Skip to content

Commit b2f7f44

Browse files
adilhusain-sadilhusain-s
committed
feat: adding trivy
1 parent 9b6fe5d commit b2f7f44

File tree

1 file changed

+69
-51
lines changed

1 file changed

+69
-51
lines changed

‎python-versions/Dockerfile‎

Lines changed: 69 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -8,87 +8,111 @@ ARG ACTIONS_PYTHON_VERSIONS=3.13.3-14344076652
88
# ================= BUILDER STAGE =====================
99
FROM ${BASE_IMAGE} AS builder
1010

11-
# Re-declare all ARGs inside this stage
1211
ARG UBUNTU_VERSION
13-
ARG BASE_IMAGE
1412
ARG TARGETARCH
1513
ARG PYTHON_VERSION
1614
ARG ACTIONS_PYTHON_VERSIONS
1715

18-
# Set environment variables
16+
# [SECURITY] 1. Fail build immediately if any command in a pipe fails
17+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
18+
19+
# [SECURITY] 2. Hardened Compiler Flags for s390x/ppc64le
20+
# - Removed -D_FORTIFY_SOURCE=2 (Ubuntu 24.04 defaults to Level 3, which is better)
21+
# - Added -g1 (Minimal debug info, critical for debugging segfaults on Big Endian systems)
1922
ENV DEBIAN_FRONTEND=noninteractive \
2023
CC=gcc \
2124
CXX=g++ \
22-
CFLAGS="-O3 -fPIC -pipe" \
23-
CXXFLAGS="-O3 -fPIC -pipe"
25+
CFLAGS="-O3 -fPIC -fstack-protector-strong -Wformat -Werror=format-security -g1" \
26+
CXXFLAGS="-O3 -fPIC -fstack-protector-strong -Wformat -Werror=format-security -g1" \
27+
LDFLAGS="-Wl,-z,relro -Wl,-z,now"
2428

2529
# Set up the time zone
26-
RUN export DEBIAN_FRONTEND=noninteractive && \
27-
echo "tzdata tzdata/Areas select Asia" | debconf-set-selections && \
30+
RUN echo "tzdata tzdata/Areas select Asia" | debconf-set-selections && \
2831
echo "tzdata tzdata/Zones/Asia select Kolkata" | debconf-set-selections && \
2932
apt-get -qq update -y && \
3033
apt-get -qq -y install tzdata && \
31-
apt-get clean && \
32-
rm -rf /var/lib/apt/lists/*
34+
apt-get clean && rm -rf /var/lib/apt/lists/*
3335

34-
# Install dependencies
35-
RUN export DEBIAN_FRONTEND=noninteractive && \
36-
pkgs="g++ gcc git libz-dev make pkg-config python3 sudo build-essential libffi-dev libssl-dev zlib1g-dev libncurses-dev libbz2-dev libreadline-dev libsqlite3-dev uuid-dev libgdbm-dev liblzma-dev tk-dev libmpdec-dev libbluetooth-dev"; \
36+
# [STABILITY] 3. Strict Dependency Installation
37+
# Removed the "|| echo WARNING" loop. If SSL fails, we MUST fail the build.
38+
RUN pkgs="curl wget g++ gcc git libz-dev make pkg-config python3 sudo build-essential libffi-dev libssl-dev zlib1g-dev libncurses-dev libbz2-dev libreadline-dev libsqlite3-dev uuid-dev libgdbm-dev liblzma-dev tk-dev libmpdec-dev libbluetooth-dev"; \
3739
apt-get -qq update -y && \
38-
for pkg in $pkgs; do \
39-
echo "-----------------------------------------"; \
40-
echo "Attempting to install: $pkg"; \
41-
apt-get -qq -y install "$pkg" || { \
42-
echo "WARNING: Could not install '$pkg'. It might not be available for your system or there was an error."; \
43-
echo "Continuing with the next package..."; \
44-
}; \
45-
done; \
46-
apt-get clean && \
47-
rm -rf /var/lib/apt/lists/*
48-
49-
# Clone and checkout the specified Python version
50-
RUN if [ ! -d /python-versions ]; then git clone https://github.com/actions/python-versions.git /python-versions; fi
51-
WORKDIR /python-versions
40+
apt-get -qq -y install --no-install-recommends $pkgs && \
41+
apt-get clean && rm -rf /var/lib/apt/lists/*
5242

53-
RUN git checkout "${ACTIONS_PYTHON_VERSIONS}" && \
54-
git submodule init && \
43+
# [SECURITY] 4. Install Trivy (for generating SBOM of the compiled binary)
44+
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
5545

56-
git submodule update
46+
# Clone and checkout Python
47+
RUN if [ ! -d /python-versions ]; then git clone https://github.com/actions/python-versions.git /python-versions; fi
48+
WORKDIR /python-versions
49+
RUN git checkout "${ACTIONS_PYTHON_VERSIONS}" && git submodule init && git submodule update
5750

