Skip to content

Commit 35a09c3

Browse files
tianontianon
committed
Fix "gpg" usage to stop relying on deprecated and insecure behavior
1 parent ec5ce80 commit 35a09c3

File tree

6 files changed

+60
-36
lines changed

6 files changed

+60
-36
lines changed

‎9.1/Dockerfile

+10-6
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ FROM debian:jessie
55
RUN groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 postgres
66

77
# grab gosu for easy step-down from root
8-
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10-
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11-
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12-
&& gpg --verify /usr/local/bin/gosu.asc \
13-
&& rm /usr/local/bin/gosu.asc \
8+
ENV GOSU_VERSION 1.7
9+
RUN set -x \
10+
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
11+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
12+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
13+
&& export GNUPGHOME="$(mktemp -d)" \
14+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
15+
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
16+
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
1417
&& chmod +x /usr/local/bin/gosu \
18+
&& gosu nobody true \
1519
&& apt-get purge -y --auto-remove ca-certificates wget
1620

1721
# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default

‎9.2/Dockerfile

+10-6
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ FROM debian:jessie
55
RUN groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 postgres
66

77
# grab gosu for easy step-down from root
8-
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10-
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11-
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12-
&& gpg --verify /usr/local/bin/gosu.asc \
13-
&& rm /usr/local/bin/gosu.asc \
8+
ENV GOSU_VERSION 1.7
9+
RUN set -x \
10+
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
11+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
12+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
13+
&& export GNUPGHOME="$(mktemp -d)" \
14+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
15+
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
16+
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
1417
&& chmod +x /usr/local/bin/gosu \
18+
&& gosu nobody true \
1519
&& apt-get purge -y --auto-remove ca-certificates wget
1620

1721
# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default

‎9.3/Dockerfile

+10-6
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ FROM debian:jessie
55
RUN groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 postgres
66

77
# grab gosu for easy step-down from root
8-
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10-
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11-
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12-
&& gpg --verify /usr/local/bin/gosu.asc \
13-
&& rm /usr/local/bin/gosu.asc \
8+
ENV GOSU_VERSION 1.7
9+
RUN set -x \
10+
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
11+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
12+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
13+
&& export GNUPGHOME="$(mktemp -d)" \
14+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
15+
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
16+
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
1417
&& chmod +x /usr/local/bin/gosu \
18+
&& gosu nobody true \
1519
&& apt-get purge -y --auto-remove ca-certificates wget
1620

1721
# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default

‎9.4/Dockerfile

+10-6
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ FROM debian:jessie
55
RUN groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 postgres
66

77
# grab gosu for easy step-down from root
8-
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10-
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11-
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12-
&& gpg --verify /usr/local/bin/gosu.asc \
13-
&& rm /usr/local/bin/gosu.asc \
8+
ENV GOSU_VERSION 1.7
9+
RUN set -x \
10+
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
11+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
12+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
13+
&& export GNUPGHOME="$(mktemp -d)" \
14+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
15+
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
16+
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
1417
&& chmod +x /usr/local/bin/gosu \
18+
&& gosu nobody true \
1519
&& apt-get purge -y --auto-remove ca-certificates wget
1620

1721
# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default

‎9.5/Dockerfile

+10-6
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ FROM debian:jessie
55
RUN groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 postgres
66

77
# grab gosu for easy step-down from root
8-
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10-
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11-
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12-
&& gpg --verify /usr/local/bin/gosu.asc \
13-
&& rm /usr/local/bin/gosu.asc \
8+
ENV GOSU_VERSION 1.7
9+
RUN set -x \
10+
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
11+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
12+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
13+
&& export GNUPGHOME="$(mktemp -d)" \
14+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
15+
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
16+
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
1417
&& chmod +x /usr/local/bin/gosu \
18+
&& gosu nobody true \
1519
&& apt-get purge -y --auto-remove ca-certificates wget
1620

1721
# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default

‎Dockerfile.template

+10-6
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ FROM debian:jessie
55
RUN groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 postgres
66

77
# grab gosu for easy step-down from root
8-
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9-
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10-
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11-
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12-
&& gpg --verify /usr/local/bin/gosu.asc \
13-
&& rm /usr/local/bin/gosu.asc \
8+
ENV GOSU_VERSION 1.7
9+
RUN set -x \
10+
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
11+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
12+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
13+
&& export GNUPGHOME="$(mktemp -d)" \
14+
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
15+
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
16+
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
1417
&& chmod +x /usr/local/bin/gosu \
18+
&& gosu nobody true \
1519
&& apt-get purge -y --auto-remove ca-certificates wget
1620

1721
# make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default

0 commit comments

Comments
 (0)