decentraland / builder-server / 31191720981 / 1

72%

master: 72%

push

github

fix(auth): harden signed fetch validation (#808)

* chore: inline the Node base image digest in both FROM lines

Revert the NODE_IMAGE build ARG introduced in 102c192 and write the
pinned digest literally in both stages.

The ARG made the pinned base image overridable via --build-arg. The
shared build workflow (decentraland/actions build-quay-main.yml)
forwards a build-args input to buildah, so the override was one config
line away from being reachable, which weakens the point of pinning by
digest at all.

It also hid the base image from tooling: the automated bumps in #804 and
#807 rewrite the literal `FROM node:<tag>@sha256:...` lines, and a
variable FROM would likely stop them (and base-image scanners) from
recognizing it — leaving the pin to go stale, which is the problem this
started as. The duplication the ARG avoided was never a real risk; both
lines have always been updated in lockstep.

Verified: builds to layers byte-identical to 102c192 apart from the
Dockerfile inside COPY . /app; Node v24.18.0 / Alpine 3.24.1;
GET /v1/committee returns the expected 19 addresses.

* fix(auth): harden signed fetch validation

* test(auth): follow authentication use case conventions

1493 of 2315 branches covered (64.49%)

Branch coverage included in aggregate %.

6654 of 8784 relevant lines covered (75.75%)

24.28 hits per line