Skip to content

Commit ec6f6a9

Browse files
alexander-smolyakovalexander-smolyakov
authored
[universal] Conda: patch Python due to CVE-2023-32681 and GHSA-5cpq-8wj7-hf2v (#627)
* [universal] Conda: patch Python due to CVE-2023-32681 and GHSA-5cpq-8wj7-hf2v - Reorganize features installation queue; - Introduce patch-conda feature; * Review comment: Update features schema and container schema * Restart checks * Revert "Review comment: Update features schema and container schema" This reverts commit 046b94c. * Review comment: Update features schema and container schema * Review comment: Add tests * Set up `installsAfter` for features * Define `installsAfter` for `patch-conda` feature * Lock packages version * Add tests for conda * Rework patch * Bump `cryptography` version * Bump `cryptography` version * Restart checks * Add tests * Revert "Add tests" This reverts commit a74d406. * Update test-utils.sh * Restart checks * Restart checks
1 parent 47bbd23 commit ec6f6a9

File tree

6 files changed

+104
-13
lines changed

6 files changed

+104
-13
lines changed

‎src/universal/.devcontainer/devcontainer.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,8 @@
7272
"./local-features/jekyll": "latest",
7373
"ghcr.io/devcontainers/features/oryx:1": "latest",
7474
"./local-features/setup-user": "latest",
75-
"./local-features/patch-python": "latest"
75+
"./local-features/patch-python": {},
76+
"./local-features/patch-conda": {}
7677
},
7778
"overrideFeatureInstallOrder": [
7879
"ghcr.io/devcontainers/features/common-utils",
@@ -81,11 +82,12 @@
8182
"ghcr.io/devcontainers/features/hugo",
8283
"ghcr.io/devcontainers/features/node",
8384
"./local-features/nvs",
85+
"ghcr.io/devcontainers/features/conda",
86+
"./local-features/patch-conda",
8487
"ghcr.io/devcontainers/features/python",
8588
"./local-features/patch-python",
8689
"./local-features/machine-learning-packages",
8790
"ghcr.io/devcontainers/features/php",
88-
"ghcr.io/devcontainers/features/conda",
8991
"ghcr.io/devcontainers/features/ruby",
9092
"ghcr.io/devcontainers/features/java",
9193
"ghcr.io/devcontainers/features/sshd",

‎src/universal/.devcontainer/local-features/machine-learning-packages/devcontainer-feature.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
"installsAfter": [
55
"ghcr.io/devcontainers/features/python"
66
]
7-
}
7+
}

‎src/universal/.devcontainer/local-features/patch-conda/devcontainer-feature.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"id": "patch-conda",
3+
"name": "Patch Conda Packages",
4+
"installsAfter": [
5+
"ghcr.io/devcontainers/features/conda"
6+
]
7+
}

‎src/universal/.devcontainer/local-features/patch-conda/install.sh‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/usr/bin/env bash
2+
#-------------------------------------------------------------------------------------------------------------
3+
# Copyright (c) Microsoft Corporation. All rights reserved.
4+
# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
5+
#-------------------------------------------------------------------------------------------------------------
6+
7+
USERNAME=${USERNAME:-"codespace"}
8+
9+
set -eux
10+
11+
if [ "$(id -u)" -ne 0 ]; then
12+
echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
13+
exit 1
14+
fi
15+
16+
# Ensure that login shells get the correct path if the user updated the PATH using ENV.
17+
rm -f /etc/profile.d/00-restore-env.sh
18+
echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
19+
chmod +x /etc/profile.d/00-restore-env.sh
20+
21+
export DEBIAN_FRONTEND=noninteractive
22+
23+
sudo_if() {
24+
COMMAND="$*"
25+
if [ "$(id -u)" -eq 0 ] && [ "$USERNAME" != "root" ]; then
26+
su - "$USERNAME" -c "$COMMAND"
27+
else
28+
"$COMMAND"
29+
fi
30+
}
31+
32+
update_python_package() {
33+
PYTHON_PATH=$1
34+
PACKAGE=$2
35+
VERSION=$3
36+
37+
sudo_if "$PYTHON_PATH -m pip uninstall --yes $PACKAGE"
38+
sudo_if "$PYTHON_PATH -m pip install --upgrade --no-cache-dir $PACKAGE==$VERSION"
39+
}
40+
41+
update_conda_package() {
42+
PACKAGE=$1
43+
VERSION=$2
44+
45+
sudo_if "conda install $PACKAGE=$VERSION"
46+
}
47+
48+
sudo_if /opt/conda/bin/python3 -m pip install --upgrade pip
49+
50+
# Temporary: Upgrade python packages due to security vulnerabilities
51+
# They are installed by the conda feature and Conda distribution does not have the patches.
52+
53+
# https://github.com/advisories/GHSA-5cpq-8wj7-hf2v
54+
update_conda_package pyopenssl "23.2.0"
55+
update_conda_package cryptography "41.0.2"
56+
57+
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681
58+
update_conda_package requests "2.31.0"

