From 4f3a81ff0f152003653eecd60d0c4e1f05ce99f0 Mon Sep 17 00:00:00 2001 From: Tianon Gravi Date: Fri, 26 Feb 2016 17:24:50 -0800 Subject: [PATCH] Fix "gpg" usage to stop relying on deprecated and insecure behavior --- 1.4/Dockerfile | 18 ++++++++++-------- 1.5/Dockerfile | 18 ++++++++++-------- 2.0/Dockerfile | 18 ++++++++++-------- 2.1/Dockerfile | 18 ++++++++++-------- 2.2/Dockerfile | 18 ++++++++++-------- Dockerfile.template | 18 ++++++++++-------- 6 files changed, 60 insertions(+), 48 deletions(-) diff --git a/1.4/Dockerfile b/1.4/Dockerfile index bbbb3c9a6..bc21e0bdb 100644 --- a/1.4/Dockerfile +++ b/1.4/Dockerfile @@ -10,14 +10,16 @@ RUN mkdir -p /usr/local/lib \ && ln -s /usr/lib/*/libzmq.so.3 /usr/local/lib/libzmq.so # grab gosu for easy step-down from root -RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 -RUN arch="$(dpkg --print-architecture)" \ - && set -x \ - && curl -o /usr/local/bin/gosu -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch" \ - && curl -o /usr/local/bin/gosu.asc -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch.asc" \ - && gpg --verify /usr/local/bin/gosu.asc \ - && rm /usr/local/bin/gosu.asc \ - && chmod +x /usr/local/bin/gosu +ENV GOSU_VERSION 1.7 +RUN set -x \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true # https://www.elastic.co/guide/en/logstash/2.0/package-repositories.html # https://packages.elasticsearch.org/GPG-KEY-elasticsearch diff --git a/1.5/Dockerfile b/1.5/Dockerfile index d82498925..90e757490 100644 --- a/1.5/Dockerfile +++ b/1.5/Dockerfile @@ -10,14 +10,16 @@ RUN mkdir -p /usr/local/lib \ && ln -s /usr/lib/*/libzmq.so.3 /usr/local/lib/libzmq.so # grab gosu for easy step-down from root -RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 -RUN arch="$(dpkg --print-architecture)" \ - && set -x \ - && curl -o /usr/local/bin/gosu -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch" \ - && curl -o /usr/local/bin/gosu.asc -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch.asc" \ - && gpg --verify /usr/local/bin/gosu.asc \ - && rm /usr/local/bin/gosu.asc \ - && chmod +x /usr/local/bin/gosu +ENV GOSU_VERSION 1.7 +RUN set -x \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true # https://www.elastic.co/guide/en/logstash/2.0/package-repositories.html # https://packages.elasticsearch.org/GPG-KEY-elasticsearch diff --git a/2.0/Dockerfile b/2.0/Dockerfile index fe192576d..88dcddfb8 100644 --- a/2.0/Dockerfile +++ b/2.0/Dockerfile @@ -10,14 +10,16 @@ RUN mkdir -p /usr/local/lib \ && ln -s /usr/lib/*/libzmq.so.3 /usr/local/lib/libzmq.so # grab gosu for easy step-down from root -RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 -RUN arch="$(dpkg --print-architecture)" \ - && set -x \ - && curl -o /usr/local/bin/gosu -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch" \ - && curl -o /usr/local/bin/gosu.asc -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch.asc" \ - && gpg --verify /usr/local/bin/gosu.asc \ - && rm /usr/local/bin/gosu.asc \ - && chmod +x /usr/local/bin/gosu +ENV GOSU_VERSION 1.7 +RUN set -x \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true # https://www.elastic.co/guide/en/logstash/2.0/package-repositories.html # https://packages.elasticsearch.org/GPG-KEY-elasticsearch diff --git a/2.1/Dockerfile b/2.1/Dockerfile index c1446d2fd..fe2e1cd52 100644 --- a/2.1/Dockerfile +++ b/2.1/Dockerfile @@ -10,14 +10,16 @@ RUN mkdir -p /usr/local/lib \ && ln -s /usr/lib/*/libzmq.so.3 /usr/local/lib/libzmq.so # grab gosu for easy step-down from root -RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 -RUN arch="$(dpkg --print-architecture)" \ - && set -x \ - && curl -o /usr/local/bin/gosu -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch" \ - && curl -o /usr/local/bin/gosu.asc -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch.asc" \ - && gpg --verify /usr/local/bin/gosu.asc \ - && rm /usr/local/bin/gosu.asc \ - && chmod +x /usr/local/bin/gosu +ENV GOSU_VERSION 1.7 +RUN set -x \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true # https://www.elastic.co/guide/en/logstash/2.0/package-repositories.html # https://packages.elasticsearch.org/GPG-KEY-elasticsearch diff --git a/2.2/Dockerfile b/2.2/Dockerfile index 07a4a2cf8..42925c576 100644 --- a/2.2/Dockerfile +++ b/2.2/Dockerfile @@ -10,14 +10,16 @@ RUN mkdir -p /usr/local/lib \ && ln -s /usr/lib/*/libzmq.so.3 /usr/local/lib/libzmq.so # grab gosu for easy step-down from root -RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 -RUN arch="$(dpkg --print-architecture)" \ - && set -x \ - && curl -o /usr/local/bin/gosu -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch" \ - && curl -o /usr/local/bin/gosu.asc -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch.asc" \ - && gpg --verify /usr/local/bin/gosu.asc \ - && rm /usr/local/bin/gosu.asc \ - && chmod +x /usr/local/bin/gosu +ENV GOSU_VERSION 1.7 +RUN set -x \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true # https://www.elastic.co/guide/en/logstash/2.0/package-repositories.html # https://packages.elasticsearch.org/GPG-KEY-elasticsearch diff --git a/Dockerfile.template b/Dockerfile.template index f61f984db..6a367227b 100644 --- a/Dockerfile.template +++ b/Dockerfile.template @@ -10,14 +10,16 @@ RUN mkdir -p /usr/local/lib \ && ln -s /usr/lib/*/libzmq.so.3 /usr/local/lib/libzmq.so # grab gosu for easy step-down from root -RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 -RUN arch="$(dpkg --print-architecture)" \ - && set -x \ - && curl -o /usr/local/bin/gosu -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch" \ - && curl -o /usr/local/bin/gosu.asc -fSL "https://github.com/tianon/gosu/releases/download/1.3/gosu-$arch.asc" \ - && gpg --verify /usr/local/bin/gosu.asc \ - && rm /usr/local/bin/gosu.asc \ - && chmod +x /usr/local/bin/gosu +ENV GOSU_VERSION 1.7 +RUN set -x \ + && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \ + && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \ + && export GNUPGHOME="$(mktemp -d)" \ + && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \ + && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \ + && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \ + && chmod +x /usr/local/bin/gosu \ + && gosu nobody true # https://www.elastic.co/guide/en/logstash/2.0/package-repositories.html # https://packages.elasticsearch.org/GPG-KEY-elasticsearch