Skip to content

chore: verify signature for arm-gcc toolchain #1108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rjaegers wants to merge 5 commits into
base: main
Choose a base branch
from
Open

chore: verify signature for arm-gcc toolchain #1108

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
032ccc5
chore: verify signature for arm-gcc toolchain
rjaegers Jan 28, 2026
8ba1f2c
chore: remove unused apt mounts
rjaegers Jan 28, 2026
46d38cd
chore: update hashes
rjaegers Jan 29, 2026
8768c8e
chore: revert checksums
rjaegers Jan 29, 2026
39c7cdf
chore: switch to manual download as ADD leads to 403
rjaegers Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 21 additions & 5 deletions .devcontainer/cpp/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,28 @@ ARG XWIN_VERSION
WORKDIR /

RUN --mount=from=downloader,target=/dl <<EOF
set -e

set -euo pipefail

ARM_GNU_TOOLCHAIN_URL="https://developer.arm.com/-/media/Files/downloads/gnu/14.2.rel1/binrel/arm-gnu-toolchain-14.2.rel1-$(uname -m)-arm-none-eabi.tar.xz"
ARM_GNU_TOOLCHAIN_TAR="/tmp/arm-gnu-toolchain.tar.xz"

if [[ "$(uname -m)" == "x86_64" ]]; then
ARM_GNU_TOOLCHAIN_SHA256="62a63b981fe391a9cbad7ef51b17e49aeaa3e7b0d029b36ca1e9c3b2a9b78823"
elif [[ "$(uname -m)" == "aarch64" ]]; then
ARM_GNU_TOOLCHAIN_SHA256="87330bab085dd8749d4ed0ad633674b9dc48b237b61069e3b481abd364d0a684"
fi

wget --no-hsts -qO "${ARM_GNU_TOOLCHAIN_TAR}" "${ARM_GNU_TOOLCHAIN_URL}"
echo "${ARM_GNU_TOOLCHAIN_SHA256} ${ARM_GNU_TOOLCHAIN_TAR}" | sha256sum -c -

tar xJf "${ARM_GNU_TOOLCHAIN_TAR}" --exclude="*arm-none-eabi-gdb*" --exclude="share" --strip-components=1
Copy link

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tar extraction uses --strip-components=1 but extracts to the current directory (/src) without specifying a target directory. Later, line 133 expects the extracted content at /src/arm-none-eabi. The strip-components will remove the top-level directory name from the archive, so the extraction may not produce the expected /src/arm-none-eabi path. Either remove --strip-components=1 or add -C flag to specify the extraction target explicitly.

Suggested change
tar xJf "${ARM_GNU_TOOLCHAIN_TAR}" --exclude="*arm-none-eabi-gdb*" --exclude="share" --strip-components=1
mkdir -p /src
tar xJf "${ARM_GNU_TOOLCHAIN_TAR}" -C /src --exclude="*arm-none-eabi-gdb*" --exclude="share" --strip-components=1

Copilot uses AI. Check for mistakes.
tar xJf /dl/ccache.tar.xz --strip-components=1 "ccache-${CCACHE_VERSION}-linux-$(uname -m)/ccache"
tar xzf /dl/xwin.tar.gz --strip-components=1 "xwin-${XWIN_VERSION}-$(uname -m)-unknown-linux-musl/xwin"
cp /dl/llvm.gpg.key /llvm.gpg.key
cp /dl/mull.gpg.key /mull.gpg.key

rm -f "${ARM_GNU_TOOLCHAIN_TAR}"
EOF

# Final development container image
Expand Down Expand Up @@ -111,11 +128,10 @@ RUN --mount=type=bind,source=.devcontainer/cpp/apt-requirements-base.json,target
echo -e 'Package: *\nPin: origin "apt.llvm.org"\nPin-Priority: 1000' > /etc/apt/preferences
apt-get update && jq -r 'to_entries | .[] | .key + "=" + .value' /tmp/apt-requirements-clang.json | \
xargs apt-get install -y --no-install-recommends
EOF

# Install arm-gcc toolchain
RUN mkdir /opt/gcc-arm-none-eabi \
&& wget --no-hsts -qO - "https://developer.arm.com/-/media/Files/downloads/gnu/14.2.rel1/binrel/arm-gnu-toolchain-14.2.rel1-$(uname -m)-arm-none-eabi.tar.xz" | tar --exclude='*arm-none-eabi-gdb*' --exclude='share' --strip-components=1 -xJC /opt/gcc-arm-none-eabi
# Install arm-gcc toolchain
mv /src/arm-none-eabi /opt/gcc-arm-none-eabi
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This command assumes that the ARM toolchain was extracted to /src/arm-none-eabi, but the extraction on line 58 doesn't specify -C /src as the destination. The toolchain is being extracted to the working directory (/) with --strip-components=1, which would place the arm-none-eabi directory at /arm-none-eabi, not /src/arm-none-eabi. Either update line 58 to extract to /src or change this line to mv /arm-none-eabi /opt/gcc-arm-none-eabi.

Suggested change
mv /src/arm-none-eabi /opt/gcc-arm-none-eabi
mv /arm-none-eabi /opt/gcc-arm-none-eabi

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This assumes /src/arm-none-eabi exists after extraction on line 64, but the tar command uses --strip-components=1 which removes the top-level directory. The actual directory structure after extraction may not match this expectation. Verify the archive structure and adjust either the extraction command or this mv command accordingly.

Copilot uses AI. Check for mistakes.
EOF

# Install include-what-you-use (iwyu) from source
# hadolint ignore=DL3008
Expand Down
Loading