Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

apache/incubator-kie-issues#1594: Security fixes for blank-app container #2716

Merged
merged 4 commits into from
Oct 30, 2024
Merged

apache/incubator-kie-issues#1594: Security fixes for blank-app container #2716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a59bd04
.
tiagobento Oct 29, 2024
bc2be1d
KIE-ISSUES#1594: bumping protobuf (fix CVE)
porcelli Oct 30, 2024
fa44334
KIE-ISSUES#1594: adding repo info + comments
porcelli Oct 30, 2024
890e98e
ops
porcelli Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions packages/dev-deployment-kogito-quarkus-blank-app-image/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ COPY --chown=$USER_ID:$USER_ID dist-dev/quarkus-app $HOME_PATH/app/
COPY --chown=$USER_ID:$USER_ID dist-dev/settings.xml /tmp/kogito/.m2/settings.xml

# Pre-populate local Maven repository for faster startup
RUN ./mvnw clean package -B -nsu --settings /tmp/kogito/.m2/settings.xml -Dmaven.test.skip -Dmaven.repo.local=/tmp/kogito/.m2/repository -Dquarkus.http.non-application-root-path=${ROOT_PATH}/q -Dquarkus.http.root-path=${ROOT_PATH} \
RUN ./mvnw -Dmaven=3.9.6 clean package -B -nsu --settings /tmp/kogito/.m2/settings.xml -Dmaven.test.skip -Dmaven.repo.local=/tmp/kogito/.m2/repository -Dquarkus.http.non-application-root-path=${ROOT_PATH}/q -Dquarkus.http.root-path=${ROOT_PATH} \
&& chgrp -R 0 $HOME_PATH/app && chmod -R g=u $HOME_PATH/app && chgrp -R 0 /tmp/kogito && chmod -R g=u /tmp/kogito && chgrp -R 0 /.m2 && chmod -R g=u /.m2

USER $USER_ID
Expand All @@ -39,4 +39,4 @@ EXPOSE 8080

ENTRYPOINT ["/bin/bash", "-c"]

CMD ["dev-deployment-upload-service && cp -r $HOME_PATH/app/. /tmp/app && cd /tmp/app && ./mvnw quarkus:dev -o -s=/tmp/kogito/.m2/settings.xml -Dquarkus.analytics.disabled=true -Ddebug=false -Dmaven.repo.local=/tmp/kogito/.m2/repository -Dquarkus.http.non-application-root-path=${ROOT_PATH}/q -Dquarkus.http.root-path=${ROOT_PATH}"]
CMD ["dev-deployment-upload-service && cp -r $HOME_PATH/app/. /tmp/app && cd /tmp/app && ./mvnw -Dmaven=3.9.6 quarkus:dev -o -s=/tmp/kogito/.m2/settings.xml -Dquarkus.analytics.disabled=true -Ddebug=false -Dmaven.repo.local=/tmp/kogito/.m2/repository -Dquarkus.http.non-application-root-path=${ROOT_PATH}/q -Dquarkus.http.root-path=${ROOT_PATH}"]
90 changes: 63 additions & 27 deletions packages/dev-deployment-kogito-quarkus-blank-app/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,8 @@
<!-- Purposefully not declaring maven-base as parent -->
<!-- As this app aims to work as any consumer app would. -->

<parent>
<groupId>org.apache</groupId>
<artifactId>apache</artifactId>
<version>32</version>
</parent>
<!-- Purposefully not declaring `apache` as parent -->
<!-- As this app is not meant to be published and consumed as a library -->

