Vuln/203 v5.1.13

Dockerfile

@@ -1,7 +1,7 @@
-FROM registry.cloudogu.com/official/base:3.19.4-4
+FROM registry.cloudogu.com/official/base:3.24.1-1
 
 LABEL NAME="official/redmine" \
-   VERSION="5.1.8-6" \
+   VERSION="5.1.13-0" \
    maintainer="hello@cloudogu.com"
 
 ENV USER=redmine \
@@ -11,12 +11,18 @@ ENV USER=redmine \
     RAILS_ENV=production \
     RAILS_RELATIVE_URL_ROOT=/redmine \
     STARTUP_DIR=/ \
+    # Ruby version
+    RUBY_VERSION=3.2.11 \
+    RUBY_TARGZ_SHA256=b3eeabd6636f334531db3ffdc3229eb05e524740e6c84fdc043720573cf2f8b2 \
+    # ruby-install version
+    RUBY_INSTALL_VERSION=0.10.2 \
+    RUBY_INSTALL_TARGZ_SHA256=65836158b8026992b2e96ed344f3d888112b2b105d0166ecb08ba3b4a0d91bf6 \
     # Rubycas-client version
     RUBYCASVERSION=2.4.0 \
     RUBYCAS_TARGZ_SHA256=1fb29cf6a2331dc91b7cdca3d9b231866a4cfc36c4c5f03cedd89c74cc5aae05 \
     # Redmine version
-    REDMINE_VERSION=5.1.8 \
-    REDMINE_TARGZ_SHA256=50a30cd16c43d0ae64f256866c8cef4b0e9dd818d6feef489fa24507fbde3a7b \
+    REDMINE_VERSION=5.1.13 \
+    REDMINE_TARGZ_SHA256=1a3d1039e474e787cebf223da148bf28373e4bca262197a53cfa6139640ebe5f \
     REDMINE_PATH="/usr/share/webapps/redmine" \
     # Rest-API-Plugin version
     EXTENDED_REST_API_PLUGIN_VERSION=1.1.0 \
@@ -82,26 +88,52 @@ RUN set -eux -o pipefail \
  && apk --no-cache add --virtual /.run-deps \
    postgresql16-client \
    imagemagick \
+   ghostscript \
    tzdata \
-   ruby \
-   ruby-bundler \
-   ruby-rdoc \
+   openssl \
+   yaml \
+   readline \
+   zlib \
+   gmp \
+   ncurses-libs \
    tini \
    libffi \
    su-exec \
    git \
+   subversion \
+   mercurial \
+   cvs \
+   breezy \
    curl \
  # install build dependencies
  && apk --no-cache add --virtual /.build-deps \
    build-base \
-   ruby-dev \
    libxslt-dev \
    postgresql-dev \
    sqlite-dev \
    linux-headers \
    patch \
    coreutils \
    libffi-dev \
+   openssl-dev \
+   yaml-dev \
+   readline-dev \
+   zlib-dev \
+   gmp-dev \
+   ncurses-dev \
+   bzip2 \
+   xz \
+ # install Ruby
+ && wget -O ruby-install-${RUBY_INSTALL_VERSION}.tar.gz "https://github.com/postmodern/ruby-install/releases/download/v${RUBY_INSTALL_VERSION}/ruby-install-${RUBY_INSTALL_VERSION}.tar.gz" \
+ && echo "${RUBY_INSTALL_TARGZ_SHA256} *ruby-install-${RUBY_INSTALL_VERSION}.tar.gz" | sha256sum -c - \
+ && tar xfz ruby-install-${RUBY_INSTALL_VERSION}.tar.gz \
+ && make -C ruby-install-${RUBY_INSTALL_VERSION} install \
+ && rm -rf ruby-install-${RUBY_INSTALL_VERSION} ruby-install-${RUBY_INSTALL_VERSION}.tar.gz \
+ && ruby-install --system --cleanup --no-install-deps \
+   --url "https://cache.ruby-lang.org/pub/ruby/3.2/ruby-${RUBY_VERSION}.tar.gz" \
+   --sha256 "${RUBY_TARGZ_SHA256}" \
+   ruby "${RUBY_VERSION}" \
+   -- --disable-install-doc --enable-shared \
  # update ruby gems
  && echo 'gem: --no-document' > /etc/gemrc \
  && 2>/dev/null 1>&2 gem update --system --quiet \
@@ -135,6 +167,7 @@ RUN set -eux -o pipefail \
  && bundle config set --local without 'development test' \
  && bundle install \
  && gem install puma \
+ && ln -sf /usr/local/bin/puma /usr/bin/puma \
  # Do not remove the dependency on bigdecimal. Many tools rely on bigdecimal, and it may not be possible to install it in a running dogu
  && gem install bigdecimal -v 3.1.6 \
  && bundle add bigdecimal --version=3.1.6 \
@@ -143,7 +176,6 @@ RUN set -eux -o pipefail \
  && rm -rf /root/* /tmp/* $(gem env gemdir)/cache \
  && apk --purge del /.build-deps \
  && rm -rf /var/cache/apk/* \
- && apk add ruby-irb \
  && chown "${USER}":"${USER}" "${WORKDIR}/Gemfile.lock"
 
