| ARG RELEASE |
| ARG LAUNCHPAD_BUILD_ARCH |
| LABEL org.opencontainers.image.version=24.04 |
| ADD file:7121eb4a5ba391efb4ba9a38c532d1c5dc2d22d276f04e062f357eea36ee62c4 in / |
| CMD ["/bin/bash"] |
| ENV DEBIAN_FRONTEND=noninteractive |
| SHELL [/bin/bash -o pipefail -c] |
| RUN /bin/bash -o pipefail -c apt-get update -qq && apt-get upgrade -y -qq && apt-get install -y -qq --no-install-recommends python3.12 python3-pip python3.12-venv curl gnupg ca-certificates git postgresql-client jq && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && apt-get install -y -qq --no-install-recommends nodejs && rm -rf /usr/lib/node_modules/npm /usr/bin/npm /usr/bin/npx && update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.12 1 && ln -sf /usr/bin/python3 /usr/bin/python && apt-get clean && rm -rf /var/lib/apt/lists/* # buildkit |
| RUN /bin/bash -o pipefail -c pip install --no-cache-dir --break-system-packages psycopg2-binary pyyaml pytest # buildkit |
| RUN /bin/bash -o pipefail -c pip install --no-cache-dir --break-system-packages "setuptools<81" "migra[pg]" psycopg2-binary "psycopg[binary]" # buildkit |
| RUN /bin/bash -o pipefail -c apt-get update -qq && apt-get install -y -qq --no-install-recommends shellcheck && apt-get clean && rm -rf /var/lib/apt/lists/* # buildkit |
| ARG HADOLINT_VERSION=v2.14.0 |
| RUN |1 HADOLINT_VERSION=v2.14.0 /bin/bash -o pipefail -c set -eu; arch="$(dpkg --print-architecture)"; case "$arch" in amd64) hl_arch=x86_64 ;; arm64) hl_arch=arm64 ;; *) echo "unsupported arch: $arch" >&2; exit 1 ;; esac; curl -fsSL -o /usr/local/bin/hadolint "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/hadolint-linux-${hl_arch}"; chmod +x /usr/local/bin/hadolint; hadolint --version # buildkit |
| ARG GITLEAKS_VERSION=v8.30.1 |
| RUN |2 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 /bin/bash -o pipefail -c set -eu; arch="$(dpkg --print-architecture)"; case "$arch" in amd64) gl_arch=x64 ;; arm64) gl_arch=arm64 ;; *) echo "unsupported arch: $arch" >&2; exit 1 ;; esac; curl -fsSL -o /tmp/gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_${gl_arch}.tar.gz"; tar -xzf /tmp/gitleaks.tar.gz -C /usr/local/bin gitleaks; rm /tmp/gitleaks.tar.gz; gitleaks version # buildkit |
| ARG SQUAWK_VERSION=v2.52.1 |
| RUN |3 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 SQUAWK_VERSION=v2.52.1 /bin/bash -o pipefail -c set -eu; arch="$(dpkg --print-architecture)"; case "$arch" in amd64) sq_arch=x64 ;; arm64) sq_arch=arm64 ;; *) echo "unsupported arch: $arch" >&2; exit 1 ;; esac; curl -fsSL -o /usr/local/bin/squawk "https://github.com/sbdchd/squawk/releases/download/${SQUAWK_VERSION}/squawk-linux-${sq_arch}"; chmod +x /usr/local/bin/squawk; squawk --version # buildkit |
| ARG TRIVY_VERSION=v0.75.0 |
| RUN |4 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 SQUAWK_VERSION=v2.52.1 TRIVY_VERSION=v0.75.0 /bin/bash -o pipefail -c set -eu; arch="$(dpkg --print-architecture)"; case "$arch" in amd64) tv_arch=64bit ;; arm64) tv_arch=ARM64 ;; *) echo "unsupported arch: $arch" >&2; exit 1 ;; esac; curl -fsSL -o /tmp/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/trivy_${TRIVY_VERSION#v}_Linux-${tv_arch}.tar.gz"; tar -xzf /tmp/trivy.tar.gz -C /usr/local/bin trivy; rm /tmp/trivy.tar.gz; trivy --version # buildkit |
| RUN |4 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 SQUAWK_VERSION=v2.52.1 TRIVY_VERSION=v0.75.0 /bin/bash -o pipefail -c pip install --no-cache-dir --break-system-packages bandit pip-audit # buildkit |
| ARG COSIGN_VERSION=v2.6.5 |
| RUN |5 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 SQUAWK_VERSION=v2.52.1 TRIVY_VERSION=v0.75.0 COSIGN_VERSION=v2.6.5 /bin/bash -o pipefail -c set -eu; arch="$(dpkg --print-architecture)"; case "$arch" in amd64) cosign_arch=amd64 ;; arm64) cosign_arch=arm64 ;; *) echo "unsupported arch: $arch" >&2; exit 1 ;; esac; curl -fsSL -o /usr/local/bin/cosign "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${cosign_arch}"; chmod +x /usr/local/bin/cosign; cosign version # buildkit |
| ARG RITUAL_RELEASE=latest (main@d5748cbe) ritual-linux-amd64-musl |
| LABEL org.toilville.ritual.release=latest (main@d5748cbe) ritual-linux-amd64-musl |
| COPY ritual /usr/local/bin/ritual # buildkit |
| RUN |6 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 SQUAWK_VERSION=v2.52.1 TRIVY_VERSION=v0.75.0 COSIGN_VERSION=v2.6.5 RITUAL_RELEASE=latest (main@d5748cbe) ritual-linux-amd64-musl /bin/bash -o pipefail -c chmod +x /usr/local/bin/ritual # buildkit |
| RUN |6 HADOLINT_VERSION=v2.14.0 GITLEAKS_VERSION=v8.30.1 SQUAWK_VERSION=v2.52.1 TRIVY_VERSION=v0.75.0 COSIGN_VERSION=v2.6.5 RITUAL_RELEASE=latest (main@d5748cbe) ritual-linux-amd64-musl /bin/bash -o pipefail -c node --version && python3 --version && psql --version && cosign version && ritual --version && shellcheck --version && hadolint --version && gitleaks version && squawk --version && trivy --version && bandit --version && pip-audit --version && jq --version && migra --help >/dev/null && for t in npm npx; do if command -v "$t" >/dev/null 2>&1; then echo "ERROR: $t is present. It is removed on purpose in the Node.js layer above" >&2; echo " (see the comment there); its bundled dependency tree is a standing" >&2; echo " source of HIGH findings and nothing on this image uses it. A nodejs" >&2; echo " package change has reintroduced it — extend the rm, do not suppress." >&2; exit 1; fi; done # buildkit |
