feat: download busybox from fc-busybox release instead of embedding#2281
feat: download busybox from fc-busybox release instead of embedding#2281tomassrnka wants to merge 9 commits intomainfrom
Conversation
PR SummaryMedium Risk Overview Written by Cursor Bugbot for commit bf39424. This will update automatically on new commits. Configure here. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Download busybox binary from e2b-dev/fc-busybox GitHub release at Docker build time (via ADD) and at local build time (via curl in Makefile). Removes ~3.2MB of committed binaries from git. - Dockerfile: ADD from GitHub release, uses TARGETARCH - Makefile: fetch-busybox target for local dev builds - Both amd64 and arm64 binaries from same reproducible CI build Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CI runs go test/lint directly (not via Docker), so the busybox binary for go:embed must be downloaded first. Add fetch-busybox to orchestrator test setup and lint workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Dockerfile: download with curl + sha256sum verification per arch - Makefile: track version in .version file to detect stale binaries, write to .tmp first to avoid partial downloads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Dockerfile: download SHA256SUMS from release, verify binary against it (no more hardcoded checksums that need manual updating) - Makefile: track version+arch in .version file to detect stale binaries, write to .tmp first to avoid partial downloads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Move RUN after COPY ./orchestrator/pkg so the target directory exists
- Download as /tmp/{binary_name} (not /tmp/busybox) so sha256sum -c
can find the file by the name in SHA256SUMS
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…r local dev - Dockerfile: build go directly instead of make build-local, so fetch-busybox doesn't overwrite the SHA256-verified binary - Makefile: restore stamp file for version tracking in local dev, only used by build-local/build-debug (not Docker) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tomassrnka
force-pushed
the
feat/busybox-download-from-release
branch
from
44bddeb to
2a51117
Compare
…st/lint - Dockerfile: wrap cd /tmp in subshell so mv/chmod use correct WORKDIR, use absolute paths for destination - Makefile: add fetch-busybox dependency to test and lint targets Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Download SHA256SUMS from the fc-busybox release and verify the binary checksum, matching the Dockerfile verification pattern. All build paths now verify integrity. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
test and lint are called inside test.Dockerfile which doesn't have the pkg/ directory. CI workflows have their own fetch-busybox setup steps. Local dev gets busybox via build-local/build-debug before running test/lint. fetch-busybox remains on: build-local, build-debug (the entry points for local builds that produce the full binary). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 participants
Summary
ADDfrom GitHub release, usesTARGETARCHfor correct archfetch-busyboxtarget for local dev builds (build-local,build-debug)Test plan
make build-localdownloads busybox and builds