Skip to content

feature: upgrade cronos to 1.6.2 #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bhaveshtank wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feature: upgrade cronos to 1.6.2 #94

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ RUN mkdir -p /home/cronos/data && mkdir -p /home/cronos/config
RUN apt-get update -y && apt-get install wget curl procps net-tools jq lz4 -y

# Download and verify tarball
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.6.1/cronos_1.6.1_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.1_Linux_x86_64.tar.gz \
&& rm cronos_1.6.1_Linux_x86_64.tar.gz && mv ./* /home/cronos/
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos-v1.6.2/raw/main/cronos_1.6.2_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.2_Linux_x86_64.tar.gz \
&& rm cronos_1.6.2_Linux_x86_64.tar.gz && mv ./* /home/cronos/
Comment on lines +11 to +12
Copy link

@coderabbitai coderabbitai bot Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Cronos v1.6.2 official release SHA256 checksum GitHub

💡 Result:

I couldn't find an official GitHub release for "v1.6.2" of crypto-org-chain/cronos. The repository's Releases page shows v1.6.1 (latest) and v1.6.0, but no v1.6.2 entry. See the releases list on GitHub. [1]

Source:
[1] crypto-org-chain/cronos — Releases (GitHub). [https://github.com/crypto-org-chain/cronos/releases]

🏁 Script executed:

#!/bin/bash
# Search for Cronos release information in GitHub or official sources
curl -s "https://api.github.com/repos/crypto-org-chain/cronos/releases" | \
  jq -r '.[] | select(.tag_name | contains("v1.6.2")) | {tag_name, assets: .assets[].name, download_url: .assets[].browser_download_url}' | head -50

Repository: chainstack/cronos-docker

Length of output: 50

🏁 Script executed:

#!/bin/bash
# Check if v1.6.2 tag exists in the repository
curl -s "https://api.github.com/repos/crypto-org-chain/cronos/git/refs/tags" | \
  jq -r '.[] | select(.ref | contains("v1.6.2")) | .ref'

# Also check all recent tags
echo "=== Recent tags in crypto-org-chain/cronos ==="
curl -s "https://api.github.com/repos/crypto-org-chain/cronos/git/refs/tags" | \
  jq -r '.[-20:] | .[] | .ref' | sort -V | tail -10

Repository: chainstack/cronos-docker

Length of output: 311

🏁 Script executed:

#!/bin/bash
# Check the URL structure - does the path "cronos-v1.6.2" exist as a repo or path?
# Try to verify if this is a valid download endpoint
echo "Testing URL accessibility..."
curl -sI "https://github.com/crypto-org-chain/cronos-v1.6.2/raw/main/cronos_1.6.2_Linux_x86_64.tar.gz" 2>&1 | head -20

# Also check if cronos-v1.6.2 exists as a separate repository
echo -e "\n=== Checking if cronos-v1.6.2 is a separate repo ==="
curl -s "https://api.github.com/repos/crypto-org-chain/cronos-v1.6.2" | jq -r '.name, .full_name, .status' 2>/dev/null || echo "Repository not found or 404"

Repository: chainstack/cronos-docker

Length of output: 4408

🏁 Script executed:

#!/bin/bash
# Get metadata about the cronos-v1.6.2 repository
curl -s "https://api.github.com/repos/crypto-org-chain/cronos-v1.6.2" | jq -r '{owner: .owner.login, name: .name, description, is_fork: .fork, parent_repo: .parent.full_name, created_at: .created_at, pushed_at: .pushed_at}'

# Check for releases in this separate repo
echo -e "\n=== Releases in cronos-v1.6.2 repo ==="
curl -s "https://api.github.com/repos/crypto-org-chain/cronos-v1.6.2/releases" | jq -r '.[] | {tag_name, assets: [.assets[].name]}'

