diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 13fb012a..0f74187d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,6 +34,9 @@ on:
jobs:
build:
+ env:
+ # renovate: datasource=docker depName=moby/buildkit
+ BUILDKIT_IMAGE: moby/buildkit:v0.31.0@sha256:a095b3d11ce1a9a05b6064ef515dfca0291ec5bcf2ea8178da8f6461924294e1
strategy:
matrix:
runner: [ubuntu-24.04, ubuntu-24.04-arm]
@@ -138,14 +141,14 @@ jobs:
done
}
- retry_with_backoff docker pull moby/buildkit:v0.31.0
+ retry_with_backoff docker pull "${BUILDKIT_IMAGE}"
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
with:
driver-opts: |
- image=moby/buildkit:v0.31.0
+ image=${{ env.BUILDKIT_IMAGE }}
network=host
- id: build
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ac1c93cc..2a494d60 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -1,9 +1,17 @@
name: Build and Push Docker Images
on:
push:
- branches: ["*"]
+ branches: ["**"]
paths:
+ - ".github/workflows/**"
+ - "ci/**"
+ - "cmd/**"
+ - "go.mod"
+ - "go.sum"
- "images/**"
+ - "internal/**"
+ - "docker-bake.hcl"
+ - "Makefile"
workflow_dispatch:
inputs:
image:
@@ -35,7 +43,9 @@ jobs:
- uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6
- name: lint
- run: shellcheck **/*.sh
+ run: |
+ mapfile -d '' scripts < <(git grep -Ilz -E '^#!.*(ba)?sh')
+ shellcheck "${scripts[@]}"
plan:
runs-on: ubuntu-24.04
@@ -63,6 +73,8 @@ jobs:
sitectl_isle_libops_image_tags: ${{ steps.plan.outputs.sitectl_isle_libops_image_tags }}
sitectl_isle_images: ${{ steps.plan.outputs.sitectl_isle_images }}
sitectl_create_smoke_matrix: ${{ steps.plan.outputs.sitectl_create_smoke_matrix }}
+ sitectl_repository: ${{ steps.plan.outputs.sitectl_repository }}
+ sitectl_ref: ${{ steps.plan.outputs.sitectl_ref }}
steps:
- uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6
with:
@@ -73,6 +85,9 @@ jobs:
with:
go-version-file: go.mod
+ - name: Test planner and repository contracts
+ run: go test -count=1 ./...
+
- id: plan
name: Plan
env:
@@ -124,6 +139,9 @@ jobs:
local create_args="$3"
local image_tags="$4"
local images="$5"
+ local local_plugin_repository="${6:-}"
+ local local_plugin_ref="${7:-main}"
+ local local_plugin_path="${8:-}"
if [ -z "${image_tags// }" ]; then
return
fi
@@ -134,16 +152,38 @@ jobs:
--arg create_args "$create_args" \
--arg image_tags "$image_tags" \
--arg images "$images" \
+ --arg local_plugin_repository "$local_plugin_repository" \
+ --arg local_plugin_ref "$local_plugin_ref" \
+ --arg local_plugin_path "$local_plugin_path" \
'. + [{
"plugin": $plugin,
"packages": $packages,
"create-args": $create_args,
"image-tags": $image_tags,
- "images": $images
+ "images": $images,
+ "local-plugin-repository": $local_plugin_repository,
+ "local-plugin-ref": $local_plugin_ref,
+ "local-plugin-path": $local_plugin_path
}]' <<<"$smoke_matrix"
)"
}
+ coordinated_template_args() {
+ local repository="$1"
+ local branch="${GITHUB_REF_NAME}"
+
+ if [ "${branch}" = "main" ]; then
+ return
+ fi
+ if [[ ! "${branch}" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+ echo "Skipping coordinated template branch with unsafe ref name: ${branch}" >&2
+ return
+ fi
+ if git ls-remote --exit-code --heads "${repository}" "refs/heads/${branch}" >/dev/null 2>&1; then
+ printf '%s' "--template-repo ${repository} --template-branch ${branch}"
+ fi
+ }
+
sitectl_wp_image_tags="$(planned_tag_assignment wp wp-php84)"
sitectl_omeka_s_image_tags="$(planned_tag_assignment omeka-s omeka-s-php84)"
sitectl_omeka_classic_image_tags="$(planned_tag_assignment omeka-classic omeka-classic-php84)"
@@ -151,14 +191,40 @@ jobs:
sitectl_drupal_image_tags="$(planned_tag_assignment drupal drupal-php84)"
sitectl_isle_libops_image_tags="$(planned_tag_assignment drupal islandora-php84)"
sitectl_isle_images=""
+ sitectl_wp_create_args="$(coordinated_template_args https://github.com/libops/wp)"
+ sitectl_omeka_s_create_args="$(coordinated_template_args https://github.com/libops/omeka-s)"
+ sitectl_omeka_classic_create_args="$(coordinated_template_args https://github.com/libops/omeka-classic)"
+ sitectl_ojs_create_args="$(coordinated_template_args https://github.com/libops/ojs)"