 WORKDIR ${WORKDIR}

Makefile

@@ -1,6 +1,6 @@
-MAKEFILES_VERSION=10.5.0
+MAKEFILES_VERSION=10.10.0
 
-BASE_VERSION=5.1.8
+BASE_VERSION=5.1.13
 
 .DEFAULT_GOAL:=dogu-release
 

build/make/coder-lib.sh

@@ -88,7 +88,7 @@ function doTrivyConvert() {
   "$containerExec" run --rm --pull=always \
     -v trivy-cache:/root/.cache \
     -v "$jsonScanToConvert:$containerJsonScanFile" \
-    aquasec/trivy -q \
+    "${TRIVY_IMAGE}" -q \
     convert $trivyFlags "$containerJsonScanFile"  > "$outputFile"
 }
 

build/make/coder.mk

@@ -35,6 +35,10 @@ GOPASS_BIN?=$(shell command -v gopass 2> /dev/null)
 
 EXCLUDED_TEMPLATE_FILES?=rich-parameters.yaml variables.yaml
 
+TRIVY_VERSION ?= latest
+TRIVY_IMAGE = aquasec/trivy:$(TRIVY_VERSION)
+
+export TRIVY_IMAGE
 
 ##@ Coder template development
 
@@ -107,7 +111,7 @@ ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}: ${CONTAINER_IMAGE_TAR}
 	${CONTAINER_BIN} run --rm --pull=always \
 		-v "trivy-cache:/root/.cache" \
 		-v "${CONTAINER_IMAGE_TAR}:/tmp/image.tar" \
-		aquasec/trivy -q \
+		$(TRIVY_IMAGE) -q \
 		image --scanners vuln --input /tmp/image.tar -f json --timeout 15m \
 		> ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
 

build/make/k8s-component.mk

@@ -1,26 +1,37 @@
+COMPONENT_ARTIFACT_ID?=$(ARTIFACT_ID)
 COMPONENT_BUILD_VERSION := $(shell date +%s)
 COMPONENT_DEV_VERSION?=${VERSION}-dev.${COMPONENT_BUILD_VERSION}
 
-include ${BUILD_DIR}/make/k8s.mk
+ifeq (${K8S_MK_INCLUDE_MARKER}, )
+	include ${BUILD_DIR}/make/k8s.mk
+endif
 
 ifeq (${RUNTIME_ENV}, local)
 	BINARY_HELM_ADDITIONAL_PUSH_ARGS?=--plain-http
 endif
+ifeq (${RUNTIME_ENV}, k3d)
+	BINARY_HELM_ADDITIONAL_PUSH_ARGS?=--plain-http
+endif
 BINARY_HELM_ADDITIONAL_PACK_ARGS?=
 BINARY_HELM_ADDITIONAL_UNINST_ARGS?=
 BINARY_HELM_ADDITIONAL_UPGR_ARGS?=
 
 HELM_TARGET_DIR ?= $(K8S_RESOURCE_TEMP_FOLDER)/helm
 HELM_SOURCE_DIR ?= k8s/helm
-HELM_RELEASE_TGZ=${HELM_TARGET_DIR}/${ARTIFACT_ID}-${VERSION}.tgz
-HELM_DEV_RELEASE_TGZ=${HELM_TARGET_DIR}/${ARTIFACT_ID}-${COMPONENT_DEV_VERSION}.tgz
+HELM_RELEASE_TGZ=${HELM_TARGET_DIR}/${COMPONENT_ARTIFACT_ID}-${VERSION}.tgz
+HELM_DEV_RELEASE_TGZ=${HELM_TARGET_DIR}/${COMPONENT_ARTIFACT_ID}-${COMPONENT_DEV_VERSION}.tgz
 HELM_ARTIFACT_NAMESPACE?=k8s
+HELM_PUSH_REGISTRY_HOST?=${CES_REGISTRY_HOST}
 ifeq (${RUNTIME_ENV}, remote)
 	HELM_ARTIFACT_NAMESPACE=testing/k8s
 endif
+ifeq (${RUNTIME_ENV}, k3d)
+	HELM_PUSH_REGISTRY_HOST=$(IMAGE_PUSH_REGISTRY_HOST)
+endif
 $(info HELM_ARTIFACT_NAMESPACE=$(HELM_ARTIFACT_NAMESPACE))
+$(info HELM_PUSH_REGISTRY_HOST=$(HELM_PUSH_REGISTRY_HOST))
 
