Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update to support 9.3.0 without Cucumber vulnerabilities #163

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Update to support 9.3.0 without Cucumber vulnerabilities #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a7969eb
Update base image to use the latest version of Ubuntu.
coty Feb 21, 2024
971a7ff
Update font installation in setup script
coty Feb 21, 2024
73c3d48
Update Gradle version to 7.6.4 in setup script
coty Feb 21, 2024
2efaddf
Add Mozilla Firefox repository and install Firefox via setup script
coty Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM ubuntu:20.04
FROM ubuntu:latest

Check failure on line 1 in src/Dockerfile

View check run for this annotation

Wiz Cloud Security / Wiz IaC Scanner

Missing User Instruction 

Rule ID: c67d9fc8-4b03-4de0-a4a2-53ac67eddf6a
Severity: High
Resource: FROM={{ubuntu:latest}}
File Type: Dockerfile
Expected: The 'Dockerfile' should contain the 'USER' instruction
Found: The 'Dockerfile' does not contain any 'USER' instruction

A user should be specified in the dockerfile, otherwise the image will run as root

Check warning on line 1 in src/Dockerfile

View check run for this annotation

Wiz Cloud Security / Wiz IaC Scanner

Image Version Using 'latest' 

Rule ID: 751841fc-f624-419e-804b-c08e0f1b5a7c
Severity: Medium
Resource: FROM={{ubuntu:latest}}
File Type: Dockerfile
Expected: FROM ubuntu:latest:'version' where version should not be 'latest'
Found: FROM ubuntu:latest'

When building images, always tag them with useful tags which codify version information, intended destination (prod or test, for instance), stability, or other information that is useful when deploying the application in different environments. Do not rely on the automatically-created latest tag

Check notice on line 1 in src/Dockerfile

View check run for this annotation

Wiz Cloud Security / Wiz IaC Scanner

Healthcheck Instruction Missing 

Rule ID: 940e61e0-64c3-41c9-887d-e97ce8aca1ff
Severity: Low
Resource: FROM={{ubuntu:latest}}
File Type: Dockerfile
Expected: Dockerfile should contain instruction 'HEALTHCHECK'
Found: Dockerfile doesn't contain instruction 'HEALTHCHECK'

Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The team is using ubuntu 20.04 as base version. So can you rollback to 20.04 to avoid some side effect issue. The team will plan to support latest LTS version later

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was a mistake for me to switch to latest, but I also think it is a mistake for us to sit on 20.04 at this point. How long do you think before we upgrade to the current LTS?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coty thanks for your reminding

https://wiki.ubuntu.com/Releases
Ubuntu 20.04 LTS - End of Standard Support: [April 2025]
We should upgrade to Ubuntu 22.04.4 LTS - End of Standard Support: [June 2027]

cc @anvantran @trinh-h


# common environment variables
ARG KATALON_ROOT_DIR=/katalon
Expand Down
13 changes: 11 additions & 2 deletions src/scripts/setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,18 @@ apt -y install fonts-liberation
apt -y install fonts-ipafont-gothic
apt -y install fonts-wqy-zenhei
apt -y install fonts-tlwg-loma-otf
apt -y install ttf-ubuntu-font-family
apt -y install fonts-ubuntu

echo "Install Mozilla Firefox"
install -d -m 0755 /etc/apt/keyrings
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain these code? without it, the docker still download correct Firefox version

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updates Firefox installation to install Firefox rather than just a Span pointer

This might only be relevant with later Ubuntu versions, but in those later versions, apt no longer actually installs Firefox. The change is described here:

https://askubuntu.com/questions/1399383/how-to-install-firefox-as-a-traditional-deb-package-without-snap-in-ubuntu-22

wget -q https://packages.mozilla.org/apt/repo-signing-key.gpg -O- | tee /etc/apt/keyrings/packages.mozilla.org.asc > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" | tee -a /etc/apt/sources.list.d/mozilla.list > /dev/null
echo '
Package: *
Pin: origin packages.mozilla.org
Pin-Priority: 1000
' | tee /etc/apt/preferences.d/mozilla
apt update
apt -y install firefox
# Install 'pulseaudio' package to support WebRTC audio streams
apt -y install pulseaudio
Expand All @@ -64,7 +73,7 @@ echo "$(microsoft-edge --version)" >> $KATALON_VERSION_FILE || true
./wrap_edge_chromium_binary.sh && rm -rfv ./wrap_edge_chromium_binary.sh

echo "Install Gradle"
gradle_version='5.4.1'
gradle_version='7.6.4'
gradle_package="gradle-$gradle_version-bin.zip"
gradle_unzipped_package="gradle-$gradle_version"
wget https://downloads.gradle.org/distributions/gradle-$gradle_version-bin.zip
Expand Down