Repository navigation
Render per-arch image layer steps as valid sh - #248
Merged
Merged
Conversation
A layer whose download URL or apt version differs by arch rendered its uname case through the statement joiner, so the RUN had 'in;' and ';;;' and every image build with such a layer failed with a sh syntax error. The case is now one statement whose arms join on a bare continuation. SbtImageSpec parses every rendered RUN with 'sh -n'. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
An
SbtImageLayerwhose steps differ by CPU arch (anImageStep.FileorImageStep.TreeURL, or anImageStep.Aptversion) renders acase "$(uname -m)"block. That block went through the same; \joiner as the layer's statements, so theRUNcame out as:in;and;;;are sh syntax errors (Syntax error: word unexpected (expecting ")")in dash,syntax error near unexpected token ';'in bash). Any derived sbt image with a per-arch layer fails to build. A JDK, or any other native binary, is always per-arch, so the documentedImageStep.Treeexample in Caching could not be built either.The existing specs only checked that the rendered text contained the URLs and
uname -m, so nothing parsed the shell.Fix
archCaserenders thecaseas one statement: its arms join on a bare continuation, and onlyesactakes the statement separator. File, Tree, and Apt share it. A single-arch layer renders as before.Proof
SbtImageSpectest: everyRUNof a Dockerfile with a per-archTreeand a per-archAptlayer is joined the way Docker joins continuations, then checked withsh -n. It failed before the fix with the syntax errors above, and passes after.core/testFull: 1010 passed.docs/testOnly zipx.docs.Caching: 6 passed.Consumer
Found while adding a Temurin JDK layer to a downstream CI image (CVE-2026-91403: the pinned sbtscala image's JDK trusts a compromised root, and no newer sbtscala tag exists). That repo will pin this PR's snapshot.
Made with Cursor