-
Notifications
You must be signed in to change notification settings - Fork 219
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Use hardening for building all tools & libraries This does not affect the wheels that are produced by end users as proposed in #59 but mitigates potential security issues in the tools used by manylinux images as mentioned in #1005 * Always update system packages in the final step Since docker cache is used, system packages are not updated when cache is present. Always update them in the final step.
- Loading branch information
Showing
11 changed files
with
140 additions
and
64 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| #!/bin/bash | ||
| # Update system packages | ||
|
|
||
| # Stop at any error, show all commands | ||
| set -exuo pipefail | ||
|
|
||
|
|
||
| fixup-mirrors | ||
| if [ "${AUDITWHEEL_POLICY}" == "manylinux2010" ] || [ "${AUDITWHEEL_POLICY}" == "manylinux2014" ]; then | ||
| yum -y update | ||
| if ! localedef -V &> /dev/null; then | ||
| # somebody messed up glibc-common package to squeeze image size, reinstall the package | ||
| fixup-mirrors | ||
| yum -y reinstall glibc-common | ||
| fi | ||
| yum clean all | ||
| rm -rf /var/cache/yum | ||
| elif [ "${AUDITWHEEL_POLICY}" == "manylinux_2_24" ]; then | ||
| export DEBIAN_FRONTEND=noninteractive | ||
| apt-get update -qq | ||
| apt-get upgrade -qq -y | ||
| apt-get clean -qq | ||
| rm -rf /var/lib/apt/lists/* | ||
| else | ||
| echo "Unsupported policy: '${AUDITWHEEL_POLICY}'" | ||
| exit 1 | ||
| fi | ||
| fixup-mirrors | ||
|
|
||
| # do we want to update locales ? | ||
| LOCALE_ARCHIVE=/usr/lib/locale/locale-archive | ||
| TIMESTAMP_FILE=${LOCALE_ARCHIVE}.ml.timestamp | ||
| if [ ! -f ${TIMESTAMP_FILE} ] || [ ${LOCALE_ARCHIVE} -nt ${TIMESTAMP_FILE} ]; then | ||
| # upgrading glibc-common can end with removal on en_US.UTF-8 locale | ||
| localedef -i en_US -f UTF-8 en_US.UTF-8 | ||
|
|
||
| # if we updated glibc, we need to strip locales again... | ||
| if localedef --list-archive | grep -sq -v -i ^en_US.utf8; then | ||
| localedef --list-archive | grep -v -i ^en_US.utf8 | xargs localedef --delete-from-archive | ||
| fi | ||
| if [ "${AUDITWHEEL_POLICY}" == "manylinux2014" ] || [ "${AUDITWHEEL_POLICY}" == "manylinux2010" ]; then | ||
| mv -f ${LOCALE_ARCHIVE} ${LOCALE_ARCHIVE}.tmpl | ||
| build-locale-archive --install-langs="en_US.utf8" | ||
| elif [ "${AUDITWHEEL_POLICY}" == "manylinux_2_24" ]; then | ||
| rm ${LOCALE_ARCHIVE} | ||
| localedef -i en_US -f UTF-8 en_US.UTF-8 | ||
| update-locale LANG=en_US.UTF-8 | ||
| fi | ||
| touch ${TIMESTAMP_FILE} | ||
| fi | ||
|
|
||
| if [ -d /usr/share/locale ]; then | ||
| find /usr/share/locale -mindepth 1 -maxdepth 1 -not \( -name 'en*' -or -name 'locale.alias' \) | xargs rm -rf | ||
| fi | ||
| if [ -d /usr/local/share/locale ]; then | ||
| find /usr/local/share/locale -mindepth 1 -maxdepth 1 -not \( -name 'en*' -or -name 'locale.alias' \) | xargs rm -rf | ||
| fi | ||
|
|
||
| # Fix libc headers to remain compatible with C99 compilers. | ||
| find /usr/include/ -type f -exec sed -i 's/\bextern _*inline_*\b/extern __inline __attribute__ ((__gnu_inline__))/g' {} + | ||
|
|
||
| if [ "${DEVTOOLSET_ROOTPATH:-}" != "" ]; then | ||
| # remove useless things that have been installed/updated by devtoolset | ||
| if [ -d $DEVTOOLSET_ROOTPATH/usr/share/man ]; then | ||
| rm -rf $DEVTOOLSET_ROOTPATH/usr/share/man | ||
| fi | ||
| if [ -d $DEVTOOLSET_ROOTPATH/usr/share/locale ]; then | ||
| find $DEVTOOLSET_ROOTPATH/usr/share/locale -mindepth 1 -maxdepth 1 -not \( -name 'en*' -or -name 'locale.alias' \) | xargs rm -rf | ||
| fi | ||
| fi | ||
|
|
||
| if [ -d /usr/share/backgrounds ]; then | ||
| rm -rf /usr/share/backgrounds | ||
| fi | ||
|
|
||
| if [ -d /usr/local/share/man ]; then | ||
| rm -rf /usr/local/share/man | ||
| fi |