-K8S_RESOURCE_COMPONENT ?= "${K8S_RESOURCE_TEMP_FOLDER}/component-${ARTIFACT_ID}-${VERSION}.yaml"
+K8S_RESOURCE_COMPONENT ?= "${K8S_RESOURCE_TEMP_FOLDER}/component-${COMPONENT_ARTIFACT_ID}-${VERSION}.yaml"
 K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML ?= $(BUILD_DIR)/make/k8s-component.tpl
 # HELM_PRE_GENERATE_TARGETS allows to execute targets that affect Helm source files AND Helm target files.
 HELM_PRE_GENERATE_TARGETS ?=
@@ -38,8 +49,8 @@ IMAGE_IMPORT_TARGET?=
 helm-init-chart: ${BINARY_HELM} ## Creates a Chart.yaml-template with zero values
 	@echo "Initialize ${HELM_SOURCE_DIR}/Chart.yaml..."
 	@mkdir -p ${HELM_SOURCE_DIR}/tmp/
-	@${BINARY_HELM} create ${HELM_SOURCE_DIR}/tmp/${ARTIFACT_ID}
-	@cp ${HELM_SOURCE_DIR}/tmp/${ARTIFACT_ID}/Chart.yaml ${HELM_SOURCE_DIR}/
+	@${BINARY_HELM} create ${HELM_SOURCE_DIR}/tmp/${COMPONENT_ARTIFACT_ID}
+	@cp ${HELM_SOURCE_DIR}/tmp/${COMPONENT_ARTIFACT_ID}/Chart.yaml ${HELM_SOURCE_DIR}/
 	@rm -dr ${HELM_SOURCE_DIR}/tmp
 	@sed -i 's/appVersion: ".*"/appVersion: "0.0.0-replaceme"/' ${HELM_SOURCE_DIR}/Chart.yaml
 	@sed -i 's/version: .*/version: 0.0.0-replaceme/' ${HELM_SOURCE_DIR}/Chart.yaml
@@ -82,24 +93,24 @@ helm-update-dependencies: ${BINARY_HELM} ## Update Helm chart dependencies
 .PHONY: helm-apply
 helm-apply: ${BINARY_HELM} check-k8s-namespace-env-var ${IMAGE_IMPORT_TARGET} helm-generate ${HELM_PRE_APPLY_TARGETS} ## Generates and installs the Helm chart.
 	@echo "Apply generated helm chart"
-	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" upgrade -i ${ARTIFACT_ID} ${HELM_TARGET_DIR} ${BINARY_HELM_ADDITIONAL_UPGR_ARGS} --namespace ${NAMESPACE}
+	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" upgrade -i ${COMPONENT_ARTIFACT_ID} ${HELM_TARGET_DIR} ${BINARY_HELM_ADDITIONAL_UPGR_ARGS} --namespace ${NAMESPACE}
 
 .PHONY: helm-delete
 helm-delete: ${BINARY_HELM} check-k8s-namespace-env-var ## Uninstalls the current Helm chart.
 	@echo "Uninstall helm chart"
-	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" uninstall ${ARTIFACT_ID} --namespace=${NAMESPACE} ${BINARY_HELM_ADDITIONAL_UNINST_ARGS} || true
+	@${BINARY_HELM} --kube-context="${KUBE_CONTEXT_NAME}" uninstall ${COMPONENT_ARTIFACT_ID} --namespace=${NAMESPACE} ${BINARY_HELM_ADDITIONAL_UNINST_ARGS} || true
 
 .PHONY: helm-reinstall
 helm-reinstall: helm-delete helm-apply ## Uninstalls the current helm chart and reinstalls it.
 
 .PHONY: helm-chart-import
 helm-chart-import: ${CHECK_VAR_TARGETS} helm-generate helm-package ${IMAGE_IMPORT_TARGET} ## Imports the currently available chart into the cluster-local registry.
 	@if [[ ${STAGE} == "development" ]]; then \
-		echo "Import ${HELM_DEV_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-		${BINARY_HELM} push ${HELM_DEV_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+		echo "Import ${HELM_DEV_RELEASE_TGZ} into K8s cluster ${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+		${BINARY_HELM} push ${HELM_DEV_RELEASE_TGZ} oci://${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
 	else \
-	  	echo "Import ${HELM_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-        ${BINARY_HELM} push ${HELM_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+	  	echo "Import ${HELM_RELEASE_TGZ} into K8s cluster ${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+        ${BINARY_HELM} push ${HELM_RELEASE_TGZ} oci://${HELM_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
     fi
 	@echo "Done."
 
