From c7f3df11a7b402fc1a1e47334fc123cd668665b6 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Tue, 1 Sep 2026 09:19:00 -0500 Subject: [PATCH] fix(agent-runtime): the OPA download follows its redirect instead of silently writing nothing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The build step I added in 73e5873e failed in CI, and it failed in the one way its own guard could not catch. `wget -qO /tmp/opa ` exits **0 without writing the file**. The OPA download URL redirects to another host, and the BusyBox wget that Alpine ships does not follow it — but it reports success anyway. `set -eu` had nothing to catch, so the run continued and died three commands later on `mv: can't rename '/tmp/opa': No such file or directory`, an error that names neither the cause nor the URL. `curl -fsSL` instead: `-f` turns an HTTP error into a non-zero exit, `-L` follows the redirect, and `test -s` refuses an empty file. The `opa version` assertion that was supposed to be the backstop now actually gets to run. Why this shipped: the original commit said in as many words that the image build was NOT verified, because no Docker daemon was available at the time — and the image build was exactly what broke. I checked the URL with `curl -IL`, which follows redirects, and did not consider that BusyBox would not. Verified this time by building it: the image builds, and inside it `.harness/bin/opa version` reports `Version: 1.19.0` from an ELF binary — Linux, not the Mach-O the repository carries. Note for whoever reads the pipeline: `Build & Push Services (GHCR)` does not gate a pull request here. It runs on push, so #669 and #670 both merged green with this broken. A build that only fails after the merge is a build that tells you late. Co-Authored-By: Claude Opus 5 Signed-off-by: aarroyo --- src/apps/agent-runtime-api/Dockerfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/apps/agent-runtime-api/Dockerfile b/src/apps/agent-runtime-api/Dockerfile index 6dceeaa9..85c0c7fc 100644 --- a/src/apps/agent-runtime-api/Dockerfile +++ b/src/apps/agent-runtime-api/Dockerfile @@ -36,10 +36,18 @@ COPY .harness ./.harness # # `_static` is not optional: this is Alpine/musl, and the non-static Linux asset # links against glibc. +# +# `curl -fsSL`, y no `wget`: la URL de descarga REDIRIGE a otro host, y el wget de +# BusyBox que trae Alpine sale con codigo 0 sin escribir el fichero. El `set -eu` no +# lo cazaba —no habia error que cazar— y el fallo aparecia tres ordenes despues, en +# un `mv` que no encontraba nada. `-f` convierte un HTTP de error en salida no nula, +# `-L` sigue la redireccion, y el `test -s` asegura que lo descargado no esta vacio. ARG TARGETARCH -RUN set -eu; \ +RUN apk add --no-cache curl && \ + set -eu; \ OPA_VERSION="$(node --input-type=module -e "import { OPA_VERSION } from 'file:///repo/.harness/scripts/opa-runtime.mjs'; process.stdout.write(OPA_VERSION);")"; \ - wget -qO /tmp/opa "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_${TARGETARCH:-amd64}_static"; \ + curl -fsSL -o /tmp/opa "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_${TARGETARCH:-amd64}_static"; \ + test -s /tmp/opa; \ chmod 0755 /tmp/opa; \ mv /tmp/opa .harness/bin/opa; \ .harness/bin/opa version | grep -q "Version: ${OPA_VERSION}"