From d3627f29c84f6b88a1468d7a2fba964a3c431679 Mon Sep 17 00:00:00 2001 From: jxxghp Date: Wed, 26 Aug 2026 23:04:21 +0800 Subject: [PATCH] fix(docker): refresh OpenSSL security packages --- docker/Dockerfile | 1 + tests/test_release_supply_chain.py | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 0d703c7e4..096c7b55b 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -88,6 +88,7 @@ RUN apt-get update \ lsof \ nano \ unar \ + openssl \ postgresql-client-18 \ libchromaprint-tools \ libjemalloc2 \ diff --git a/tests/test_release_supply_chain.py b/tests/test_release_supply_chain.py index 46dfb6e36..2b5db8fb3 100644 --- a/tests/test_release_supply_chain.py +++ b/tests/test_release_supply_chain.py @@ -32,7 +32,7 @@ def _steps_by_name(workflow: dict) -> dict[str, dict]: def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() -> None: - """基础镜像允许获得上游更新，构建阶段不得无边界升级整套 Debian。""" + """基础镜像允许更新，并仅显式刷新运行时安全包而非整套 Debian。""" dockerfile = DOCKERFILE.read_text(encoding="utf-8") assert 'ARG MOVIEPILOT_PYTHON_VERSION="3.14.7"' in dockerfile @@ -45,6 +45,7 @@ def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() -> assert "ARG MOVIEPILOT_PYTHON_VERSION" in free_threaded_stage assert 'uv python install --no-bin "${MOVIEPILOT_PYTHON_VERSION}t"' in free_threaded_stage assert "apt-get upgrade" not in dockerfile + assert "\n openssl \\\n" in dockerfile assert "\n util-linux \\\n" in dockerfile