@@ -122,7 +133,7 @@ ${HELM_RELEASE_TGZ}: ${BINARY_HELM} ${HELM_TARGET_DIR}/Chart.yaml ${HELM_POST_GE
 .PHONY: helm-delete-existing-tgz
 helm-delete-existing-tgz: ## Remove an existing Helm package from the target directory.
 	@echo "Delete ${HELM_RELEASE_TGZ}*"
-	@rm -f ${HELM_TARGET_DIR}/${ARTIFACT_ID}-*.tgz
+	@rm -f ${HELM_TARGET_DIR}/${COMPONENT_ARTIFACT_ID}-*.tgz
 
 ##@ K8s - Helm lint targets
 
@@ -138,9 +149,9 @@ component-generate: ${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML} ${COMPONENT_POST_
 ${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}: ${K8S_RESOURCE_TEMP_FOLDER}
 	@echo "Generating temporary K8s component resource: ${K8S_RESOURCE_COMPONENT}"
 	@if [[ ${STAGE} == "development" ]]; then \
-		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(ARTIFACT_ID)|g"  | sed "s|VERSION|$(COMPONENT_DEV_VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
+		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(COMPONENT_ARTIFACT_ID)|g"  | sed "s|VERSION|$(COMPONENT_DEV_VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
 	else \
-		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(ARTIFACT_ID)|g"  | sed "s|VERSION|$(VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
+		sed "s|NAMESPACE|$(HELM_ARTIFACT_NAMESPACE)|g" "${K8S_RESOURCE_COMPONENT_CR_TEMPLATE_YAML}" | sed "s|NAME|$(COMPONENT_ARTIFACT_ID)|g"  | sed "s|VERSION|$(VERSION)|g" > "${K8S_RESOURCE_COMPONENT}"; \
 	fi
 
 .PHONY: component-apply

build/make/k8s-crd.mk

@@ -90,11 +90,11 @@ ${HELM_CRD_RELEASE_TGZ}: ${BINARY_HELM} crd-helm-generate ## Generates and packa
 .PHONY: crd-helm-chart-import
 crd-helm-chart-import: ${CHECK_VAR_TARGETS} check-k8s-artifact-id crd-helm-generate crd-helm-package ## Imports the currently available Helm CRD chart into the cluster-local registry.
 	@if [[ ${STAGE} == "development" ]]; then \
-		echo "Import ${HELM_CRD_DEV_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-		${BINARY_HELM} push ${HELM_CRD_DEV_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+		echo "Import ${HELM_CRD_DEV_RELEASE_TGZ} into K8s cluster ${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+		${BINARY_HELM} push ${HELM_CRD_DEV_RELEASE_TGZ} oci://${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
 	else \
-	  	echo "Import ${HELM_CRD_RELEASE_TGZ} into K8s cluster ${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
-        ${BINARY_HELM} push ${HELM_CRD_RELEASE_TGZ} oci://${CES_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
+	  	echo "Import ${HELM_CRD_RELEASE_TGZ} into K8s cluster ${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE}..."; \
+        ${BINARY_HELM} push ${HELM_CRD_RELEASE_TGZ} oci://${IMAGE_PUSH_REGISTRY_HOST}/${HELM_ARTIFACT_NAMESPACE} ${BINARY_HELM_ADDITIONAL_PUSH_ARGS}; \
     fi
 	@echo "Done."
 

build/make/k8s-dogu.mk

@@ -11,12 +11,16 @@ VERSION=$(shell $(BINARY_YQ) -oy -e ".Version" $(DOGU_JSON_FILE))
 # Image of the dogu is extracted from the dogu.json
 IMAGE=$(shell $(BINARY_YQ) -oy -e ".Image" $(DOGU_JSON_FILE)):$(VERSION)
 
-include $(BUILD_DIR)/make/k8s.mk
+PRE_BUILD_TARGETS ?=
+
+ifeq (${K8S_MK_INCLUDE_MARKER}, )
+	include ${BUILD_DIR}/make/k8s.mk
+endif
 
 ##@ K8s - EcoSystem
 
 .PHONY: build
-build: image-import install-dogu-descriptor create-dogu-resource apply-dogu-resource ## Builds a new version of the dogu and deploys it into the K8s-EcoSystem.
+build: ${PRE_BUILD_TARGETS} image-import install-dogu-descriptor create-dogu-resource apply-dogu-resource ## Builds a new version of the dogu and deploys it into the K8s-EcoSystem.
 
 ##@ K8s - Dogu - Resource