Security patches 20251017

.github/workflows/docker-image.yml

@@ -7,7 +7,7 @@ on:
       - workflowhub
       - rails-7-hacking-rebased
       - full-test-suite
-      - seek-1.16
+      - seek-1.17
 
   pull_request:
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.3-slim-bullseye
+FROM ruby:3.3-slim-trixie
 
 LABEL maintainer="Stuart Owen <orcid.org/0000-0003-2130-0865>, Finn Bacall"
 ARG SOURCE_COMMIT
@@ -10,11 +10,11 @@ ENV LANG="en_US.UTF-8" LANGUAGE="en_US:UTF-8" LC_ALL="C.UTF-8"
 
 RUN apt-get update -qq && \
     apt-get install -y --no-install-recommends build-essential cmake curl default-mysql-client gettext graphviz git \
-		libcurl4-gnutls-dev libmagick++-dev libmariadb-dev libpq-dev libreadline-dev \
-		libreoffice libsqlite3-dev libssl-dev libxml++2.6-dev \
-		libxslt1-dev libyaml-dev locales nginx nodejs openjdk-11-jdk-headless \
-		python3.9-dev python3.9-distutils python3-pip \
-		poppler-utils postgresql-client shared-mime-info sqlite3 links telnet vim-tiny zip && \
+    libcurl4-gnutls-dev libmagick++-dev libmariadb-dev libpq-dev libreadline-dev \
+    libreoffice libsqlite3-dev libssl-dev libxml++2.6-dev \
+    libxslt1-dev libyaml-dev locales nginx nodejs openjdk-21-jre openjdk-21-jdk-headless \
+    python3.13-dev python3-setuptools python3-pip python3.13-venv \
+    poppler-utils postgresql-client shared-mime-info sqlite3 links telnet vim-tiny zip && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     locale-gen en_US.UTF-8
@@ -41,14 +41,19 @@ COPY docker/virtuoso_settings.docker.yml config/virtuoso_settings.yml
 USER root
 RUN if [ -n "$SOURCE_COMMIT" ] ; then echo $SOURCE_COMMIT > config/.git-revision ; fi
 RUN chown -R www-data solr config docker public /var/www db/schema.rb
+
+# create and use a dedicated virtualenv
+RUN python3.13 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+RUN chown -R www-data /opt/venv
+
 USER www-data
 RUN touch config/using-docker #allows us to see within SEEK we are running in a container
 
 # Python dependencies from requirements.txt
-ENV PATH="/var/www/.local/bin:$PATH"
-RUN python3.9 -m pip install --upgrade pip
-RUN python3.9 -m pip install setuptools==58
-RUN python3.9 -m pip install -r requirements.txt
+RUN python3.13 -m pip install --upgrade pip
+RUN python3.13 -m pip install setuptools==58
+RUN python3.13 -m pip install -r requirements.txt
 
 # SQLite Database (for asset compilation)
 RUN mkdir sqlite3-db && \
@@ -69,10 +74,10 @@ ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.
     SUPERCRONIC_SHA1SUM=048b95b48b708983effb2e5c935a1ef8483d9e3e
 
 RUN curl -fsSLO "$SUPERCRONIC_URL" \
- && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
- && chmod +x "$SUPERCRONIC" \
- && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
- && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
+    && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
+    && chmod +x "$SUPERCRONIC" \
+    && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
+    && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
 
 # Cleanup and remove default nginx index page
 RUN rm -rf /tmp/* /var/tmp/* /usr/share/nginx/html/index.html

docker-compose.yml

@@ -1,5 +1,6 @@
 services:
-  db: # Database implementation, in this case MySQL
+  db:
+    # Database implementation, in this case MySQL
     image: mysql:8.0
     container_name: seek-mysql
     command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci --log-error-verbosity=1
@@ -9,8 +10,14 @@ services:
       - docker/db.env
     volumes:
       - seek-mysql-db:/var/lib/mysql
+    healthcheck:
+      test: [ "CMD", "mysqladmin", "ping", "-h", "localhost" ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
-  seek: # The SEEK application
+  seek:
+    # The SEEK application
     #build: .
 
     image: fairdom/seek:1.17
@@ -32,39 +39,45 @@ services:
     ports:
       - "3000:3000"
     depends_on:
-      - db
-      - solr
+      db:
+        condition: service_healthy
+      solr:
+        condition: service_healthy
     links:
       - db
       - solr
 
-  seek_workers: # The SEEK delayed job workers
-      #build: .
+  seek_workers:
+    # The SEEK delayed job workers
+    #build: .
 
-      image: fairdom/seek:1.17
-      container_name: seek-workers
-      command: docker/start_workers.sh
-      restart: always
-      environment:
-        RAILS_ENV: production
-        SOLR_PORT: 8983
-        SOLR_HOST: solr
-        RAILS_LOG_LEVEL: info # debug, info, warn, error or fatal
-        QUIET_SUPERCRONIC: 1 # remove to show supercronic activity logs
-      env_file:
-        - docker/db.env
-      volumes:
-        - seek-filestore:/seek/filestore
-        - seek-cache:/seek/tmp/cache
-      depends_on:
-        - db
-        - solr
-      links:
-        - db
-        - solr
+    image: fairdom/seek:1.17
+    container_name: seek-workers
+    command: docker/start_workers.sh
+    restart: always
+    environment:
+      RAILS_ENV: production
+      SOLR_PORT: 8983
+      SOLR_HOST: solr
+      RAILS_LOG_LEVEL: info # debug, info, warn, error or fatal
+      QUIET_SUPERCRONIC: 1 # remove to show supercronic activity logs
+    env_file:
+      - docker/db.env
+    volumes:
+      - seek-filestore:/seek/filestore
+      - seek-cache:/seek/tmp/cache
+    depends_on:
+      db:
+        condition: service_healthy
+      solr:
+        condition: service_healthy
+    links:
+      - db
+      - solr
 
   solr:
     image: fairdom/seek-solr:8.11
+    shm_size: 1gb
     container_name: seek-solr
     restart: always
     environment:
@@ -75,8 +88,7 @@ services:
       - docker-entrypoint.sh
       - solr-precreate
       - seek
-      - /opt/solr/server/solr/configsets/seek_config      
-
+      - /opt/solr/server/solr/configsets/seek_config
 
 volumes:
   seek-filestore:

requirements.txt

@@ -1,8 +1,8 @@
 psutil==5.9.3
-cwltool==3.1.20230601100705
+cwltool==3.1.20230906142556
 html5lib==1.0.1
 galaxy2cwl==0.1.4
 #isatools==0.11.0
 gxformat2==0.15.0
-nbconvert==7.4.0
-ipython==8.10.0
+nbconvert==7.16.6
+ipython==8.18.1

script/check_deployment.rb

@@ -1,4 +1,4 @@
-output = `curl --verbose --silent http://localhost:3000/statistics/application_status 2>&1`
+output = `curl -4 --verbose --silent http://localhost:3000/statistics/application_status 2>&1`
 if $?.success? && output.include?('FAIRDOM-SEEK is running | search is enabled | 7 delayed jobs running')
   exit 0
 else