‎src/universal/test-project/test-utils.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,3 +217,21 @@ checkDirectoryOwnership() {
217217
return 1
218218
fi
219219
}
220+
221+
checkPythonPackageVersion()
222+
{
223+
PYTHON_PATH=$1
224+
PACKAGE=$2
225+
REQUIRED_VERSION=$3
226+
227+
current_version=$(${PYTHON_PATH} -c "import ${PACKAGE}; print(${PACKAGE}.__version__)")
228+
check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
229+
}
230+
231+
checkCondaPackageVersion()
232+
{
233+
PACKAGE=$1
234+
REQUIRED_VERSION=$2
235+
current_version=$(conda list "${PACKAGE}" | grep -E "^${PACKAGE}\s" | awk '{print $2}')
236+
check-version-ge "conda-${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
237+
}

‎src/universal/test-project/test.sh‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,6 @@ check "torch" python -c "import torch; print(torch.__version__)"
5555
check "requests" python -c "import requests; print(requests.__version__)"
5656
check "jupyterlab-git" bash -c "python3 -m pip list | grep jupyterlab-git"
5757

58-
setuptools_version=$(python3 -c "import setuptools; print(setuptools.__version__)")
59-
check-version-ge "setuptools-requirement" "${setuptools_version}" "65.5.1"
60-
6158
# Check JupyterLab
6259
check "jupyter-lab" jupyter-lab --version
6360
check "jupyter-lab config" grep ".*.allow_origin = '*'" /home/codespace/.jupyter/jupyter_server_config.py
@@ -187,16 +184,25 @@ check "java-version-on-path-is-12.0.2" java --version | grep 12.0.2
187184
MAVEN_PATH=$(cd /usr/local/sdkman/candidates/maven/3*/lib/ && pwd)
188185
check "commons-io-lib" bash -c "ls ${MAVEN_PATH} | grep commons-io-2.11.jar"
189186

190-
wheel_version=$(python -c "import wheel; print(wheel.__version__)")
191-
check-version-ge "wheel-requirement" "${wheel_version}" "0.38.1"
192-
193187
ls -la /home/codespace
194188

195-
setuptools_version_py_current=$(python -c "import setuptools; print(setuptools.__version__)")
196-
check-version-ge "setuptools-requirement-python_current" "${setuptools_version_py_current}" "65.5.1"
189+
## Python - current
190+
checkPythonPackageVersion "python" "wheel" "0.38.1"
191+
checkPythonPackageVersion "python" "setuptools" "65.5.1"
192+
checkPythonPackageVersion "python" "requests" "2.31.0"
193+
194+
## Python 3.9
195+
checkPythonPackageVersion "/usr/local/python/3.9.*/bin/python" "setuptools" "65.5.1"
196+
197+
## Conda Python
198+
checkCondaPackageVersion "requests" "2.31.0"
199+
checkCondaPackageVersion "cryptography" "41.0.2"
200+
checkCondaPackageVersion "pyopenssl" "23.2.0"
197201

198-
setuptools_version_py_39=$(/usr/local/python/3.9.*/bin/python -c "import setuptools; print(setuptools.__version__)")
199-
check-version-ge "setuptools-requirement-python_39" "${setuptools_version_py_39}" "65.5.1"
202+
## Test Conda
203+
check "conda-update-conda" bash -c "conda update -y conda"
204+
check "conda-install" bash -c "conda install -c conda-forge --yes tensorflow"
205+
check "conda-install" bash -c "conda install -c conda-forge --yes pytorch"
200206

201207
# Report result
202208
reportResults

0 commit comments

Comments
 (0)