<modelVersion>4.0.0</modelVersion>
<groupId>org.kie.kogito</groupId>
Expand All @@ -47,15 +44,14 @@
<!-- Maven versions -->
<version.maven.artifact.plugin>3.4.1</version.maven.artifact.plugin>
<version.maven.compiler.plugin>3.13.0</version.maven.compiler.plugin>
<version.maven.resources.plugin>3.2.0</version.maven.resources.plugin>
<version.maven.resources.plugin>3.3.1</version.maven.resources.plugin>
<version.maven.failsafe.plugin>3.0.0-M7</version.maven.failsafe.plugin>
<version.maven.surefire.plugin>3.5.0</version.maven.surefire.plugin>
<version.maven.install.plugin>3.1.3</version.maven.install.plugin>
<version.maven.deploy.plugin>3.1.2</version.maven.deploy.plugin>
<version.maven.site.plugin>3.12.1</version.maven.site.plugin>
<version.maven.dependency.plugin>3.6.1</version.maven.dependency.plugin>
<version.maven.jar.plugin>3.4.1</version.maven.jar.plugin>
<version.maven.remote.resources.plugin>3.2.0</version.maven.remote.resources.plugin>
<version.maven.clean.plugin>3.4.0</version.maven.clean.plugin>
<version.codehaus.flatten.plugin>1.6.0</version.codehaus.flatten.plugin>

Expand All @@ -67,6 +63,8 @@
<version.junit>4.13.2</version.junit>
<version.org.apache.commons.commons-compress>1.26.1</version.org.apache.commons.commons-compress>
<version.org.iq80.snappy>0.5</version.org.iq80.snappy>
<version.commons-io>2.16.1</version.commons-io>
<version.com.google.protobuf>3.25.5</version.com.google.protobuf>
</properties>

<dependencyManagement>
Expand Down Expand Up @@ -94,6 +92,18 @@
</dependencyManagement>

<dependencies>
<!-- This was added when the latest version of protobuf brought by Quarkus was 3.25.0 -->
<!-- To address CVE-2024-7254, affecting protobuf:3.25.0 -->
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
<version>${version.com.google.protobuf}</version>
</dependency>
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java-util</artifactId>
<version>${version.com.google.protobuf}</version>
</dependency>
Comment on lines +97 to +106
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add a comment here with a disclaimer that those dependencies are only here to force this application to use a newer version of these dependencies? This will help not having people thinking this is necessary for the app to function properly.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point, done!

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
Expand Down Expand Up @@ -214,7 +224,6 @@
<pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-site-plugin</artifactId>
<version>${version.maven.site.plugin}</version>
<dependencies>
Expand All @@ -231,24 +240,6 @@
</dependencies>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-remote-resources-plugin</artifactId>
<version>${version.maven.remote.resources.plugin}</version>
<dependencies>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>${version.org.apache.commons.commons-compress}</version>
</dependency>
<dependency>
<groupId>org.iq80.snappy</groupId>
<artifactId>snappy</artifactId>
<version>${version.org.iq80.snappy}</version>
</dependency>
</dependencies>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>${version.maven.jar.plugin}</version>
<dependencies>
Expand All @@ -260,7 +251,6 @@
</dependencies>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>${version.maven.surefire.plugin}</version>
<dependencies>
Expand All @@ -276,6 +266,32 @@
</dependency>
</dependencies>
</plugin>
<plugin>
<artifactId>maven-resources-plugin</artifactId>
<version>${version.maven.resources.plugin}</version>
<dependencies>
<dependency>
<!-- This was added when the latest version of maven-resources-plugin was 3.3.1 -->
<!-- To address CVE-2024-47554, affecting commons-io:commons-io:2.11 -->
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>${version.commons-io}</version>
</dependency>
</dependencies>
</plugin>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<version>${version.maven.compiler.plugin}</version>
<dependencies>
<dependency>
<!-- This was added when the latest version of maven-compiler-plugin was 3.13.0 -->
<!-- To address CVE-2024-47554, affecting commons-io:commons-io:2.11 -->
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>${version.commons-io}</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</pluginManagement>
<plugins>
Expand Down Expand Up @@ -336,4 +352,24 @@
</plugin>
</plugins>
</build>
<repositories>
<repository>
<id>apache.snapshots</id>
<name>Apache Snapshot Repository</name>
<url>https://repository.apache.org/snapshots</url>
<releases>
<enabled>false</enabled>
</releases>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>apache.snapshots</id>
<name>Apache Snapshot Repository</name>
<url>https://repository.apache.org/snapshots</url>
<releases>
<enabled>false</enabled>
</releases>
</pluginRepository>
</pluginRepositories>
</project>
Loading