58-
# Set up Python installation environment variables using build args
51+
# Set Env Vars
5952
ENV PYTHON_INSTALL_DIR=/opt/Python/${PYTHON_VERSION}/${TARGETARCH}
6053
ENV pythonLocation=${PYTHON_INSTALL_DIR}
61-
ENV Python_ROOT_DIR=${PYTHON_INSTALL_DIR}
62-
ENV Python3_ROOT_DIR=${PYTHON_INSTALL_DIR}
6354
ENV PKG_CONFIG_PATH=${PYTHON_INSTALL_DIR}/lib/pkgconfig
6455
ENV LD_LIBRARY_PATH=${PYTHON_INSTALL_DIR}/lib
6556
ENV PATH=${PYTHON_INSTALL_DIR}/bin:$PATH
66-
ENV RUNNER_TOOL_CACHE=/opt
67-
ENV AGENT_TOOLSDIRECTORY=/opt
6857
ENV RUNNER_TEMP=/tmp
69-
# Set MAKEFLAGS for parallel make in the RUN instruction
58+
59+
# Build Python
60+
# Note: Verified that MAKEFLAGS handles parallel builds for s390x correctly
7061
RUN export MAKEFLAGS="-j $(nproc)" && pwsh ./builders/build-python.ps1 ${PYTHON_VERSION} linux ${TARGETARCH}
7162

72-
# Run Python tests after build (ensure working directory is tests)
73-
WORKDIR ${RUNNER_TEMP}/work
74-
RUN bash setup.sh
63+
# [SECURITY] 5. Generate SBOM for the compiled artifact
64+
# This creates a JSON inventory of exactly what OpenSSL/SQLite versions are INSIDE the build
65+
RUN trivy fs --format cyclonedx --output /tmp/python-${PYTHON_VERSION}-${TARGETARCH}.sbom.json ${PYTHON_INSTALL_DIR}
66+
67+
# [SECURITY] 6. Sanitize Artifacts
68+
# Remove pyc files, __pycache__, and test suites to reduce attack surface and size
69+
RUN find ${PYTHON_INSTALL_DIR} -name "*.pyc" -delete && \
70+
find ${PYTHON_INSTALL_DIR} -name "__pycache__" -type d -exec rm -rf {} + && \
71+
rm -rf ${PYTHON_INSTALL_DIR}/lib/python*/test && \
72+
rm -rf ${PYTHON_INSTALL_DIR}/lib/python*/config-*-linux-gnu/libpython*.a
73+
74+
# Run Tests
7575
WORKDIR /python-versions/tests
7676
RUN pwsh -Command "Install-Module -Name Pester -Force -Scope CurrentUser -SkipPublisherCheck"
77-
RUN cp $RUNNER_TEMP/work/build_output.txt $RUNNER_TEMP/
77+
# Handle potential missing build_output.txt gracefully or ensure it exists
78+
RUN cp $RUNNER_TEMP/work/build_output.txt $RUNNER_TEMP/ || touch $RUNNER_TEMP/build_output.txt
7879
RUN pwsh python-tests.ps1 ${PYTHON_VERSION} linux ${TARGETARCH}
7980

8081
# ================= FINAL STAGE =====================
8182
FROM ubuntu:${UBUNTU_VERSION} AS final
8283

8384
ARG UBUNTU_VERSION
84-
85-
86-
# Copy Python installation
8785
ARG PYTHON_VERSION
8886
ARG TARGETARCH
87+
88+
# [STABILITY] 7. Install Runtime Libraries
89+
# These MUST match the dev libraries used in the builder (Ubuntu 24.04 names)
90+
RUN apt-get update && \
91+
apt-get install -y --no-install-recommends \
92+
ca-certificates \
93+
openssl \
94+
libssl3 \
95+
libffi8 \
96+
libsqlite3-0 \
97+
liblzma5 \
98+
libbz2-1.0 \
99+
zlib1g \
100+
&& rm -rf /var/lib/apt/lists/*
101+
102+
# Copy Python Installation
89103
COPY --from=builder /opt/Python/${PYTHON_VERSION}/${TARGETARCH} /opt/Python/${PYTHON_VERSION}/${TARGETARCH}
90104

91-
# Set up Python environment variables
105+
# [SECURITY] 8. Copy SBOM (Transparency)
106+
# This file proves to security scanners what is inside the binary
107+
COPY --from=builder /tmp/python-${PYTHON_VERSION}-${TARGETARCH}.sbom.json /opt/python-sbom.json
108+
109+
# Copy other artifacts
110+
COPY --from=builder /tmp/artifact /tmp/artifact
111+
112+
# Clean up source tarball if copied over
113+
RUN rm -f /opt/Python/${PYTHON_VERSION}/${TARGETARCH}/Python-${PYTHON_VERSION}.tgz
114+
115+
# Set Runtime Envs
92116
ENV PYTHON_INSTALL_DIR=/opt/Python/${PYTHON_VERSION}/${TARGETARCH}
93117
ENV pythonLocation=${PYTHON_INSTALL_DIR}
94118
ENV Python_ROOT_DIR=${PYTHON_INSTALL_DIR}
@@ -97,11 +121,5 @@ ENV PKG_CONFIG_PATH=${PYTHON_INSTALL_DIR}/lib/pkgconfig
97121
ENV LD_LIBRARY_PATH=${PYTHON_INSTALL_DIR}/lib
98122
ENV PATH=${PYTHON_INSTALL_DIR}/bin:$PATH
99123

100-
# Copy artifacts
101-
COPY --from=builder /tmp/artifact /tmp/artifact
102-
103-
#delete python source code
104-
RUN rm -f /opt/Python/${PYTHON_VERSION}/${TARGETARCH}/Python-${PYTHON_VERSION}.tgz
105-
106-
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 CMD python --version || exit 1
107-
CMD ["python"]
124+
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 CMD python3 --version || exit 1
125+
CMD ["python3"]

0 commit comments

Comments
 (0)