mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
fb152b9114
## Summary This pull request is created by [Secure Repo](https://app.stepsecurity.io/securerepo) at the request of @zwass. Please merge the Pull Request to incorporate the requested changes. Please tag @zwass on your message if you have any questions related to the PR. You can also engage with the [StepSecurity](https://github.com/step-security) team by tagging @step-security-bot. ## Security Fixes ### Secure Dockerfiles Pin image tags to digests in Dockerfiles. With the Docker v2 API release, it became possible to use digests in place of tags when pulling images or to use them in FROM lines in Dockerfiles. - [The Open Source Security Foundation (OpenSSF) Security Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies) ## Feedback For bug reports, feature requests, and general feedback; please create an issue in [step-security/secure-repo](https://github.com/step-security/secure-repo). To create such PRs, please visit https://app.stepsecurity.io/securerepo. Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Zach Wasserman <zach@fleetdm.com>
28 lines
1.3 KiB
Docker
28 lines
1.3 KiB
Docker
FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8 AS builder
|
|
|
|
RUN apt-get update
|
|
RUN apt-get install -y build-essential autoconf libxml2-dev libssl-dev zlib1g-dev curl
|
|
|
|
# Install bomutils
|
|
RUN curl -L https://github.com/hogliux/bomutils/archive/0.2.tar.gz > bomutils.tar.gz && \
|
|
echo "fb1f4ae37045eaa034ddd921ef6e16fb961e95f0364e5d76c9867bc8b92eb8a4 bomutils.tar.gz" | sha256sum --check && \
|
|
tar -xzf bomutils.tar.gz
|
|
RUN cd bomutils-0.2 && make && make install
|
|
|
|
# Install xar
|
|
RUN curl -L https://github.com/mackyle/xar/archive/refs/tags/xar-1.6.1.tar.gz > xar.tar.gz && \
|
|
echo "5e7d50dab73f5cb1713b49fa67c455c2a0dd2b0a7770cbc81b675e21f6210e25 xar.tar.gz" | sha256sum --check && \
|
|
tar -xzf xar.tar.gz
|
|
# Note this needs patching due to newer version of OpenSSL
|
|
# See https://github.com/mackyle/xar/pull/23
|
|
COPY patch.txt .
|
|
RUN cd xar-xar-1.6.1/xar && patch < ../../patch.txt && autoconf && ./configure && make && make install
|
|
|
|
|
|
FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends libxml2 && rm -rf /var/lib/apt/lists/*
|
|
COPY --from=builder /usr/bin /usr/bin/
|
|
COPY --from=builder /usr/local/bin /usr/local/bin/
|
|
COPY --from=builder /usr/local/lib /usr/local/lib/
|