Skip to content

Commit

Permalink
Fix "gpg" usage to stop relying on deprecated and insecure behavior
Browse files Browse the repository at this point in the history
  • Loading branch information
@tianon
tianon committed Feb 29, 2016
1 parent 17f2bb9 commit 343ac9c
Show file tree
Hide file tree
Showing 12 changed files with 63 additions and 51 deletions.
11 changes: 6 additions & 5 deletions 2.7/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,15 @@ ENV PYTHON_VERSION 2.7.11
ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
11 changes: 6 additions & 5 deletions 2.7/alpine/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,16 @@ ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& apk add --no-cache --virtual .fetch-deps curl gnupg \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src \
&& tar -xJC /usr/src -f python.tar.xz \
&& mv "/usr/src/Python-$PYTHON_VERSION" /usr/src/python \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& apk add --no-cache --virtual .build-deps \
bzip2-dev \
Expand Down
11 changes: 6 additions & 5 deletions 2.7/slim/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,15 @@ RUN set -ex \
zlib1g-dev \
' \
&& apt-get update && apt-get install -y $buildDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
9 changes: 5 additions & 4 deletions 3.3/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,15 @@ ENV PYTHON_VERSION 3.3.6
ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
9 changes: 5 additions & 4 deletions 3.3/alpine/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,16 @@ ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& apk add --no-cache --virtual .fetch-deps curl gnupg \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src \
&& tar -xJC /usr/src -f python.tar.xz \
&& mv "/usr/src/Python-$PYTHON_VERSION" /usr/src/python \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& apk add --no-cache --virtual .build-deps \
bzip2-dev \
Expand Down
9 changes: 5 additions & 4 deletions 3.3/slim/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,15 @@ RUN set -ex \
zlib1g-dev \
' \
&& apt-get update && apt-get install -y $buildDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
9 changes: 5 additions & 4 deletions 3.4/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,15 @@ ENV PYTHON_VERSION 3.4.4
ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
9 changes: 5 additions & 4 deletions 3.4/alpine/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,16 @@ ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& apk add --no-cache --virtual .fetch-deps curl gnupg \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src \
&& tar -xJC /usr/src -f python.tar.xz \
&& mv "/usr/src/Python-$PYTHON_VERSION" /usr/src/python \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
&& apk del .fetch-deps \
\
&& apk add --no-cache --virtual .build-deps \
Expand Down
9 changes: 5 additions & 4 deletions 3.4/slim/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,15 @@ RUN set -ex \
zlib1g-dev \
' \
&& apt-get update && apt-get install -y $buildDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
9 changes: 5 additions & 4 deletions 3.5/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,15 @@ ENV PYTHON_VERSION 3.5.1
ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down
9 changes: 5 additions & 4 deletions 3.5/alpine/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,16 @@ ENV PYTHON_PIP_VERSION 8.0.3

RUN set -ex \
&& apk add --no-cache --virtual .fetch-deps curl gnupg \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src \
&& tar -xJC /usr/src -f python.tar.xz \
&& mv "/usr/src/Python-$PYTHON_VERSION" /usr/src/python \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
&& apk del .fetch-deps \
\
&& apk add --no-cache --virtual .build-deps \
Expand Down
9 changes: 5 additions & 4 deletions 3.5/slim/Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,15 @@ RUN set -ex \
zlib1g-dev \
' \
&& apt-get update && apt-get install -y $buildDeps --no-install-recommends && rm -rf /var/lib/apt/lists/* \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" -o python.tar.xz \
&& curl -fSL "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" -o python.tar.xz.asc \
&& gpg --verify python.tar.xz.asc \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
&& rm -r "$GNUPGHOME" python.tar.xz.asc \
&& mkdir -p /usr/src/python \
&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
&& rm python.tar.xz* \
&& rm -r ~/.gnupg \
&& rm python.tar.xz \
\
&& cd /usr/src/python \
&& ./configure --enable-shared --enable-unicode=ucs4 \
Expand Down

0 comments on commit 343ac9c

Please sign in to comment.