From d94764f00168471ffa2f825f462f1383a5894737 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 14 Oct 2026 21:07:26 +0200 Subject: [PATCH] Build build-agent and route-proxy without a build ID (hq issue 721) Go's build ID hashes every input package, so a change mesh-builder never reaches still changed its bytes; without it, a rebuild of the same program is the same file, and the check can say the module is unchanged. --- modules/build-agent/Dockerfile | 2 +- modules/route-proxy/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/build-agent/Dockerfile b/modules/build-agent/Dockerfile index 8abeaa19..55f388d9 100644 --- a/modules/build-agent/Dockerfile +++ b/modules/build-agent/Dockerfile @@ -14,7 +14,7 @@ WORKDIR /src COPY go.mod go.sum ./ RUN go mod download COPY . . -RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-builder ./cmd/mesh-builder +RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false -ldflags=-buildid= -o /mesh-builder ./cmd/mesh-builder # Unlike mesh-controller's own FROM scratch (ADR 0006: nothing to audit but one binary), the build # machine's whole job is shelling out to git and docker — it needs a real userland to do that in, diff --git a/modules/route-proxy/Dockerfile b/modules/route-proxy/Dockerfile index b556c2f6..7e7fe648 100644 --- a/modules/route-proxy/Dockerfile +++ b/modules/route-proxy/Dockerfile @@ -20,7 +20,7 @@ WORKDIR /src COPY go.mod go.sum ./ RUN go mod download COPY . . -RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-route-proxy ./examples/route-proxy +RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false -ldflags=-buildid= -o /mesh-route-proxy ./examples/route-proxy # A small runtime with the public CA roots the ACME client needs to reach a real authority, and run # as root so it can bind :80 and :443 — the two privileged ports a public front door listens on.