SYS-696 cleanup after recent updates

.gitlab-ci.yml

@@ -33,7 +33,7 @@ workflow:
   - { if: $CI_COMMIT_TAG =~ /^chart-.*/, when: never }
   - when: always
 
-image: docker:29.1.2
+image: docker:29.7.2
 
 prepare:
   stage: prepare

.image-gitlab-ci.yml

@@ -13,7 +13,7 @@ stages:
   - Security Scan
   - Promote Image
 
-image: docker:29.7.1
+image: docker:29.7.2
 
 .registry_template: &registry_login
   before_script:
@@ -49,27 +49,26 @@ security_scan_trivy:
     TRIVY_EXIT_CODE: 1
     TRIVY_FORMAT: json
     TRIVY_IGNORE: >-
-      CVE-2023-31484,CVE-2023-45853,
       CVE-2023-52425,CVE-2024-8176,
       CVE-2025-9900,
-      CVE-2026-0861,CVE-2025-8194,CVE-2025-13699,
-      CVE-2025-13836,CVE-2025-40914
-      # Above two rows are for spamassassin under debian trixie
       # CVE-2025-9900 is for mythtv-backend
-      # Below are for blacklist image, there's a won't-fix note for zlib1g
-      # CVE-2023-31484,CVE-2023-45853
     TRIVY_OUTPUT: gl-container-scanning-report.json
     TRIVY_SEVERITY: HIGH,CRITICAL
     TRIVY_PKG_TYPES: os,library
   script:
   - export TAG=bld_$CI_PIPELINE_IID_${CI_COMMIT_SHORT_SHA}
+  # Trivy alerts on unfixed vulnerabilities in debian images
+  - >
+    if [ $IMAGE = blacklist ] || [ $IMAGE = spamassassin ]; then
+      IGN_FLAG=--ignore-unfixed ;
+    fi
   - trivy clean --all
   - trivy image --download-db-only --no-progress
   - trivy image "${REGISTRY}/${IMAGE}:${TAG}" --severity LOW,MEDIUM
       --exit-code 0 --format table --output medium-vulns.txt
   - cat medium-vulns.txt
   - echo $TRIVY_IGNORE | tr , "\n" | tee .trivyignore
-  - trivy image "${REGISTRY}/${IMAGE}:${TAG}"
+  - trivy image $IGN_FLAG "${REGISTRY}/${IMAGE}:${TAG}"
   cache:
     paths: [ .trivycache ]
   interruptible: true

images/data-sync/helm/Chart.yaml

@@ -5,7 +5,7 @@ home: https://github.com/instantlinux/docker-tools
 sources:
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.17
+version: 0.1.18
 appVersion: "2.54.0-4.14.3-r0"
 dependencies:
 - name: chartlib

images/data-sync/helm/values.yaml

@@ -117,6 +117,7 @@ configmap:
       ignore = Path data-sync/share/openldap/data/lock.mdb
       ignore = Path data-sync/share/snappymail/data/_default_/cache
       ignore = Path data-sync/dos
+      ignore = Path data-sync/headscale/db.sqlite-shm
       ignore = Path data-sync/home/*/.kube/cache
       ignore = Path data-sync/jira/home/analytics-logs
       ignore = Path data-sync/jira/home/log/automation-jira-performance.csv

images/dovecot/helm/Chart.yaml

@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/vdukhovni/dovecot
 type: application
-version: 0.1.15
-appVersion: "2.4.3-r2"
+version: 0.1.16
+appVersion: "2.4.4-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

images/git-pull/add_tags

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo $(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)

images/mythtv-backend/helm/Chart.yaml

@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/mythtv/mythtv
 type: application
-version: 0.1.21
-appVersion: "36.0-fixes.202607020123.7153bb6e34"
+version: 0.1.22
+appVersion: "36.0-fixes.202608010335.0d263282c8"
 dependencies:
 - name: chartlib
   version: 0.1.8

images/postfix-python/helm/Chart.yaml

@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/vdukhovni/postfix
 type: application
-version: 0.1.23
-appVersion: "3.11.4-r0"
+version: 0.1.24
+appVersion: "3.11.5-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

images/proftpd/Dockerfile

@@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 
-ARG PROFTPD_VERSION=1.3.9c-r1
+ARG PROFTPD_VERSION=1.3.9c-r0
 
