Skip to content

Commit

Permalink
Update debian build stages to use gpg over sq (#5664)
Browse files Browse the repository at this point in the history
  • Loading branch information
shaun-nx authored May 30, 2024
1 parent 978fd40 commit 905bf4d
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions build/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -165,13 +165,13 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
--mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \
--mount=type=bind,from=nginx-files,src=debian-plus-12.sources,target=/etc/apt/sources.list.d/nginx-plus.sources \
apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y sq ca-certificates libcap2-bin libcurl4 \
&& apt-get install --no-install-recommends --no-install-suggests -y gpg ca-certificates libcap2-bin libcurl4 \
&& groupadd --system --gid 101 nginx \
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
&& sq dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg /tmp/nginx_signing.key \
&& gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg /tmp/nginx_signing.key \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check \
&& apt-get purge --auto-remove -y sq \
&& apt-get purge --auto-remove -y gpg \
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
&& ldconfig \
&& rm -rf /var/lib/apt/lists/*
Expand Down Expand Up @@ -199,11 +199,11 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
cp /tmp/app-protect-dos.sources /etc/apt/sources.list.d/app-protect-dos.sources; \
fi \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates sq \
&& apt-get install --no-install-recommends --no-install-suggests -y ca-certificates gpg \
&& groupadd --system --gid 101 nginx \
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
&& sq dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg /tmp/nginx_signing.key \
&& sq dearmor -o /usr/share/keyrings/app-protect-archive-keyring.gpg /tmp/app-protect-security-updates.key \
&& gpg --dearmor -o /usr/share/keyrings/nginx-archive-keyring.gpg /tmp/nginx_signing.key \
&& gpg --dearmor -o /usr/share/keyrings/app-protect-archive-keyring.gpg /tmp/app-protect-security-updates.key \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check libcap2-bin libcurl4 \
## end of duplicated code
Expand All @@ -214,7 +214,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
&& if [ -z "${NAP_MODULES##*dos*}" ]; then \
apt-get install --no-install-recommends --no-install-suggests -y app-protect-dos; \
fi \
&& apt-get purge --auto-remove -y sq \
&& apt-get purge --auto-remove -y gpg \
## the code below is duplicated from the debian-plus image because NAP doesn't support debian 12
&& cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \
&& ldconfig \
Expand Down

0 comments on commit 905bf4d

Please sign in to comment.