Skip to content

Commit 175fde3

Browse files
hectormachinhectormachin
authored
Remediating certifi vulnerability (#37)
1 parent 4fcdb65 commit 175fde3

File tree

6 files changed

+78
-57
lines changed

6 files changed

+78
-57
lines changed

‎.github/workflows/publish-image.yml‎

Lines changed: 52 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,77 @@
11
name: Publish Image
22
on:
3+
release:
4+
types:
5+
- published
36
push:
47
branches:
58
- main
6-
tags:
9+
pull_request:
10+
branches:
711
- '*'
8-
paths:
9-
- ./version.json
1012

1113
jobs:
1214
build:
1315
env:
1416
context: .
1517
image_name: swoop
18+
image_registry: "${{ secrets.REGISTRY_URI }}"
19+
image_repository: "${{ secrets.REGISTRY_REPOSITORY }}"
1620
runs-on: ubuntu-latest
1721
steps:
1822
- uses: actions/checkout@main
23+
24+
- name: Set up Python ${{ matrix.python-version }}
25+
uses: actions/setup-python@v4
26+
with:
27+
python-version: '3.x'
28+
29+
- name: Install dependencies
30+
run: pip install setuptools-scm
31+
1932
- name: Get image tags
2033
id: image_tags
2134
run: |
22-
echo -n ::set-output name=IMAGE_TAGS::
23-
VERSION=$(jq -r '.version' ${context}/version.json)
24-
TAGS=('latest')
25-
if [ "${VERSION}" ] && [ "${VERSION}" != "latest" ]; then
26-
TAGS+=("${VERSION}")
35+
VERSION="$(python -m setuptools_scm | tr + -)"
36+
TAGS=("${VERSION}")
37+
38+
if [ -n "${{ github.event.release.tag_name }}" ]; then
39+
MAJOR="$(<<<"${VERSION}" cut -d '.' -f 1)"
40+
MINOR="${MAJOR}.$(<<<"${VERSION}" cut -d '.' -f 2)"
41+
TAGS+=('latest' "${MAJOR}" "${MINOR}")
2742
fi
43+
2844
if [[ "${GITHUB_REF}" =~ refs/tags/(.*) ]]; then
2945
TAGS+=("git-${BASH_REMATCH[1]}")
3046
fi
31-
( IFS=$','; echo "${TAGS[*]}" )
32-
- name: Build and publish image to Quay
33-
uses: docker/build-push-action@v1
47+
48+
PREFIX="${{ env.image_registry }}/${{ env.image_repository }}/${{ env.image_name }}"
49+
EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
50+
echo "IMAGE_TAGS<<$EOF" >> "$GITHUB_ENV"
51+
for tag in "${TAGS[@]}"; do
52+
echo "${PREFIX}:${tag}" >> "$GITHUB_ENV"
53+
done
54+
echo "$EOF" >> "$GITHUB_ENV"
55+
56+
- name: Set up QEMU
57+
uses: docker/setup-qemu-action@v2
58+
59+
- name: Set up Docker Buildx
60+
uses: docker/setup-buildx-action@v2
61+
with:
62+
buildkitd-flags: --debug
63+
64+
- name: Login to Quay.io
65+
uses: docker/login-action@v2
3466
with:
35-
path: ${{ env.context }}
36-
registry: ${{ secrets.REGISTRY_URI }}
37-
repository: ${{ secrets.REGISTRY_REPOSITORY }}/${{ env.image_name }}
67+
registry: ${{ env.image_registry }}
3868
username: ${{ secrets.REGISTRY_USERNAME }}
3969
password: ${{ secrets.REGISTRY_PASSWORD }}
40-
tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
70+
71+
- name: Build and publish image to Quay
72+
uses: docker/build-push-action@v4
73+
with:
74+
context: ${{ env.context }}
75+
platforms: linux/amd64,linux/arm64
76+
push: ${{ github.event_name == 'release' }}
77+
tags: ${{ env.IMAGE_TAGS }}

‎.snyk‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
22
version: v1.22.1
33

4-
ignore: {}
4+
ignore:
5+
SNYK-DEBIAN12-POSTGRESQL15-5838227:
6+
- '*':
7+
reason: Although postgresql-15 package has been flagged as vulnerable, we're not installing postgres-15 on our base image.
8+
expires: 2023-09-30T17:33:45.004Z
59
patch: {}

