[ci] Update remote-image Dockerfile

[VietND96]

User description

Thanks for contributing to Selenium!
A PR well described will help maintainers to quickly review and merge it

Before submitting your PR, please check our contributing guidelines.
Avoid large PRs, help reviewers by making them as simple and short as possible.

Motivation and Context

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I have read the contributing document.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

PR Type

Enhancement, Configuration changes

---

Description

• Updated Bazelisk version in create-cc-toolchain-within-image.sh.

• Changed Docker image references in multiple files.

• Switched base image in remote-image/Dockerfile to Ubuntu Focal.

• Added Mozilla repository setup and key verification in remote-image/Dockerfile.

---

Changes walkthrough 📝

	Relevant files
Enhancement	create-cc-toolchain-within-image.sh Update Bazelisk version in script                                                scripts/remote-image/create-cc-toolchain-within-image.sh Updated Bazelisk version from 1.16.0 to 1.25.0. Ensured the new version is downloaded and executable. +1/-1
Configuration changes	BUILD.bazel Update container image reference in BUILD.bazel                    common/remote-build/BUILD.bazel Updated container-image reference to a new Docker image. Changed the image hash to reflect the updated image. +1/-1      Dockerfile Update base image in dev Dockerfile                                            scripts/dev-image/Dockerfile Updated base image reference to selenium/selenium-remote-build:latest. Replaced the previous image shs96c/selenium-remote-build:latest. +1/-1      Dockerfile Update base image and add Mozilla repository                          scripts/remote-image/Dockerfile Changed base image from Ubuntu Jammy to Ubuntu Focal. Added Mozilla repository setup and key verification. Included pinning for Mozilla packages with high priority. Ensured Firefox and Chrome runtime libraries are installed. +10/-1

---

Need help?

Type /help how to ... in the comments thread for any questions about Qodo Merge usage.

Check out the documentation for more information.

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Mozilla Key Verification The Mozilla repository key verification is implemented but the script continues regardless of verification result. Consider adding error handling to abort if key verification fails. gpg -n -q --import --import-options import-show /etc/apt/keyrings/packages.mozilla.org.asc | awk '/pub/{getline; gsub(/^ +| +$/,""); if($0 == "35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3") print "\nThe key fingerprint matches ("$0").\n"; else print "\nVerification failed: the fingerprint ("$0") does not match the expected one.\n"}' && \ Image Reference The container image reference has been updated to a new hash. Verify that this hash corresponds to the correct and approved image version. "container-image": "docker://docker.io/selenium/selenium-remote-build@sha256:ca164352826812f02eaa1b4dab89adcf5b3e57deb6798dd9f15d004099db59fe",

[qodo-merge-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Enforce GPG key verification The GPG key verification doesn't halt the build if verification fails. This is a security risk as it only prints a message but continues execution even if the key doesn't match the expected fingerprint. scripts/remote-image/Dockerfile [25-26] wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null && \ -gpg -n -q --import --import-options import-show /etc/apt/keyrings/packages.mozilla.org.asc | awk '/pub/{getline; gsub(/^ +| +$/,""); if($0 == "35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3") print "\nThe key fingerprint matches ("$0").\n"; else print "\nVerification failed: the fingerprint ("$0") does not match the expected one.\n"}' +gpg -n -q --import --import-options import-show /etc/apt/keyrings/packages.mozilla.org.asc | awk '/pub/{getline; gsub(/^ +| +$/,""); if($0 == "35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3") print "\nThe key fingerprint matches ("$0").\n"; else print "\nVerification failed: the fingerprint ("$0") does not match the expected one.\n"; exit 1}' [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 9 __ Why: This is a critical security fix that prevents the build from continuing when the Mozilla GPG key verification fails. Without this change, the build would proceed even with an invalid key, potentially allowing compromised packages to be installed.	High
More