 ENV ALLOW_OVERWRITE=on \
     ANONYMOUS_DISABLE=off \

images/proftpd/helm/Chart.yaml

@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/proftpd/proftpd
 type: application
-version: 0.1.14
-appVersion: "1.3.9b-r1"
+version: 0.1.15
+appVersion: "1.3.9c-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8

images/spamassassin/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie-slim
+FROM ubuntu:resolute
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
@@ -17,7 +17,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
     PYZOR_SITE=public.pyzor.org:24441
 
 ARG DCC_VERSION=2.3.169
-ARG SPAMD_VERSION=4.0.1-5
+ARG SPAMD_VERSION=4.0.2-3
 ARG DCC_SHA=3447e655476ac742942daf25fc217236da456dd0f82b7117661b9a70484b7bf6
 ARG SPAMD_UID=2022
 
@@ -42,9 +42,9 @@ RUN apt-get -yq update && apt-get -y upgrade && \
      /etc/razor/razor-agent.conf && \
     sed -i 's/DCCIFD_ENABLE=off/DCCIFD_ENABLE=on/' /var/dcc/dcc_conf && \
     sed -i '/^#\s*loadplugin .\+::DCC/s/^#\s*//g' /etc/spamassassin/v310.pre && \
-    apt-get purge -yq binutils libldap-2.5-0 linux-libc-dev libmilter-dev make && \
-    apt-get -yq autoremove && \
-    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/log/*
+    apt-get purge -yq binutils libc6-dev linux-libc-dev libmilter-dev make && \
+    apt-get -yq autoremove && apt-get clean && \
+    rm -rf /var/cache/debconf/* /var/lib/apt/lists/* /tmp/* /var/log/*
 
 COPY entrypoint.sh /root/
 VOLUME ["/var/lib/spamassassin", "/var/log"]

images/spamassassin/helm/Chart.yaml

@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://svn.apache.org/viewvc/spamassassin
 type: application
-version: 0.1.4
-appVersion: "4.0.1-5"
+version: 0.1.5
+appVersion: "4.0.2-3"
 dependencies:
 - name: chartlib
   version: 0.1.8

lib/build/Makefile.docker_image

@@ -41,7 +41,9 @@ ifeq ($(IMAGE),$(filter $(IMAGE),python-builder python-wsgi))
   PLATFORMS = linux/amd64,linux/arm64
 endif
 ifeq ($(IMAGE),spamassassin)
-  PLATFORMS = linux/amd64,linux/arm64
+  PLATFORMS = linux/amd64
+  # TODO restore arm64 when this error gets fixed:
+  # /usr/bin/tar: dcc-2.3.169/dcc.html.in: Cannot open: Function not implemented
 endif
 
 analysis: flake8
@@ -69,11 +71,21 @@ promote_image: $(HOME)/.docker/cli-plugins/docker-buildx
 	  --push --file Dockerfile . \
 	  --build-arg=VCS_REF=$(CI_COMMIT_SHA) \
 	  --build-arg=BUILD_DATE=$(shell date +%Y-%m-%dT%H:%M:%SZ)
-	-if [ -x hooks/post_build ]; then sh hooks/post_build; fi
 
-	# TODO update dockerhub README if/when that is supported,
-	# see https://github.com/docker/hub-feedback/issues/1927
-	# and https://github.com/docker/hub-feedback/issues/2127
+	# update dockerhub README
+	[ -s /usr/bin/jq ] || apk add jq
+	@JSON=$(jq -n --arg pwd "$DOCKER_TOKEN" --arg user "$USER_LOGIN" \
+	  '{username: $user, password: $pwd}')
+	@JWT=$(curl -s -H "Content-Type: application/json" -X POST \
+	  -d "$JSON" https://hub.docker.com/v2/users/login/ |jq -r .token)
+	# Build JSON payload securely and send PATCH request
+	# jq --arg escapes special characters / newlines in markdown text
+	RESP=$(jq -n --arg desc "$(<README.md)" '{"full_description": $desc}' | \
+	  curl -s -o /dev/null -w "%{http_code}" -X PATCH \
+	  -H "Content-Type: application/json" \
+	  -H "Authorization: JWT $JWT_TOKEN" \
+	  -d @- https://hub.docker.com/v2/repositories/$(IMAGE_REPO)/
+	[ "$RESPONSE_CODE" -eq 200 ] || exit 1
 
 flake8: test_requirements
 	@echo "Running flake8 code analysis"