diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 1d496e81..e2b8dbfb 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -33,7 +33,7 @@ workflow: - { if: $CI_COMMIT_TAG =~ /^chart-.*/, when: never } - when: always -image: docker:29.1.2 +image: docker:29.7.2 prepare: stage: prepare diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml index 366b3116..0c2e2939 100644 --- a/.image-gitlab-ci.yml +++ b/.image-gitlab-ci.yml @@ -13,7 +13,7 @@ stages: - Security Scan - Promote Image -image: docker:29.7.1 +image: docker:29.7.2 .registry_template: ®istry_login before_script: @@ -49,27 +49,26 @@ security_scan_trivy: TRIVY_EXIT_CODE: 1 TRIVY_FORMAT: json TRIVY_IGNORE: >- - CVE-2023-31484,CVE-2023-45853, CVE-2023-52425,CVE-2024-8176, CVE-2025-9900, - CVE-2026-0861,CVE-2025-8194,CVE-2025-13699, - CVE-2025-13836,CVE-2025-40914 - # Above two rows are for spamassassin under debian trixie # CVE-2025-9900 is for mythtv-backend - # Below are for blacklist image, there's a won't-fix note for zlib1g - # CVE-2023-31484,CVE-2023-45853 TRIVY_OUTPUT: gl-container-scanning-report.json TRIVY_SEVERITY: HIGH,CRITICAL TRIVY_PKG_TYPES: os,library script: - export TAG=bld_$CI_PIPELINE_IID_${CI_COMMIT_SHORT_SHA} + # Trivy alerts on unfixed vulnerabilities in debian images + - > + if [ $IMAGE = blacklist ] || [ $IMAGE = spamassassin ]; then + IGN_FLAG=--ignore-unfixed ; + fi - trivy clean --all - trivy image --download-db-only --no-progress - trivy image "${REGISTRY}/${IMAGE}:${TAG}" --severity LOW,MEDIUM --exit-code 0 --format table --output medium-vulns.txt - cat medium-vulns.txt - echo $TRIVY_IGNORE | tr , "\n" | tee .trivyignore - - trivy image "${REGISTRY}/${IMAGE}:${TAG}" + - trivy image $IGN_FLAG "${REGISTRY}/${IMAGE}:${TAG}" cache: paths: [ .trivycache ] interruptible: true diff --git a/images/data-sync/helm/Chart.yaml b/images/data-sync/helm/Chart.yaml index 4ac7b18d..1cface8f 100644 --- a/images/data-sync/helm/Chart.yaml +++ b/images/data-sync/helm/Chart.yaml @@ -5,7 +5,7 @@ home: https://github.com/instantlinux/docker-tools sources: - https://github.com/instantlinux/docker-tools type: application -version: 0.1.17 +version: 0.1.18 appVersion: "2.54.0-4.14.3-r0" dependencies: - name: chartlib diff --git a/images/data-sync/helm/values.yaml b/images/data-sync/helm/values.yaml index d30f5f3f..ff6314d7 100644 --- a/images/data-sync/helm/values.yaml +++ b/images/data-sync/helm/values.yaml @@ -117,6 +117,7 @@ configmap: ignore = Path data-sync/share/openldap/data/lock.mdb ignore = Path data-sync/share/snappymail/data/_default_/cache ignore = Path data-sync/dos + ignore = Path data-sync/headscale/db.sqlite-shm ignore = Path data-sync/home/*/.kube/cache ignore = Path data-sync/jira/home/analytics-logs ignore = Path data-sync/jira/home/log/automation-jira-performance.csv diff --git a/images/dovecot/helm/Chart.yaml b/images/dovecot/helm/Chart.yaml index 8622ba7a..6510d5ad 100644 --- a/images/dovecot/helm/Chart.yaml +++ b/images/dovecot/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/vdukhovni/dovecot type: application -version: 0.1.15 -appVersion: "2.4.3-r2" +version: 0.1.16 +appVersion: "2.4.4-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/git-pull/add_tags b/images/git-pull/add_tags new file mode 100755 index 00000000..ff9ebf1d --- /dev/null +++ b/images/git-pull/add_tags @@ -0,0 +1,2 @@ +#!/bin/sh +echo $(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2) diff --git a/images/mythtv-backend/helm/Chart.yaml b/images/mythtv-backend/helm/Chart.yaml index 58512d64..6ed63e4b 100644 --- a/images/mythtv-backend/helm/Chart.yaml +++ b/images/mythtv-backend/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/mythtv/mythtv type: application -version: 0.1.21 -appVersion: "36.0-fixes.202607020123.7153bb6e34" +version: 0.1.22 +appVersion: "36.0-fixes.202608010335.0d263282c8" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/postfix-python/helm/Chart.yaml b/images/postfix-python/helm/Chart.yaml index bc98eefb..e823b410 100644 --- a/images/postfix-python/helm/Chart.yaml +++ b/images/postfix-python/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/vdukhovni/postfix