+ sitectl_drupal_create_args="$(coordinated_template_args https://github.com/libops/drupal)"
+ sitectl_isle_template_args="$(coordinated_template_args https://github.com/libops/isle)"
+ if [ -z "${sitectl_isle_template_args}" ]; then
+ sitectl_isle_template_args="--template-repo https://github.com/libops/isle"
+ fi
+ sitectl_isle_create_args="${sitectl_isle_template_args} --fcrepo off --blazegraph off --isle-file-system-uri private --iiif triplet --iiif-topology disabled --bot-mitigation off"
+ sitectl_repository=""
+ sitectl_ref="main"
+ if [ -n "$(coordinated_template_args https://github.com/libops/sitectl)" ]; then
+ sitectl_repository="libops/sitectl"
+ sitectl_ref="${GITHUB_REF_NAME}"
+ fi
+ sitectl_isle_packages="sitectl sitectl-isle sitectl-drupal"
+ sitectl_isle_plugin_repository=""
+ sitectl_isle_plugin_ref="main"
+ sitectl_isle_plugin_path=""
+ if [ -n "$(coordinated_template_args https://github.com/libops/sitectl-isle)" ]; then
+ sitectl_isle_packages="sitectl sitectl-drupal"
+ sitectl_isle_plugin_repository="libops/sitectl-isle"
+ sitectl_isle_plugin_ref="${GITHUB_REF_NAME}"
+ sitectl_isle_plugin_path="sitectl-isle-source"
+ fi
smoke_matrix='[]'
- add_smoke_row "wp" "sitectl sitectl-wp" "" "$sitectl_wp_image_tags" ""
- add_smoke_row "omeka-s" "sitectl sitectl-omeka-s" "" "$sitectl_omeka_s_image_tags" ""
- add_smoke_row "omeka-classic" "sitectl sitectl-omeka-classic" "" "$sitectl_omeka_classic_image_tags" ""
- add_smoke_row "ojs" "sitectl sitectl-ojs" "" "$sitectl_ojs_image_tags" ""
- add_smoke_row "drupal" "sitectl sitectl-drupal" "" "$sitectl_drupal_image_tags" ""
- add_smoke_row "isle" "sitectl sitectl-isle sitectl-drupal" "--template-repo https://github.com/libops/isle --fcrepo off --blazegraph off --isle-file-system-uri private --iiif triplet --iiif-topology disabled --bot-mitigation off" "$sitectl_isle_libops_image_tags" "$sitectl_isle_images"
+ add_smoke_row "wp" "sitectl sitectl-wp" "$sitectl_wp_create_args" "$sitectl_wp_image_tags" ""
+ add_smoke_row "omeka-s" "sitectl sitectl-omeka-s" "$sitectl_omeka_s_create_args" "$sitectl_omeka_s_image_tags" ""
+ add_smoke_row "omeka-classic" "sitectl sitectl-omeka-classic" "$sitectl_omeka_classic_create_args" "$sitectl_omeka_classic_image_tags" ""
+ add_smoke_row "ojs" "sitectl sitectl-ojs" "$sitectl_ojs_create_args" "$sitectl_ojs_image_tags" ""
+ add_smoke_row "drupal" "sitectl sitectl-drupal" "$sitectl_drupal_create_args" "$sitectl_drupal_image_tags" ""
+ add_smoke_row "isle" "$sitectl_isle_packages" "$sitectl_isle_create_args" "$sitectl_isle_libops_image_tags" "$sitectl_isle_images" "$sitectl_isle_plugin_repository" "$sitectl_isle_plugin_ref" "$sitectl_isle_plugin_path"
{
echo "sitectl_wp_image_tags=${sitectl_wp_image_tags}"
@@ -169,6 +235,8 @@ jobs:
echo "sitectl_isle_libops_image_tags=${sitectl_isle_libops_image_tags}"
echo "sitectl_isle_images=${sitectl_isle_images}"
echo "sitectl_create_smoke_matrix=${smoke_matrix}"
+ echo "sitectl_repository=${sitectl_repository}"
+ echo "sitectl_ref=${sitectl_ref}"
} >> "$GITHUB_OUTPUT"
- name: Summary
@@ -375,13 +443,13 @@ jobs:
sitectl-create-smoke-test:
if: ${{ always() && needs.plan.outputs.sitectl_create_smoke_matrix != '[]' && !cancelled() && !failure() }}
- needs: [plan, test-level-4]
+ needs: [plan, test-level-0, test-level-1, test-level-2, test-level-3, test-level-4]
strategy:
fail-fast: false
matrix:
include: ${{ fromJson(needs.plan.outputs.sitectl_create_smoke_matrix) }}
- uses: libops/.github/.github/workflows/sitectl-create-smoke-test.yaml@main
+ uses: libops/.github/.github/workflows/sitectl-create-smoke-test.yaml@e366f7422565ea5ee71c0c626b740e03f2e2ffcd # main
with:
plugin: ${{ matrix.plugin }}
create-definition: default
@@ -391,5 +459,10 @@ jobs:
image-tags: ${{ matrix.image-tags }}
images: ${{ matrix.images }}
packages: ${{ matrix.packages }}
+ local-plugin-repository: ${{ matrix.local-plugin-repository }}
+ local-plugin-ref: ${{ matrix.local-plugin-ref }}
+ local-plugin-path: ${{ matrix.local-plugin-path }}
+ sitectl-repository: ${{ needs.plan.outputs.sitectl_repository }}
+ sitectl-ref: ${{ needs.plan.outputs.sitectl_ref }}
permissions:
