fix: replace vulnerable container bases and release v0.1.21

scripts/production-deploy.py

@@ -375,9 +375,7 @@ class Deploy:
                 "DOCKER_PIP_FALLBACK_INDEX_URL"
             )
             or "https://pypi.org/simple",
-            "DEBIAN_MIRROR": self.env.get("DEBIAN_MIRROR") or "deb.debian.org",
-            "DEBIAN_SECURITY_MIRROR": self.env.get("DEBIAN_SECURITY_MIRROR")
-            or "deb.debian.org",
+            "ALPINE_MIRROR": self.env.get("ALPINE_MIRROR") or "dl-cdn.alpinelinux.org",
             "BUILD_COMMIT": commit,
             "BUILD_TIME": now,
         }.items():

scripts/server-release.py

@@ -10,6 +10,7 @@ import shutil
 import sqlite3
 import subprocess
 import time
+import tomllib
 import urllib.request
 from pathlib import Path
 
@@ -139,9 +140,6 @@ def release(lock):
     before = inspect()
     old_env = dict(s.split("=", 1) for s in before["Config"]["Env"])
     verify_runtime(old_env["BUILD_COMMIT"])
-    assert run("docker", "exec", CONTAINER, "cat", "/app/requirements.lock") == (
-        (ctx / "requirements.lock").read_text().strip()
-    ), "Dependencies differ; full build required"
     stamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%dT%H%M%SZ")
     backup = RECOVERY / ("release-" + stamp + "-" + commit[:12])
     backup.mkdir(mode=0o700)
@@ -153,29 +151,26 @@ def release(lock):
         with sqlite3.connect(backup / "frameflow.before.db") as dst:
             src.backup(dst)
             assert dst.execute("pragma quick_check").fetchone()[0] == "ok"
-    base = "pigway-frame-flow:release-base-" + commit[:12]
-    run("docker", "image", "tag", before["Image"], base)
-    image = "pigway-frame-flow:0.1.19-" + commit[:12]
-    try:
-        run(
-            "docker",
-            "build",
-            "--pull=false",
-            "--network=none",
-            "-f",
-            str(ctx / "deploy/Dockerfile.runtime-update"),
-            "--build-arg",
-            "BASE_IMAGE=" + base,
-            "--build-arg",
-            "BUILD_COMMIT=" + commit,
-            "--build-arg",
-            "BUILD_TIME=" + stamp,
-            "-t",
-            image,
-            str(ctx),
-        )
-    finally:
-        run("docker", "image", "rm", base)
+    version = tomllib.loads((ctx / "pyproject.toml").read_text())["project"]["version"]
+    assert re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version)
+    image = "pigway-frame-flow:" + version + "-" + commit[:12]
+    # A source-only overlay would retain vulnerable packages from the old image.
+    run(
+        "docker",
+        "build",
+        "--pull",
+        "-f",
+        str(ctx / "Dockerfile"),
+        "--build-arg",
+        "BUILD_COMMIT=" + commit,
+        "--build-arg",
+        "BUILD_TIME=" + stamp,
+        "--build-arg",
+        "ALPINE_MIRROR=" + os.getenv("ALPINE_MIRROR", "dl-cdn.alpinelinux.org"),
+        "-t",
+        image,
+        str(ctx),
+    )
     compose = json.loads((APP / "compose.json").read_text())
     service = compose["services"][CONTAINER]
     service["image"] = image