oryx cannot build some reference like "xmlsec" automatically

[ding-01-r]

Bug Report

• 2024/07/04 I decide to feedback this problem. It's not the first time i meet this bug, but it starts to affect my work recently, it appeared nearly 2 years age.

• I enperience this problem in Azure web apps.

• We used the web app with python stack and windows os to deploy our websites. But 2 years ago, the type of web app we used had been retired. So we wanted to find another way to deploy our projects.

• At that time, we only had one type web app with linux os to choose(we don't want to use docker untill we have no choice, because our customer think docker deployment will bring safety issues), so we tried to create a new web app with python stack and linux os to deploy.

• However, when the webapp tried to pull deployment files from git repos, we found that deployment failed. After discussed with Azure support team, we found that oryx couldn't install some references like "xmlsec", so we needed to install this reference. but when we pull the files again , the reference(xmlsec) we installed in the web app had been cleaned from the web app, this mad us give up using linux os web app.

• Today，we find that out web site is scaned with a safety issue: tornado 6.1 has a known vulnerability; So we have to resolve this safety issue. To fix it, we need to change our deployment, to use high version webapp.

• As we are in China, we just have linux os web app to choose. So if we can't deploy out project in this way, we have to use docker, it will bring a lot unknown problems.

• Can we fix this bug? Or can you provide a list of unsupport references ?

• To reproduce this issue, I think we just need to deploy a project with the reference xmlsec.