#188
Pull Requests/baarai/ARTEX/#188

chore(docker): verify tool downloads and pin build inputs

OpenBaaRaiwants to merge intofrom
1 commit1 file changed+90-37

Summary

Carries over the Dockerfile part of #127 by stevenAthompson. Scope is checksums and pins only. The GHCR change from #127 (release.yml and the published-image path in compose and the install scripts) is left out; it is a separate decision. Building from source is already on main via #147 and is unchanged here.

Only Dockerfile changes.

What changes

  • New tools stage (--platform=$BUILDPLATFORM, debian:bookworm-slim) stages the recon binaries. Each release archive is checked against the checksums file of its own GitHub release: the exact asset name is looked up, its sha256 compared, and the build fails with no checksum entry for <asset> or checksum mismatch for <asset>: want ... got ....
    • nuclei v3.11.1, httpx v1.12.0, subfinder v2.17.0, katana v1.8.0 (*_checksums.txt / katana-*-checksums.txt)
    • ffuf v2.3.0 (ffuf_2.3.0_checksums.txt)
    • dalfox v3.2.4 (the per-asset .sha256 file; the release checksum.txt only covers the source archives)
    • sqlmap: shallow clone of tag 1.9.9, checked against commit cceda39208b5aad478de2c3f731df4239d9881f6, then .git is deleted
    • The runtime stage copies /out/ into /usr/local/bin/ and /opt/sqlmap, then runs each tool's version command. dalfox --version failures are no longer ignored.
  • Node v22.23.4 from the official nodejs.org tarball, verified against SHASUMS256.txt, instead of piping the NodeSource setup script into bash. xz-utils is added to the runtime apt list to unpack it.
  • Playwright pinned: @playwright/mcp@0.0.83, @playwright/cli@0.1.22, playwright@1.64.1 (no @latest).
  • Architectures: amd64 and arm64 are mapped explicitly (PD_ARCH, FFUF_ARCH, DALFOX_ARCH, NODE_ARCH); any other architecture fails the build.
  • bbot stays at 3.0.2 with the existing dry-run check.

The checksums come from the same release channel as the archives, so this catches corrupted or swapped downloads and moved tags, not a compromised publisher.

Verification

Run locally in WSL (Kali, Docker with BuildKit, amd64) on a fresh LF clone of this commit. CI does not build the image.

  1. docker build -t artex:verify-127 . → exit 0 (image built; tools stage log shows each fetch/verify; Node step printed v22.23.4 / npm 10.9.9).
  2. docker run --rm --entrypoint sh artex:verify-127 -c 'nuclei -version >/dev/null && httpx -version >/dev/null && subfinder -version >/dev/null && katana -version >/dev/null && ffuf -V >/dev/null && dalfox --version >/dev/null && sqlmap --version >/dev/null && node --version && playwright --version' → exit 0, stdout: 
    v22.23.4
Version 1.64.1
    (--entrypoint sh because the image entrypoint is /app/start.sh, which would pass the command to artex.) Versions reported inside the image: nuclei v3.11.1, httpx v1.12.0, subfinder v2.17.0, katana v1.8.0, ffuf 2.3.0, dalfox 3.2.4, sqlmap 1.9.9#stable (no .git in /opt/sqlmap), @playwright/cli@0.1.22, @playwright/mcp@0.0.83, playwright@1.64.1, bbot 3.0.2.
  3. Negative test, in a temporary copy: the downloaded checksums file had every expected hash replaced with zeros. docker build --target tools . → exit 1 with 
    checksum mismatch for nuclei_3.11.1_linux_amd64.zip: want 0000000000000000000000000000000000000000000000000000000000000000 got ea63d4ae232808cd7c6bc00d0142428e231fab59dae01042246097d195835ab6
    The temporary copy was removed afterwards.

arm64 was not built locally; its asset names and checksum entries were checked against the release files.

Activity

1
B
chore(docker): verify tool downloads and pin build inputs
ac003ed