Skip to content

fix(docker): pin bcrypt below 5 so passlib can hash #4182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
official-burak wants to merge 1 commit into
base: develop
Choose a base branch
from
+7 −4
Open

fix(docker): pin bcrypt below 5 so passlib can hash #4182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions deployment/docker/job/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
unzip \
&& rm -rf /var/lib/apt/lists/*


# passlib 1.7.4 cannot load its bcrypt backend on bcrypt 5+ (#4180)
RUN pip3 install --no-cache-dir --break-system-packages \
"ansible-core>=2.16,<2.18" \
"ansible==${ANSIBLE_VERSION}" \
jmespath \
netaddr \
passlib
passlib \
'bcrypt>=4,<5'

RUN set -eux; \
for bin in sh cat chmod rm ls echo ssh ssh-agent ssh-add setsid git ansible-playbook python3; do \
Expand Down
3 changes: 2 additions & 1 deletion deployment/docker/runner/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM --platform=$BUILDPLATFORM golang:1.26-alpine3.24 as builder

Check warning on line 1 in deployment/docker/runner/Dockerfile

View workflow job for this annotation

GitHub Actions / deploy-runner

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

RUN apk add --no-cache -U \
libc-dev curl nodejs npm git gcc zip unzip tar
Expand All @@ -16,7 +16,7 @@
ARG APP_BUILD_TYPE
ARG TARGETOS
ARG TARGETARCH
ARG GH_TOKEN

Check warning on line 19 in deployment/docker/runner/Dockerfile

View workflow job for this annotation

GitHub Actions / deploy-runner

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

RUN if [ -n "$APP_BUILD_TYPE" ]; then \
git clone -b main https://${GH_TOKEN}@github.com/semaphoreui/semaphorepro-module.git pro_impl && \
Expand Down Expand Up @@ -85,11 +85,12 @@
ENV ANSIBLE_VERSION=${ANSIBLE_VERSION}
ARG ANSIBLE_VENV_PATH=/opt/semaphore/apps/ansible/${ANSIBLE_VERSION}/venv

# passlib 1.7.4 cannot load its bcrypt backend on bcrypt 5+ (#4180)
RUN apk add --no-cache -U python3-dev build-base openssl-dev libffi-dev cargo && \
mkdir -p ${ANSIBLE_VENV_PATH} && \
python3 -m venv ${ANSIBLE_VENV_PATH} --system-site-packages && \
source ${ANSIBLE_VENV_PATH}/bin/activate && \
pip3 install --upgrade pip ansible==${ANSIBLE_VERSION} boto3 botocore requests pywinrm passlib && \
pip3 install --upgrade pip ansible==${ANSIBLE_VERSION} boto3 botocore requests pywinrm passlib 'bcrypt>=4,<5' && \
apk del python3-dev build-base openssl-dev libffi-dev cargo && \
rm -rf /var/cache/apk/* && \
find ${ANSIBLE_VENV_PATH} -iname __pycache__ | xargs rm -rf && \
Expand Down
3 changes: 2 additions & 1 deletion deployment/docker/server/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM --platform=$BUILDPLATFORM golang:1.26-alpine3.24 as builder

Check warning on line 1 in deployment/docker/server/Dockerfile

View workflow job for this annotation

GitHub Actions / deploy-server

The 'as' keyword should match the case of the 'from' keyword 

FromAsCasing: 'as' and 'FROM' keywords' casing do not match
More info: https://docs.docker.com/go/dockerfile/rule/from-as-casing/

RUN apk add --no-cache -U \
libc-dev curl nodejs npm git gcc zip unzip tar
Expand All @@ -16,7 +16,7 @@
ARG APP_BUILD_TYPE
ARG TARGETOS
ARG TARGETARCH
ARG GH_TOKEN

Check warning on line 19 in deployment/docker/server/Dockerfile

View workflow job for this annotation

GitHub Actions / deploy-server

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

RUN if [ -n "$APP_BUILD_TYPE" ]; then \
git clone -b main https://${GH_TOKEN}@github.com/semaphoreui/semaphorepro-module.git pro_impl && \
Expand Down Expand Up @@ -86,11 +86,12 @@

WORKDIR /home/semaphore

# passlib 1.7.4 cannot load its bcrypt backend on bcrypt 5+ (#4180)
RUN apk add --no-cache -U python3-dev build-base openssl-dev libffi-dev cargo && \
mkdir -p ${ANSIBLE_VENV_PATH} && \
python3 -m venv ${ANSIBLE_VENV_PATH} --system-site-packages && \
source ${ANSIBLE_VENV_PATH}/bin/activate && \
pip3 install --upgrade pip ansible==${ANSIBLE_VERSION} boto3 botocore requests pywinrm passlib paramiko && \
pip3 install --upgrade pip ansible==${ANSIBLE_VERSION} boto3 botocore requests pywinrm passlib 'bcrypt>=4,<5' paramiko && \
apk del python3-dev build-base openssl-dev libffi-dev cargo && \
rm -rf /var/cache/apk/* && \
find ${ANSIBLE_VENV_PATH} -iname __pycache__ | xargs rm -rf && \
Expand Down
Loading