From b9a4c783972961e65b92ca1efcf61fc12cf0ee11 Mon Sep 17 00:00:00 2001
From: Adam Chrapkowski <adam.chrapkowski@sourcegraph.com>
Date: Thu, 22 Oct 2026 07:09:14 +0000
Subject: [PATCH] fix(docker): base images on ruby:3.4-slim-trixie

Move the scip-ruby Docker images from ruby:2.7.6-alpine3.16 to
ruby:3.4-slim-trixie (Debian 13):

- Trust store: the images still trusted the compromised eMudhra intermediate
  CAs (https://emudhra.we-have-a-problem.com/). Alpine 3.16 is end-of-life and
  has no fixed ca-certificates; Debian 13 ships 20250419+deb13u1, which
  distrusts emSign ECC Root CA - G3 and Comodo AAA Certificate Services.
  ca-certificates is installed explicitly so builds pick up security updates.
- glibc: Linux release binaries built on Ubuntu 24.04 (v0.4.8, v0.5.0) need
  glibc 2.38 symbols (__isoc23_*) that gcompat on Alpine lacks, so scip-ruby
  could not start in those images. Debian 13 has glibc 2.41. The base build
  now runs `scip-ruby --version` to catch this.
- Ruby 3.4 replaces Ruby 2.7, which current sorbet (>= 3.0) and tapioca
  (>= 3.3) no longer support.
---
 Dockerfile.base | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/Dockerfile.base b/Dockerfile.base
index 5dc3605a9..4047aa4ac 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -1,5 +1,5 @@
 FROM --platform=linux/amd64 \
-    ruby:2.7.6-alpine3.16@sha256:b014cf3e792d7130daec772241a211c40be009fc7f00e2b728ffe26805649575
+    ruby:3.4-slim-trixie@sha256:a1e521f7710a59431695c0628de8ffdbbceec17065a217bd67b59343d4d17b22
 
 # This is the base Docker image for scip-ruby with common dependencies
 
@@ -10,19 +10,18 @@ ARG SCIP_RUBY_VERSION
 RUN test -n "${SCIP_RUBY_VERSION}" || \
     (echo "ERROR: SCIP_RUBY_VERSION build arg is required" && exit 1)
 
-# gcompat is a glibc-musl compat library (scip-ruby links in glibc)
-# Other deps are to help build C extensions in gems.
-RUN apk add --no-cache \
-    bash \
-    wget \
-    make \
-    libstdc++ \
-    gcc \
-    g++ \
-    automake \
-    autoconf \
-    gcompat \
-    git
+# ca-certificates is listed so the build picks up trust store fixes from
+# trixie-security (e.g. 20250419+deb13u1 distrusts the compromised eMudhra chains).
+# The other deps are used by the autoindex script and to build C extensions in gems.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        wget \
+        git \
+        build-essential \
+        automake \
+        autoconf && \
+    rm -rf /var/lib/apt/lists/*
 
 # Use a release binary instead of building from source
 # because release builds are very time-consuming.
@@ -31,9 +30,13 @@ RUN apk add --no-cache \
 # The binary at this version is guaranteed to exist because this workflow runs either:
 # 1. Manually with a specific tag that already has a release
 # 2. After the Release workflow completes (which creates the release and uploads the binary)
+#
+# `scip-ruby --version` fails the build if the binary can't run on this base
+# (e.g. it needs a newer glibc).
 RUN wget https://github.com/sourcegraph/scip-ruby/releases/download/scip-ruby-v${SCIP_RUBY_VERSION}/scip-ruby-x86_64-linux \
     -O /usr/bin/scip-ruby && \
-    chmod +x /usr/bin/scip-ruby
+    chmod +x /usr/bin/scip-ruby && \
+    scip-ruby --version
 
 # Set working directory for sources
 WORKDIR /sources