Skip to content

[miniconda] Patch Python due to GHSA-5cpq-8wj7-hf2v #634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jul 26, 2023
Merged

[miniconda] Patch Python due to GHSA-5cpq-8wj7-hf2v #634

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
93c29b1
[miniconda] Patch Python due to GHSA-5cpq-8wj7-hf2v
alexander-smolyakov Jun 20, 2023
23af00f
Fix text
alexander-smolyakov Jun 20, 2023
8c248c0
Rework fix
alexander-smolyakov Jun 20, 2023
7634669
test: Replace command
alexander-smolyakov Jun 21, 2023
5e2fbd2
test: Enable `pip_interop_enabled` for conda
alexander-smolyakov Jun 23, 2023
16d7b90
Merge remote-tracking branch 'upstream/main' into users/alexander-smo…
alexander-smolyakov Jul 26, 2023
dbd4048
Rework patch
alexander-smolyakov Jul 26, 2023
b9f7e6f
Fix dockerfile
alexander-smolyakov Jul 26, 2023
f03c050
Test: Restore patch for `requests` package
alexander-smolyakov Jul 26, 2023
8f76e8c
Update test.sh
alexander-smolyakov Jul 26, 2023
ecf86c4
Update Dockerfile
alexander-smolyakov Jul 26, 2023
1afba0a
Revert patch for `requests` package due to issues with `conda-install…
alexander-smolyakov Jul 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions src/miniconda/.devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,16 @@ RUN if [ -f "/tmp/conda-tmp/environment.yml" ]; then umask 0002 && /opt/conda/bi

# Temporary: Upgrade python packages due to mentioned CVEs
# They are installed by the base image (continuumio/miniconda3) which does not have the patch.
RUN python3 -m pip install --upgrade \
RUN conda update -y conda \
# uninstall vulnerable packages
&& python3 -m pip uninstall --yes \
cryptography \
&& python3 -m pip install --upgrade \
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681
requests
requests \
# https://github.com/pyca/cryptography/security/advisories/GHSA-5cpq-8wj7-hf2v
pyopenssl \
cryptography

# [Optional] Uncomment this section to install additional OS packages.
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
Expand Down
8 changes: 8 additions & 0 deletions src/miniconda/test-project/test-utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,3 +172,11 @@ checkPythonPackageVersion()
current_version=$(python -c "import ${PACKAGE}; print(${PACKAGE}.__version__)")
check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
}

checkCondaPackageVersion()
{
PACKAGE=$1
REQUIRED_VERSION=$2
current_version=$(conda list "${PACKAGE}" | grep -w "${PACKAGE}" | awk '{print $2}')
check-version-ge "conda-${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
}
8 changes: 7 additions & 1 deletion src/miniconda/test-project/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,17 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont

check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"

checkPythonPackageVersion "cryptography" "38.0.3"
checkPythonPackageVersion "cryptography" "41.0.0"
checkPythonPackageVersion "setuptools" "65.5.1"
checkPythonPackageVersion "wheel" "0.38.1"
checkPythonPackageVersion "requests" "2.31.0"

checkCondaPackageVersion "cryptography" "41.0.0"
checkCondaPackageVersion "pyopenssl" "23.2.0"
checkCondaPackageVersion "setuptools" "65.5.1"
checkCondaPackageVersion "wheel" "0.38.1"
checkCondaPackageVersion "requests" "2.31.0"

check "conda-update-conda" bash -c "conda update -y conda"
check "conda-install" bash -c "conda install -c conda-forge --yes tensorflow"
check "conda-install" bash -c "conda install -c conda-forge --yes pytorch"
Expand Down