[None][infra] Always install latest openssl, libssl3t64 - #17096
Conversation
Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughUbuntu initialization now uses minimum-version constraints for ChangesOpenSSL installation
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker/common/install_base.sh`:
- Around line 99-101: Replace the apt-get satisfy command in the base dependency
installation block with apt-get install requesting libssl3t64 and openssl by
package name, so configured candidates are selected. After installation,
validate that both installed versions meet the minimum 3.0.13-0ubuntu3.11
requirement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5504c1a0-83f4-43dd-8a9a-d1e27caaaf79
📒 Files selected for processing (1)
docker/common/install_base.sh
| apt-get satisfy -y --no-install-recommends \ | ||
| "libssl3t64 (>= 3.0.13-0ubuntu3.11)" \ | ||
| "openssl (>= 3.0.13-0ubuntu3.11)" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
apt-cache policy libssl3t64 openssl
apt-get -s satisfy \
"libssl3t64 (>= 3.0.13-0ubuntu3.11)" \
"openssl (>= 3.0.13-0ubuntu3.11)"
apt-get -s install --no-install-recommends libssl3t64 opensslRepository: NVIDIA/TensorRT-LLM
Length of output: 204
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- file list ---'
git ls-files 'docker/common/install_base.sh' 'docker' | sed -n '1,120p'
printf '%s\n' '--- header and target section ---'
cat -n docker/common/install_base.sh | sed -n '1,125p'
printf '%s\n' '--- changed-file summary ---'
git diff --stat -- docker/common/install_base.sh
git diff -- docker/common/install_base.sh | sed -n '1,180p'
printf '%s\n' '--- related package and base-image references ---'
rg -n --glob '!docker/common/install_base.sh' \
'apt-get (satisfy|install|upgrade)|libssl3t64|openssl|install_base\.sh|FROM ' \
docker README.md .github 2>/dev/null | sed -n '1,240p'Repository: NVIDIA/TensorRT-LLM
Length of output: 7490
🌐 Web query:
apt-get satisfy dependency string installed package already satisfies version constraint apt-get install newest candidate manpage
💡 Result:
The apt-get satisfy command is designed to satisfy arbitrary dependency strings, similar to those found in package Build-Depends fields [1][2]. It is distinct from apt-get install, as it allows for more flexible requirement specifications, including version constraints (e.g., "pkg (>= 1.0)"), OR-dependencies ("pkg1 | pkg2"), and the ability to define conflicts [1][2]. Regarding your specific questions: 1. How apt-get satisfy handles installed packages: If a package required by a dependency string is already installed and meets the constraint (e.g., the string asks for "pkg (>= 1.0)" and version 1.1 is installed), apt-get satisfy will recognize that the requirement is already fulfilled and will not perform unnecessary changes for that specific dependency [2]. If the currently installed version does not meet the constraint, it will attempt to upgrade or install the correct version to satisfy the string [2]. 2. apt-get install and version constraints: The standard apt-get install command does not natively support version constraints like "pkg >= 1.0" in its argument list [3]. To install a specific version, you must provide the exact version string (e.g., apt-get install pkg=1.0) [3]. If you run apt-get install on a package that is already installed, APT will generally upgrade it to the "newest candidate" version available in the configured repositories, provided no dependency conflicts prevent the upgrade [4][5]. In summary, use apt-get satisfy when you need to enforce complex dependency relationships or minimum version requirements that the standard install command cannot parse directly [3][2]. Use apt-get install when you want to ensure the latest version of a specific package is present [4][5].
Citations:
- 1: https://manpages.debian.org/bullseye/apt/apt-get.8.en.html
- 2: https://askubuntu.com/questions/1413251/how-does-the-apt-satisfy-work
- 3: https://unix.stackexchange.com/questions/578460/specify-apt-get-a-minimum-version-to-be-installed
- 4: https://unix.stackexchange.com/questions/654007/does-sudo-apt-install-command-also-update-an-already-installed-app
- 5: https://manpages.debian.org/bullseye/apt/apt-get.8
Use apt-get install to request the newest configured candidates.
apt-get satisfy stops when the installed versions meet the lower bounds. It does not request an upgrade from an already-sufficient version. Install libssl3t64 and openssl by name, then check that both versions meet 3.0.13-0ubuntu3.11.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docker/common/install_base.sh` around lines 99 - 101, Replace the apt-get
satisfy command in the base dependency installation block with apt-get install
requesting libssl3t64 and openssl by package name, so configured candidates are
selected. After installation, validate that both installed versions meet the
minimum 3.0.13-0ubuntu3.11 requirement.
Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>
Signed-off-by: Yuanjing Xue <197832395+yuanjingx87@users.noreply.github.com>
2 participants
Dev Engineer Review
apt-get installwith unversionedlibssl3t64andopensslpackages.apt-get satisfyminimum-version change is not present in the verified file output.QA Engineer Review
No test changes.
Description
Test Coverage
PR Checklist
Please review the following before submitting your PR:
PR description clearly explains what and why. If using CodeRabbit's summary, please make sure it makes sense.
PR Follows TRT-LLM CODING GUIDELINES to the best of your knowledge.
Test cases are provided for new code paths (see test instructions)
If PR introduces API changes, an appropriate PR label is added - either
api-compatibleorapi-breaking. Forapi-breaking, includeBREAKINGin the PR title.Any new dependencies have been scanned for license and vulnerabilities
CODEOWNERS updated if ownership changes
Documentation updated as needed
Update tava architecture diagram if there is a significant design change in PR.
The reviewers assigned automatically/manually are appropriate for the PR.
Please check this after reviewing the above items as appropriate for this PR.
GitHub Bot Help
To see a list of available CI bot commands, please comment
/bot help.