Repository navigation
Build the release kit from the signed release tag - #473
williamdes wants to merge 1 commit into
Conversation
Instead of downloading the release tarball, build the kit in a stage based on the official php:8.3-cli-trixie image, checking out the commit the signed release tag points at and verifying the signature against the release key. This locks the Composer dependencies for the PHP version of the image instead of the minimum supported one, and lets them be updated to fix vulnerabilities for the lifetime of the version. The tag commit is resolved by update.sh with the release tag format the daily-composer script documents, and recorded in the generated Dockerfiles. generate-stackbrew-library.sh had to learn about multi-stage Dockerfiles: it read the second word of every FROM and every COPY argument, so the new stage made it look for a repository named --platform=$BUILDPLATFORM and for files outside the repository. The kit is copied already extracted to avoid keeping the archive in its own layer, git verify-tag runs unpiped so a failed or revoked signature fails the build, and gd is installed in the build stage so the GIS tests run. Fixes #472 Signed-off-by: William Desportes <williamdes@wdes.fr> Co-Authored-By: DeepSeek <noreply@deepseek.com>
|
I am unsure about this one because we want reproducible and idempotent
builds. Checking out the tag might meet that qualification but I’m not
positive, it’s something I can look in to a bit more.
Good idea though, I like the thought.
|
Yes indeed, also it can create dependency chain attack vulnerability if done on the right timing. Please let me know |
|
@williamdes @ibennetch will there be any movement on this at all by any chance? I'm keen to get these security updates for all our docker phpmyadmin images ASAP as some are Critical / High and it affects multiple upstream package versions so something needs to be changed in terms of how the Docker image is built. |
Instead of downloading the release tarball, build the kit in a stage based on the official php:8.3-cli-trixie image, checking out the commit the signed release tag points at and verifying the signature against the release key.
This locks the Composer dependencies for the PHP version of the image instead of the minimum supported one, and lets them be updated to fix vulnerabilities for the lifetime of the version.
The tag commit is resolved by update.sh with the release tag format the daily-composer script documents, and recorded in the generated Dockerfiles.
generate-stackbrew-library.sh had to learn about multi-stage Dockerfiles: it read the second word of every FROM and every COPY argument, so the new stage made it look for a repository named --platform=$BUILDPLATFORM and for files outside the repository.
The kit is copied already extracted to avoid keeping the archive in its own layer, git verify-tag runs unpiped so a failed or revoked signature fails the build, and gd is installed in the build stage so the GIS tests run.
Fixes #472
The work was made by DeepSeek under my guidance and review