decentraland / builder-server / 31191720981

72%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): harden signed fetch validation (#808)

* chore: inline the Node base image digest in both FROM lines

Revert the NODE_IMAGE build ARG introduced in 102c192 and write the
pinned digest literally in both stages.

The ARG made the pinned base image overridable via --build-arg. The
shared build workflow (decentraland/actions build-quay-main.yml)
forwards a build-args input to buildah, so the override was one config
line away from being reachable, which weakens the point of pinning by
digest at all.

It also hid the base image from tooling: the automated bumps in #804 and
#807 rewrite the literal `FROM node:<tag>@sha256:...` lines, and a
variable FROM would likely stop them (and base-image scanners) from
recognizing it — leaving the pin to go stale, which is the problem this
started as. The duplication the ARG avoided was never a real risk; both
lines have always been updated in lockstep.

Verified: builds to layers byte-identical to 102c192 apart from the
Dockerfile inside COPY . /app; Node v24.18.0 / Alpine 3.24.1;
GET /v1/committee returns the expected 19 addresses.

* fix(auth): harden signed fetch validation

* test(auth): follow authentication use case conventions

Coverage Stats

1446 of 2220 branches covered (65.14%)

Branch coverage included in aggregate %.

35 of 40 new or added lines in 2 files covered. (87.5%)

44 existing lines in 3 files now uncovered.

3327 of 4392 relevant lines covered (75.75%)

48.55 hits per line