Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove vulnerable packages in net8.0 webassembly image #1291

Merged
merged 1 commit into from
Dec 9, 2024
Merged

Remove vulnerable packages in net8.0 webassembly image #1291

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions src/azurelinux/3.0/net8.0/webassembly/amd64/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@ RUN tdnf update -y \
npm \
python3 \
libxml2 \
unzip
unzip \
# dependency for npm package modification
jq

# WebAssembly build needs typescript
RUN npm i -g typescript
Expand All @@ -18,15 +20,30 @@ RUN npm i -g typescript
ENV EMSCRIPTEN_VERSION=3.1.34
ENV EMSCRIPTEN_PATH=/usr/local/emscripten
ENV EMSDK_PATH=/usr/local/emscripten/emsdk
ENV NODE_VERSION_IN_EMSDK=15.14.0_64bit

RUN mkdir ${EMSCRIPTEN_PATH} \
&& cd ${EMSCRIPTEN_PATH} \
&& git clone https://github.com/emscripten-core/emsdk.git ${EMSDK_PATH} \
&& cd ${EMSDK_PATH} \
&& git checkout ${EMSCRIPTEN_VERSION} \
# patch node version in emsdk_manifest.json
&& sed -i 's/14\.18\.2/15\.14\.0/g' emsdk_manifest.json \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this be generalized so it doesn't need to maintained as versions get updated?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you mean in a variable? we can't just pick any node version since it needs to be one that emsdk shipped.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean use a regex to match on the existing version (not a hardcoded version but one that has a simple version pattern) defined in the JSON file and replace it with the new value, referencing an ENV value that could be defined.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why that'd be necessary given that emsdk 3.1.34 will always ship with node 14.18.2 and as mentioned in #1281 we can't upgrade the emsdk version.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or do you mean the replacement version?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm referring to both versions so that neither have to be hardcoded on this line.

emsdk 3.1.34 will always ship with node 14.18.2

So when the emsdk version is updated, that requires knowing what the node version is and having to update this line with that value. My aim here is to reduce the amount of work needed to rev the versions.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So when the emsdk version is updated, that requires knowing what the node version is and having to update this line with that value.

No, what I'm saying is the emsdk version is frozen for net8, we can't update it. And this logic is gone in net9+

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, got it. Thanks

&& ./emsdk install ${EMSCRIPTEN_VERSION}-upstream \
&& ./emsdk activate ${EMSCRIPTEN_VERSION}-upstream \
&& chmod -R 777 ${EMSCRIPTEN_PATH}
&& chmod -R 777 ${EMSCRIPTEN_PATH} \
# update packages to non-vulnerable versions
&& export PATH=$PATH:${EMSDK_PATH}/node/${NODE_VERSION_IN_EMSDK}/bin \
&& cd ${EMSDK_PATH}/node/${NODE_VERSION_IN_EMSDK}/lib \
&& npm install npm@latest \
&& npm prune --production \
&& cd ${EMSDK_PATH}/upstream/emscripten \
&& jq 'del(.devDependencies)' package.json > package.json.tmp && mv package.json.tmp package.json \
&& npm audit fix \
&& npm prune --production \
&& rm -rf ${EMSDK_PATH}/upstream/emscripten/node_modules/google-closure-compiler \
&& rm -rf ${EMSDK_PATH}/upstream/emscripten/node_modules/google-closure-compiler-java \
&& rm -rf ${EMSDK_PATH}/upstream/emscripten/node_modules/google-closure-compiler-linux

# Install V8 Engine
SHELL ["/bin/bash", "-c"]
Expand Down
Loading