# Check if there are any release notes or checksums in the main branch
echo -e "\n=== Check for checksums or release notes ==="
curl -s "https://api.github.com/repos/crypto-org-chain/cronos-v1.6.2/contents/" | jq -r '.[] | .name' | grep -i -E 'sha|check|release|hash'

Repository: chainstack/cronos-docker

Length of output: 413

🏁 Script executed:

#!/bin/bash
# Fetch checksums for Cronos v1.6.2
echo "=== Linux x86_64 checksum ==="
curl -s "https://raw.githubusercontent.com/crypto-org-chain/cronos-v1.6.2/main/checksums.txt" | grep -i "linux.*x86_64"

echo -e "\n=== All checksums in checksums.txt ==="
curl -s "https://raw.githubusercontent.com/crypto-org-chain/cronos-v1.6.2/main/checksums.txt"

Repository: chainstack/cronos-docker

Length of output: 963

Remove --no-check-certificate and verify the tarball checksum.

The RUN command disables TLS validation with --no-check-certificate and downloads from a mutable raw/main branch without any checksum verification. This creates unnecessary supply-chain risk. Official checksums are published in the repository; use them.

The official SHA256 for cronos_1.6.2_Linux_x86_64.tar.gz is 33279437c8facb32cfef2da642e452146600c43eddc0ca41cc1804ba9ab4cea5. Add checksum verification and keep TLS validation enabled.

🔒 Suggested hardening 
+ARG CRONOS_VERSION=1.6.2
+ARG CRONOS_SHA256=33279437c8facb32cfef2da642e452146600c43eddc0ca41cc1804ba9ab4cea5
+
-RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos-v1.6.2/raw/main/cronos_1.6.2_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.2_Linux_x86_64.tar.gz \
-     && rm cronos_1.6.2_Linux_x86_64.tar.gz && mv ./* /home/cronos/
+RUN cd /tmp && \
+    wget https://github.com/crypto-org-chain/cronos-v${CRONOS_VERSION}/raw/main/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \
+    echo "${CRONOS_SHA256}  cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz" | sha256sum -c - && \
+    tar -xvf cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \
+    rm cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && mv ./* /home/cronos/
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos-v1.6.2/raw/main/cronos_1.6.2_Linux_x86_64.tar.gz && tar -xvf cronos_1.6.2_Linux_x86_64.tar.gz \
&& rm cronos_1.6.2_Linux_x86_64.tar.gz && mv ./* /home/cronos/
ARG CRONOS_VERSION=1.6.2
ARG CRONOS_SHA256=33279437c8facb32cfef2da642e452146600c43eddc0ca41cc1804ba9ab4cea5
RUN cd /tmp && \
wget https://github.com/crypto-org-chain/cronos-v${CRONOS_VERSION}/raw/main/cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \
echo "${CRONOS_SHA256} cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz" | sha256sum -c - && \
tar -xvf cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && \
rm cronos_${CRONOS_VERSION}_Linux_x86_64.tar.gz && mv ./* /home/cronos/
🧰 Tools
🪛 Checkov (3.2.334)

[high] 11-12: Ensure that certificate validation isn't disabled with wget

(CKV2_DOCKER_3)

🤖 Prompt for AI Agents 
In `@Dockerfile` around lines 11 - 12, Update the RUN step that downloads
cronos_1.6.2_Linux_x86_64.tar.gz: remove the wget --no-check-certificate flag so
TLS validation remains enabled, download the tarball from a fixed release tag
(not raw/main), compute and verify its SHA256 against the official value
33279437c8facb32cfef2da642e452146600c43eddc0ca41cc1804ba9ab4cea5 (e.g., use
sha256sum or openssl dgst) and abort the build if the checksum does not match,
then proceed to extract and move files as before; the change affects the RUN
line handling cronos_1.6.2_Linux_x86_64.tar.gz in the Dockerfile.


# Set permissions
RUN chown -R cronos:cronos /home/cronos && chmod 1777 /tmp
Expand Down