mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
fb152b9114
## Summary This pull request is created by [Secure Repo](https://app.stepsecurity.io/securerepo) at the request of @zwass. Please merge the Pull Request to incorporate the requested changes. Please tag @zwass on your message if you have any questions related to the PR. You can also engage with the [StepSecurity](https://github.com/step-security) team by tagging @step-security-bot. ## Security Fixes ### Secure Dockerfiles Pin image tags to digests in Dockerfiles. With the Docker v2 API release, it became possible to use digests in place of tags when pulling images or to use them in FROM lines in Dockerfiles. - [The Open Source Security Foundation (OpenSSF) Security Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies) ## Feedback For bug reports, feature requests, and general feedback; please create an issue in [step-security/secure-repo](https://github.com/step-security/secure-repo). To create such PRs, please visit https://app.stepsecurity.io/securerepo. Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Zach Wasserman <zach@fleetdm.com>
44 lines
1.8 KiB
Docker
44 lines
1.8 KiB
Docker
FROM rust:latest@sha256:02a53e734724bef4a58d856c694f826aa9e7ea84353516b76d9a6d241e9da60e AS builder
|
|
|
|
ARG transporter_url=https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/ra/resources/download/public/Transporter__Linux/bin
|
|
|
|
RUN cargo install --version 0.16.0 apple-codesign \
|
|
&& curl -sSf $transporter_url -o transporter_install.sh \
|
|
&& sh transporter_install.sh --target transporter --accept --noexec
|
|
|
|
FROM golang:1.19.4-bullseye@sha256:9d235ae41bff699b44255bf912e77acac5046b06e61b018561239a35d9bd2ebb
|
|
|
|
RUN apt-get update \
|
|
&& dpkg --add-architecture i386 \
|
|
&& apt update \
|
|
&& apt install -y --no-install-recommends ca-certificates cpio libxml2 wine wine32 libgtk-3-0 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# copy macOS dependencies
|
|
COPY --from=fleetdm/bomutils:latest /usr/bin/mkbom /usr/local/bin/xar /usr/bin/
|
|
COPY --from=fleetdm/bomutils:latest /usr/local/lib /usr/local/lib/
|
|
COPY --from=builder /transporter/itms /usr/local/
|
|
COPY --from=builder /usr/local/cargo/bin/rcodesign /usr/local/bin
|
|
|
|
# copy Windows dependencies
|
|
COPY --from=fleetdm/wix:latest /home/wine /home/wine
|
|
|
|
ENV FLEETCTL_NATIVE_TOOLING=1 WINEPREFIX=/home/wine/.wine WINEARCH=win32 PATH="/home/wine/bin:$PATH" WINEDEBUG=-all
|
|
|
|
RUN apt update; apt install -y curl openssl unzip
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN go get -d -v
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-extldflags '-static'"
|
|
RUN curl https://releases.hashicorp.com/terraform/1.1.8/terraform_1.1.8_linux_amd64.zip > terraform.zip
|
|
RUN unzip terraform.zip
|
|
RUN rm terraform.zip
|
|
RUN chmod 644 $(find . -type f)
|
|
RUN chmod 755 $(find . -type d)
|
|
RUN chmod 655 lambda terraform
|
|
|
|
#FROM scratch
|
|
#COPY --from=builder /build/lambda /build/terraform /
|
|
#COPY --from=builder /build/deploy_terraform /deploy_terraform
|
|
#COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
ENTRYPOINT ["/build/lambda"]
|