mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
de7858100f
Every stage now starts from node:22-trixie-slim, pinned by its multi-arch index digest, so the native modules load their glibc builds. The arm64 musl Skia build needs ARMv8.2 (LSE atomics, RCpc loads) and dies with SIGILL on an ARMv8.0 core such as the Raspberry Pi 4's Cortex-A72; the glibc build runs there (#1311). The runner keeps what it had: tzdata, TZ, the build-time OS upgrade, the nextjs user (uid 1001, now in group nodejs gid 1001), the backup and GeoLite2 directories and every build-time assertion. pg_dump and pg_restore of major 18 come from the PGDG apt repository, whose signing key is fetched by node and checked against a pinned SHA-256 before apt trusts it; PATH names the major 18 directory so the binary does not depend on Debian's version-picking wrapper. The canvas hoist takes the -gnu binary package by the pinned version and still fails the build on a mismatch. bookworm-slim was the other candidate; on the day of the switch it carried a CRITICAL zlib finding that trixie-slim does not.