[GitHub] keith-turner closed pull request #12: Checksum the download of the binaries

[GitBox <gi...@apache.org>]

keith-turner closed pull request #12: Checksum the download of the binaries 
URL: https://github.com/apache/fluo-docker/pull/12
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/Dockerfile b/Dockerfile
index 3408ce5..b17e39b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,11 +19,21 @@ ARG HADOOP_VERSION
 ARG ZOOKEEPER_VERSION
 ARG ACCUMULO_VERSION
 
-ENV HADOOP_VERSION ${HADOOP_VERSION:-2.7.3}
-ENV ZOOKEEPER_VERSION ${ZOOKEEPER_VERSION:-3.4.9}
+ARG HADOOP_HASH
+ARG ZOOKEEPER_HASH
+ARG ACCUMULO_HASH
+
+ENV HADOOP_VERSION ${HADOOP_VERSION:-2.7.5}
+ENV ZOOKEEPER_VERSION ${ZOOKEEPER_VERSION:-3.4.11}
 ENV ACCUMULO_VERSION ${ACCUMULO_VERSION:-1.8.1}
 ENV FLUO_VERSION 1.2.0-SNAPSHOT
 
+ENV HADOOP_HASH ${HADOOP_HASH:-0f90ef671530c2aa42cde6da111e8e47e9cd659e}
+ENV ZOOKEEPER_HASH ${ZOOKEEPER_HASH:-9268b4aed71dccad3d7da5bfa5573b66d2c9b565}
+ENV ACCUMULO_HASH ${ACCUMULO_HASH:-8e6b4f5d9bd0c41ca9a206e876553d8b39923528}
+# Change and uncomment next line when 1.2.0 is released
+# ENV FLUO_HASH ${FLUO_HASH:-xxx}
+
 # Download from Apache mirrors instead of archive #9
 ENV APACHE_DIST_URLS \
   https://www.apache.org/dyn/closer.cgi?action=download&filename= \
@@ -35,21 +45,24 @@ https://archive.apache.org/dist/
 RUN set -eux; \
   download_bin() { \
     local f="$1"; shift; \
+    local hash="$1"; shift; \
     local distFile="$1"; shift; \
     local success=; \
     local distUrl=; \
     for distUrl in $APACHE_DIST_URLS; do \
       if wget -nv -O "$f" "$distUrl$distFile"; then \
         success=1; \
+        # Checksum the download
+        echo "$hash" "*$f" | sha1sum -c -; \
         break; \
       fi; \
     done; \
     [ -n "$success" ]; \
   };\
    \
-   download_bin "accumulo.tar.gz" "accumulo/$ACCUMULO_VERSION/accumulo-$ACCUMULO_VERSION-bin.tar.gz"; \
-   download_bin "hadoop.tar.gz" "hadoop/core/hadoop-$HADOOP_VERSION/hadoop-$HADOOP_VERSION.tar.gz"; \
-   download_bin "zookeeper.tar.gz" "zookeeper/zookeeper-$ZOOKEEPER_VERSION/zookeeper-$ZOOKEEPER_VERSION.tar.gz"
+   download_bin "accumulo.tar.gz" "$ACCUMULO_HASH" "accumulo/$ACCUMULO_VERSION/accumulo-$ACCUMULO_VERSION-bin.tar.gz"; \
+   download_bin "hadoop.tar.gz" "$HADOOP_HASH" "hadoop/core/hadoop-$HADOOP_VERSION/hadoop-$HADOOP_VERSION.tar.gz"; \
+   download_bin "zookeeper.tar.gz" "$ZOOKEEPER_HASH" "zookeeper/zookeeper-$ZOOKEEPER_VERSION/zookeeper-$ZOOKEEPER_VERSION.tar.gz"
 
 RUN tar xzf accumulo.tar.gz -C /tmp/
 RUN tar xzf hadoop.tar.gz -C /tmp/
diff --git a/README.md b/README.md
index 960c1f2..3b74116 100644
--- a/README.md
+++ b/README.md
@@ -21,8 +21,8 @@ While it is easier to pull from DockerHub, the image will default to the softwar
 |-------------|---------|
 | [Fluo]      | 1.2.0   |
 | [Accumulo]  | 1.8.1   |
-| [Hadoop]    | 2.7.3   |
-| [Zookeeper] | 3.4.9   |
+| [Hadoop]    | 2.7.5   |
+| [Zookeeper] | 3.4.11  |
 
 If these versions do not match what is running on your cluster, you should consider building
 your own image with matching versions. However, Fluo must be 1.2+.
@@ -51,7 +51,16 @@ Below are instructions for building an image:
 
    Or build the Fluo docker image with specific versions of Hadoop, Zookeeper, etc using the command below:
 
-        docker build --build-arg ZOOKEEPER_VERSION=3.4.8 --build-arg ACCUMULO_VERSION=1.7.3 --build-arg HADOOP_VERSION=2.7.0 -t fluo .
+        docker build \
+        --build-arg ZOOKEEPER_VERSION=3.4.11 \
+        --build-arg ZOOKEEPER_HASH=9268b4aed71dccad3d7da5bfa5573b66d2c9b565 \
+        --build-arg ACCUMULO_VERSION=1.8.1 \
+        --build-arg ACCUMULO_HASH=8e6b4f5d9bd0c41ca9a206e876553d8b39923528 \
+        --build-arg HADOOP_VERSION=2.7.5 \
+        --build-arg HADOOP_HASH=0f90ef671530c2aa42cde6da111e8e47e9cd659e \
+        -t fluo .
+
+   Don't forget to update the HASH of the chosen version. We use SHA1 to validate the hash.
 
 ## Next steps
 


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services