Skip to content

Commit 823e13a

Browse files
Kaniska244Kaniska244
authored
Merge branch 'main' into universal-vulnerability-issues-fix
2 parents 2be3c76 + 8eced02 commit 823e13a

File tree

32 files changed

+313
-28
lines changed

32 files changed

+313
-28
lines changed

‎src/base-debian/.devcontainer/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
# [Choice] Debian version (use bullseye on local arm64/Apple Silicon): bookworm, bullseye, buster
2-
ARG VARIANT="bookworm"
1+
# [Choice] Debian version (use bullseye on local arm64/Apple Silicon): trixie, bookworm, bullseye, buster
2+
ARG VARIANT="trixie"
33
FROM buildpack-deps:${VARIANT}-curl
44

55
# [Optional] Uncomment this section to install additional OS packages.

‎src/base-debian/README.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
| *Categories* | Core, Other |
1010
| *Image type* | Dockerfile |
1111
| *Published images* | mcr.microsoft.com/devcontainers/base:debian |
12-
| *Available image variants* | bookworm, bullseye ([full list](https://mcr.microsoft.com/v2/devcontainers/base/tags/list)) |
13-
| *Published image architecture(s)* | x86-64, aarch64/arm64 for `bookworm`, and `bullseye` variant |
12+
| *Available image variants* | trixie, bookworm, bullseye ([full list](https://mcr.microsoft.com/v2/devcontainers/base/tags/list)) |
13+
| *Published image architecture(s)* | x86-64, aarch64/arm64 for `trixie`, `bookworm`, and `bullseye` variant |
1414
| *Container host OS support* | Linux, macOS, Windows |
1515
| *Container OS* | Debian |
1616
| *Languages, platforms* | Any |
@@ -22,16 +22,17 @@ See **[history](history)** for information on the contents of published images.
2222
You can directly reference pre-built versions of `Dockerfile` by using the `image` property in `.devcontainer/devcontainer.json` or updating the `FROM` statement in your own `Dockerfile` to one of the following. An example `Dockerfile` is included in this repository.
2323

2424
- `mcr.microsoft.com/devcontainers/base:debian` (latest)
25+
- `mcr.microsoft.com/devcontainers/base:trixie` (or `debian-13`)
2526
- `mcr.microsoft.com/devcontainers/base:bookworm` (or `debian-12`)
2627
- `mcr.microsoft.com/devcontainers/base:bullseye` (or `debian-11`)
2728

2829
Refer to [this guide](https://containers.dev/guide/dockerfile) for more details.
2930

3031
You can decide how often you want updates by referencing a [semantic version](https://semver.org/) of each image. For example:
3132

32-
- `mcr.microsoft.com/devcontainers/base:1-bookworm`
33-
- `mcr.microsoft.com/devcontainers/base:1.0-bookworm`
34-
- `mcr.microsoft.com/devcontainers/base:1.0.0-bookworm`
33+
- `mcr.microsoft.com/devcontainers/base:1-trixie`
34+
- `mcr.microsoft.com/devcontainers/base:1.0-trixie`
35+
- `mcr.microsoft.com/devcontainers/base:1.0.0-trixie`
3536

3637
See [history](history) for information on the contents of each version and [here for a complete list of available tags](https://mcr.microsoft.com/v2/devcontainers/base/tags/list).
3738

‎src/base-debian/manifest.json‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
2-
"version": "1.0.25",
2+
"version": "2.0.0",
33
"variants": [
4+
"trixie",
45
"bookworm",
56
"bullseye"
67
],
78
"build": {
8-
"latest": "bookworm",
9+
"latest": "trixie",
910
"rootDistro": "debian",
1011
"architectures": {
12+
"trixie": [
13+
"linux/amd64",
14+
"linux/arm64"
15+
],
1116
"bookworm": [
1217
"linux/amd64",
1318
"linux/arm64"
@@ -21,12 +26,16 @@
2126
"base:${VERSION}-${VARIANT}"
2227
],
2328
"variantTags": {
24-
"bookworm": [
25-
"base:${VERSION}-debian-12",
26-
"base:${VERSION}-debian12",
29+
"trixie": [
30+
"base:${VERSION}-debian-13",
31+
"base:${VERSION}-debian13",
2732
"base:${VERSION}-debian",
2833
"base:${VERSION}"
2934
],
35+
"bookworm": [
36+
"base:${VERSION}-debian-12",
37+
"base:${VERSION}-debian12"
38+
],
3039
"bullseye": [
3140
"base:${VERSION}-debian-11",
3241
"base:${VERSION}-debian11"

‎src/go/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
ARG VARIANT=1.25-bookworm
22
FROM golang:${VARIANT}
33

4+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
5+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
6+
RUN chmod +x /tmp/install-subversion.sh
7+
RUN /tmp/install-subversion.sh \
8+
&& rm -f /tmp/install-subversion.sh
9+
410
# [Optional] Uncomment the next line to use go get to install anything else you need
511
# RUN go get -x <your-dependency-or-tool>
612

‎src/go/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/go/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.4.5",
2+
"version": "1.4.6",
33
"variants": [
44
"1.25-bookworm",
55
"1.24-bookworm",

‎src/go/test-project/test.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
2424

2525
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
2626

27+
# Testing vulnerability issue CVE-2024-46901 fix by upgrading svn to 1.14.5.
28+
svn_version=$(svn --version --quiet)
29+
check-version-ge "svn-requirement" "${svn_version}" "1.14.5"
30+
2731
check "Oh My Zsh! theme" test -e $HOME/.oh-my-zsh/custom/themes/devcontainers.zsh-theme
2832
check "zsh theme symlink" test -e $HOME/.oh-my-zsh/custom/themes/codespaces.zsh-theme
2933

‎src/javascript-node/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ RUN \
2222
&& su ${USERNAME} -c "umask 0002 && npm install -g eslint" \
2323
&& npm cache clean --force > /dev/null 2>&1
2424

25+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
26+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
27+
RUN chmod +x /tmp/install-subversion.sh
28+
RUN /tmp/install-subversion.sh \
29+
&& rm -f /tmp/install-subversion.sh
30+
2531
# [Optional] Uncomment this section to install additional OS packages.
2632
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
2733
# && apt-get -y install --no-install-recommends <your-package-list-here>

‎src/javascript-node/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/javascript-node/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "3.0.2",
2+
"version": "3.0.3",
33
"variants": [
44
"24-bookworm",
55
"22-bookworm",

0 commit comments

Comments
 (0)