type: application -version: 0.1.23 -appVersion: "3.11.4-r0" +version: 0.1.24 +appVersion: "3.11.5-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/proftpd/Dockerfile b/images/proftpd/Dockerfile index cd7102f5..90348460 100644 --- a/images/proftpd/Dockerfile +++ b/images/proftpd/Dockerfile @@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.vcs-ref=$VCS_REF \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools -ARG PROFTPD_VERSION=1.3.9c-r1 +ARG PROFTPD_VERSION=1.3.9c-r0 ENV ALLOW_OVERWRITE=on \ ANONYMOUS_DISABLE=off \ diff --git a/images/proftpd/helm/Chart.yaml b/images/proftpd/helm/Chart.yaml index 8f060b8c..39813574 100644 --- a/images/proftpd/helm/Chart.yaml +++ b/images/proftpd/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/proftpd/proftpd type: application -version: 0.1.14 -appVersion: "1.3.9b-r1" +version: 0.1.15 +appVersion: "1.3.9c-r0" dependencies: - name: chartlib version: 0.1.8 diff --git a/images/spamassassin/Dockerfile b/images/spamassassin/Dockerfile index 18874bc5..d9ff4ab8 100644 --- a/images/spamassassin/Dockerfile +++ b/images/spamassassin/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:trixie-slim +FROM ubuntu:resolute ARG BUILD_DATE ARG VCS_REF LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ @@ -17,7 +17,7 @@ ENV DEBIAN_FRONTEND=noninteractive \ PYZOR_SITE=public.pyzor.org:24441 ARG DCC_VERSION=2.3.169 -ARG SPAMD_VERSION=4.0.1-5 +ARG SPAMD_VERSION=4.0.2-3 ARG DCC_SHA=3447e655476ac742942daf25fc217236da456dd0f82b7117661b9a70484b7bf6 ARG SPAMD_UID=2022 @@ -42,9 +42,9 @@ RUN apt-get -yq update && apt-get -y upgrade && \ /etc/razor/razor-agent.conf && \ sed -i 's/DCCIFD_ENABLE=off/DCCIFD_ENABLE=on/' /var/dcc/dcc_conf && \ sed -i '/^#\s*loadplugin .\+::DCC/s/^#\s*//g' /etc/spamassassin/v310.pre && \ - apt-get purge -yq binutils libldap-2.5-0 linux-libc-dev libmilter-dev make && \ - apt-get -yq autoremove && \ - apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/log/* + apt-get purge -yq binutils libc6-dev linux-libc-dev libmilter-dev make && \ + apt-get -yq autoremove && apt-get clean && \ + rm -rf /var/cache/debconf/* /var/lib/apt/lists/* /tmp/* /var/log/* COPY entrypoint.sh /root/ VOLUME ["/var/lib/spamassassin", "/var/log"] diff --git a/images/spamassassin/helm/Chart.yaml b/images/spamassassin/helm/Chart.yaml index d208e5b7..5e1f3c9f 100644 --- a/images/spamassassin/helm/Chart.yaml +++ b/images/spamassassin/helm/Chart.yaml @@ -6,8 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://svn.apache.org/viewvc/spamassassin type: application -version: 0.1.4 -appVersion: "4.0.1-5" +version: 0.1.5 +appVersion: "4.0.2-3" dependencies: - name: chartlib version: 0.1.8 diff --git a/lib/build/Makefile.docker_image b/lib/build/Makefile.docker_image index 51592c79..d3be9446 100644 --- a/lib/build/Makefile.docker_image +++ b/lib/build/Makefile.docker_image @@ -41,7 +41,9 @@ ifeq ($(IMAGE),$(filter $(IMAGE),python-builder python-wsgi)) PLATFORMS = linux/amd64,linux/arm64 endif ifeq ($(IMAGE),spamassassin) - PLATFORMS = linux/amd64,linux/arm64 + PLATFORMS = linux/amd64 + # TODO restore arm64 when this error gets fixed: + # /usr/bin/tar: dcc-2.3.169/dcc.html.in: Cannot open: Function not implemented endif analysis: flake8 @@ -69,11 +71,21 @@ promote_image: $(HOME)/.docker/cli-plugins/docker-buildx --push --file Dockerfile . \ --build-arg=VCS_REF=$(CI_COMMIT_SHA) \ --build-arg=BUILD_DATE=$(shell date +%Y-%m-%dT%H:%M:%SZ) - -if [ -x hooks/post_build ]; then sh hooks/post_build; fi - # TODO update dockerhub README if/when that is supported, - # see https://github.com/docker/hub-feedback/issues/1927 - # and https://github.com/docker/hub-feedback/issues/2127 + # update dockerhub README + [ -s /usr/bin/jq ] || apk add jq + @JSON=$(jq -n --arg pwd "$DOCKER_TOKEN" --arg user "$USER_LOGIN" \ + '{username: $user, password: $pwd}') + @JWT=$(curl -s -H "Content-Type: application/json" -X POST \ + -d "$JSON" https://hub.docker.com/v2/users/login/ |jq -r .token) + # Build JSON payload securely and send PATCH request + # jq --arg escapes special characters / newlines in markdown text + RESP=$(jq -n --arg desc "$(