Bump versions

[endersonmaia]

Since Ubuntu released oficial ricvs64 container images for 24.04, I suggest bumping its versions.

Also bumped cartesi/sdk and golang.

I just built but didn't test if everything worked.

[vercel]

@endersonmaia is attempting to deploy a commit to the Bug Buster App Team on Vercel.

A member of the Team first needs to authorize it.

[endersonmaia]

I'm considering sending a PR with a distroless version using Canonical's chisel tool.

It should be good to have a smaller image, it may reduce the attack surface.

[guidanoli]

Maybe we should also bump Ubuntu in the following files:

tests/bounties/busybox-bounty/Dockerfile
tests/bounties/lua-bounty/Dockerfile
tests/bounties/solidity-bounty/Dockerfile
tests/bounties/sqlite-bounty/Dockerfile

[guidanoli]

I'm considering sending a PR with a distroless version using Canonical's chisel tool.

Could you open an issue for it, please?

[endersonmaia]

About reproducibility, should I try to add locked versions to debian packages within this PR or use another one?

[guidanoli]

About reproducibility, should I try to add locked versions to debian packages within this PR or use another one?

Yeah, I think it would be nice to work towards having reproducible builds.
If you want to do it in this PR, or on another, it's totally up to you, though! :-)

[guidanoli]

I ran the tests, and, for some reason, now the BusyBox exploit is not working...
Instead of segfaulting, it now prints the following error message:

ash: arithmetic syntax error

Any insights, @edubart?

[endersonmaia]

Starting with ubuntu:24.04 we can use apt update --snapshot= to guarantee we don't download any "new" package and make the build reproducible.

See: https://snapshot.ubuntu.com/

This way we can avoid pining the package versions, and focus on the --snapshot.

I'll send fixups.

[endersonmaia]

apt update --snapshot wasn´t working due to certificate errors.

I removed the commit where I introduced it, rebased and squashed.

[guidanoli]

apt update --snapshot wasn't working due to certificate errors.

That's a shame!

[endersonmaia]

apt update --snapshot wasn't working due to certificate errors.

That's a shame!

I may go back to that on another PR.

[guidanoli]

Why not fix these versions as well?

[endersonmaia]

Will do.

[endersonmaia]

sent a fixup at c41fcc6

[guidanoli]

Here is the patch that makes the BusyBox exploit still valid.
I've tested locally and seems to work.
Thanks for the help, @edubart!

diff --git a/tests/bounties/busybox-bounty/Makefile b/tests/bounties/busybox-bounty/Makefile
index 790ee66..8fc373d 100644
--- a/tests/bounties/busybox-bounty/Makefile
+++ b/tests/bounties/busybox-bounty/Makefile
@@ -5,7 +5,7 @@ SOURCE_DIR=busybox-$(VERSION)
 BOUNTY_TAR=busybox-$(VERSION)-bounty_$(ARCH).tar.xz
 BOUNTY_RISCV64_TAR=busybox-$(VERSION)-bounty_riscv64.tar.xz
 
-HARDEN_CFLAGS=-Os -D_FORTIFY_SOURCE=2 -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections -Wno-unused-result
+HARDEN_CFLAGS=-O1 -ftrivial-auto-var-init=pattern -D_FORTIFY_SOURCE=2 -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections -Wno-unused-result
 HARDEN_LDFLAGS=-pie -Wl,-z,now,-z,relro,--gc-sections -s
 
 # Use GitHub Actions cache when available
diff --git a/tests/bounties/lua-bounty/Makefile b/tests/bounties/lua-bounty/Makefile
index 49708a5..9898efb 100644
--- a/tests/bounties/lua-bounty/Makefile
+++ b/tests/bounties/lua-bounty/Makefile
@@ -5,7 +5,7 @@ SOURCE_DIR=lua-$(VERSION)
 BOUNTY_TAR=lua-$(VERSION)-bounty_$(ARCH).tar.xz
 BOUNTY_RISCV64_TAR=lua-$(VERSION)-bounty_riscv64.tar.xz
 
-HARDEN_CFLAGS=-Os -D_FORTIFY_SOURCE=2 -fexceptions -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections
+HARDEN_CFLAGS=-O1 -ftrivial-auto-var-init=pattern -D_FORTIFY_SOURCE=2 -fexceptions -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections
 HARDEN_LDFLAGS=-pie -Wl,-z,now,-z,relro,--gc-sections -s
 
 # Use GitHub Actions cache when available
diff --git a/tests/bounties/solidity-bounty/Dockerfile b/tests/bounties/solidity-bounty/Dockerfile
index 4e78a40..e6a5407 100644
--- a/tests/bounties/solidity-bounty/Dockerfile
+++ b/tests/bounties/solidity-bounty/Dockerfile
@@ -36,6 +36,8 @@ ARG VERSION
 RUN wget -O solidity-${VERSION}.tar.gz https://github.com/ethereum/solidity/releases/download/v${VERSION}/solidity_${VERSION}.tar.gz
 RUN tar xzf solidity-${VERSION}.tar.gz
 COPY --from=boost-builder /opt/boost /opt/boost
+ENV CFLAGS="-O1 -ftrivial-auto-var-init=pattern -D_FORTIFY_SOURCE=2 -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections -Wno-unused-result"
+ENV CXXFLAGS=$CFLAGS
 RUN cmake \
     -S solidity_${VERSION} \
     -B solidity_${VERSION}/build \
diff --git a/tests/bounties/sqlite-bounty/Makefile b/tests/bounties/sqlite-bounty/Makefile
index 3e44e1b..cd86918 100644
--- a/tests/bounties/sqlite-bounty/Makefile
+++ b/tests/bounties/sqlite-bounty/Makefile
@@ -6,7 +6,7 @@ BOUNTY_TAR=sqlite-$(VERSION)-bounty_$(ARCH).tar.xz
 BOUNTY_RISCV64_TAR=sqlite-$(VERSION)-bounty_riscv64.tar.xz
 
 CC=gcc
-HARDEN_CFLAGS=-Os -D_FORTIFY_SOURCE=2 -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections
+HARDEN_CFLAGS=-O1 -ftrivial-auto-var-init=pattern -D_FORTIFY_SOURCE=2 -fPIE -fstack-clash-protection -fstack-protector-strong -ffunction-sections -fdata-sections
 HARDEN_LDFLAGS=-pie -Wl,-z,now,-z,relro,--gc-sections
 SQLITE_CFLAGS=-DSQLITE_THREADSAFE=0 -DSQLITE_OMIT_LOAD_EXTENSION
 SQLITE_LDFLAGS=-lm -s

[guidanoli]

Can you rebase, to trigger the new CI on PRs?

[guidanoli]

I think the CI is failing because you opened a PR from your fork under endersonmaia, and it's not able to push the images to GHCR under crypto-bug-hunters, even with pr- tags. Could you push your branch to crypto-bug-hunters/bug-buster, and update this PR to use that?

[endersonmaia]

I think the CI is failing because you opened a PR from your fork under endersonmaia, and it's not able to push the images to GHCR under crypto-bug-hunters, even with pr- tags. Could you push your branch to crypto-bug-hunters/bug-buster, and update this PR to use that?

I'll need to create another PR.

[endersonmaia]

Replaced by #148