [PATCH] fix(docker): bound Docker GPG key download (#108894) --- Dockerfile | 3 ++- src/dockerfile.test.ts | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8fd7c0f4f11..dfa62368c0e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -313,7 +313,8 @@ RUN --mount=type=cache,id=openclaw-bookworm-apt-cache,target=/var/cache/apt,shar # Require exactly one primary key (`pub` in --with-colons; subkeys use `sub`) so we # never pin the first fingerprint while apt trusts extra keys from the same file. # Update OPENCLAW_DOCKER_GPG_FINGERPRINT when Docker rotates release keys. - curl -fsSL https://download.docker.com/linux/debian/gpg -o /tmp/docker.gpg.asc && \ + curl -fsSL --connect-timeout 10 --max-time 120 \ + https://download.docker.com/linux/debian/gpg -o /tmp/docker.gpg.asc && \ expected_fingerprint="$(printf '%s' "$OPENCLAW_DOCKER_GPG_FINGERPRINT" | tr '[:lower:]' '[:upper:]' | tr -d '[:space:]')" && \ docker_gpg_pub_count="$(gpg --batch --show-keys --with-colons /tmp/docker.gpg.asc | awk -F: '$1 == "pub" { c++ } END { print c+0 }')" && \ if [ "$docker_gpg_pub_count" != "1" ]; then \ diff --git a/src/dockerfile.test.ts b/src/dockerfile.test.ts index 234d54d4f32..8186bda4cb0 100644 --- a/src/dockerfile.test.ts +++ b/src/dockerfile.test.ts @@ -540,8 +540,11 @@ describe("Dockerfile", () => { it("counts primary pub keys before Docker apt fingerprint compare and dearmor", async () => { const dockerfile = collapseDockerContinuations(await readFile(dockerfilePath, "utf8")); + expect(dockerfile).toMatch( + /curl -fsSL --connect-timeout 10 --max-time 120\s+https:\/\/download\.docker\.com\/linux\/debian\/gpg -o \/tmp\/docker\.gpg\.asc/u, + ); const anchor = dockerfile.indexOf( - "curl -fsSL https://download.docker.com/linux/debian/gpg -o /tmp/docker.gpg.asc", + "https://download.docker.com/linux/debian/gpg -o /tmp/docker.gpg.asc", ); expect(anchor).toBeGreaterThan(-1); const slice = dockerfile.slice(anchor);