From 5564db6791008f9e6b950b03fd1b5b8052adec50 Mon Sep 17 00:00:00 2001 From: Thomas Date: Tue, 23 Jun 2026 09:59:58 +0200 Subject: Dockerfiles: pin Qt to a commit hash Qt was cloned with -b ${QT_VERSION} --depth 1 but, unlike every other dependency in these files, never reset to a commit, so a moved upstream tag would silently change the Qt source built into the release. Pin the qt5 superproject to its v5.15.19-lts-lgpl commit and let it resolve the submodules (git submodule update on linux/windows, init-repository on android), so only the qt5 hash is hardcoded. qt5 records the exact submodule commits, and the relative .gitmodules URLs keep the fetches on https. Follow-up to #4613. --- Dockerfile.android | 1 + 1 file changed, 1 insertion(+) (limited to 'Dockerfile.android') diff --git a/Dockerfile.android b/Dockerfile.android index daa0acc9..c99a8d4a 100644 --- a/Dockerfile.android +++ b/Dockerfile.android @@ -58,6 +58,7 @@ RUN wget -q https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zl RUN git clone https://code.qt.io/qt/qt5.git -b ${QT_VERSION} --depth 1 \ && cd qt5 \ + && git reset --hard dc2ac680fa9d0ef7b0d9520859593d13951bedea \ && perl init-repository --module-subset=default,-qtwebengine \ && PATH=${HOST_PATH} ./configure -v -developer-build -release \ -xplatform android-clang \ -- cgit v1.2.3