‎Dockerfile‎

Lines changed: 18 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,15 @@
1-
FROM debian:bookworm-slim
2-
3-
WORKDIR /app
4-
5-
COPY . /app
6-
7-
RUN apt-get update
8-
9-
RUN apt-get install -y gcc musl-dev python3-dev python3-pip
10-
11-
# Resolving libcurl4 vulnerability https://security-tracker.debian.org/tracker/CVE-2023-23914
12-
# Resolving libcurl4 vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-CURL-5561883
13-
# Resolving libcurl4 vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-CURL-5561882
14-
RUN apt-get install -y libcurl4>=7.88.1-10 curl>=7.88.1-10
15-
16-
# Resolving libcap2 vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-LIBCAP2-5537069
17-
RUN apt-get install -y libcap2>=1:2.66-4
18-
19-
# Resolving libwebp7 vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-LIBWEBP-5489176
20-
RUN apt-get install -y libwebp7>=1.2.4-0.2
21-
22-
# Resolving libx11-data vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-LIBX11-5710892
23-
RUN apt-get install -y libx11-data>=2:1.8.4-2+deb12u1
24-
25-
# Resolving libssl3 vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-OPENSSL-5661565
26-
# Resolving libssl3 vulnerability https://security.snyk.io/vuln/SNYK-DEBIAN12-OPENSSL-3368733
27-
RUN apt-get install -y libssl3>=3.0.9-1
28-
29-
# Resolving libaom vulnerabilities:
30-
# - https://security-tracker.debian.org/tracker/CVE-2021-30473
31-
# - https://security-tracker.debian.org/tracker/CVE-2021-30474
32-
# - https://security-tracker.debian.org/tracker/CVE-2021-30475
33-
RUN apt-get install -y libaom-dev>=3.6.0-1
34-
35-
RUN python3 -m pip install --break-system-packages --upgrade pip && \
36-
pip install --break-system-packages -r requirements.txt && \
37-
pip install --break-system-packages '.[dev]'
1+
# build python venv for inclusion into image
2+
FROM python:slim-bookworm as APP
3+
RUN apt-get update && apt-get install -y git python3-venv
4+
WORKDIR /opt/swoop/api
5+
RUN python3 -m venv --copies swoop-api-venv
6+
COPY requirements.txt .
7+
COPY workflow-config.yml .
8+
RUN ./swoop-api-venv/bin/pip install -r requirements.txt
9+
RUN --mount=source=.git,target=.git,type=bind git clone . clone
10+
RUN ./swoop-api-venv/bin/pip install ./clone
11+
12+
FROM python:slim-bookworm
3813

3914
ENV SWOOP_ACCESS_KEY_ID=$SWOOP_ACCESS_KEY_ID \
4015
SWOOP_SECRET_ACCESS_KEY=$SWOOP_ACCESS_KEY_ID \
@@ -46,6 +21,12 @@ ENV SWOOP_ACCESS_KEY_ID=$SWOOP_ACCESS_KEY_ID \
4621
PGHOST=$PGHOST \
4722
PGUSER=$PGUSER
4823

24+
COPY --from=APP /opt/swoop/api/swoop-api-venv /opt/swoop/api/swoop-api-venv
25+
COPY --from=APP /opt/swoop/api/$SWOOP_WORKFLOW_CONFIG_FILE /opt/swoop/api/swoop-api-venv
26+
ENV PATH=/opt/swoop/api/swoop-api-venv/bin:$PATH
27+
4928
RUN env
5029

30+
WORKDIR /opt/swoop/api/swoop-api-venv
31+
5132
CMD ["uvicorn", "swoop.api.main:app", "--host", "0.0.0.0", "--port", "8000"]

‎pyproject.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ dev = [
5555
"isort >=5.12.0",
5656
]
5757

58+
[tool.setuptools_scm]
59+
5860
[tool.setuptools.dynamic]
5961
version = {attr = "swoop.api.__version__"}
6062
readme = {file = "README.md"}

‎requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ buildpg==0.4
1515
# via
1616
# dbami
1717
# swoop (pyproject.toml)
18-
certifi==2023.5.7
18+
certifi==2023.7.22
1919
# via minio
2020
click==8.1.3
2121
# via uvicorn

‎version.json‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)