contents: read
diff --git a/Makefile b/Makefile
index 5e8b642a..535c0955 100644
--- a/Makefile
+++ b/Makefile
@@ -31,9 +31,12 @@ endef
# Used to include host-platform specific docker compose files.
OS := $(shell uname -s | tr A-Z a-z)
-# Used to determine set TAGS when no explicit value provided,
-# as well as to fetch branch specific remote caches when building.
-BRANCH = $(shell git rev-parse --abbrev-ref HEAD)
+# Used to set TAGS when no explicit value is provided and to fetch branch-specific
+# remote caches. Keep it aligned with the metadata helper's Docker-tag fallback
+# normalization so names such as feature/foo produce valid cache references.
+# Pipe the ref directly into the normalizer so branch text is never re-evaluated
+# as part of a generated shell command.
+BRANCH = $(shell git -c safe.directory='$(CURDIR)' rev-parse --abbrev-ref HEAD | sed -E 's/[^A-Za-z0-9_.-]+/-/g; s/^-+//; s/-+$$//')
# The buildkit builder to use.
BUILDER ?= default
@@ -121,7 +124,7 @@ docker-buildx: | docker
.SILENT: build/bake.json
build/bake.json: | docker-buildx jq build folder-permissions executable-permissons
set -x; \
- BRANCH=$(BRANCH) \
+ BRANCH="$(BRANCH)" \
CACHE_FROM_REPOSITORY=$(CACHE_FROM_REPOSITORY) \
CACHE_TO_REPOSITORY=$(CACHE_TO_REPOSITORY) \
REPOSITORY=$(REPOSITORY) \
diff --git a/README.md b/README.md
index 2321efa4..f92d9f57 100644
--- a/README.md
+++ b/README.md
@@ -32,9 +32,26 @@ Changes in this fork:
- Dropped fcrepo file persistence
- Added ArchivesSpace, OJS, Omeka, and Wordpress images.
- Moved Islandora buildkit's `drupal` image to `islandora` and made a drupal-only image
- - All of these images are intended to be infra scaffolding and app-specific codebase dropped into the container in local builds
+ - ArchivesSpace, OJS, Omeka S, and Omeka Classic include checksum-verified upstream application releases.
+ - Drupal and Wordpress remain infrastructure scaffolding for Composer-managed application code in downstream builds.
- Tags are based on software versions
- Multiple versions of the same software/image can coexist (e.g. java, solr, fcrepo, php, etc.)
- `base` environment variables (e.g. `DB_NAME`) are overriden instead of `IMAGE_NAME_*` env vars
- Removed Islandora multisite support
- Added optional Vault-backed secret bootstrap
+
+## OJS dataset initialization
+
+Fresh OJS installations defer the install-time ROR registry and IP geolocation
+downloads so that container initialization is bounded and does not require
+outbound network access. OJS's built-in scheduler remains enabled and updates
+the ROR registry monthly on the first day of the month and the IP database
+monthly on the tenth.
+
+To populate either dataset immediately after installation, run the corresponding
+OJS scheduler task from `/var/www/ojs` as the application user:
+
+```sh
+php lib/pkp/tools/scheduler.php test --name='PKP\task\UpdateRorRegistryDataset'
+php lib/pkp/tools/scheduler.php test --name='PKP\task\UpdateIPGeoDB'
+```
diff --git a/ci/tests/update-sha-readme.sh b/ci/tests/update-sha-readme.sh
new file mode 100755
index 00000000..953b8c3a
--- /dev/null
+++ b/ci/tests/update-sha-readme.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+root_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+work_dir=$(mktemp -d)
+trap 'rm -rf "${work_dir}"' EXIT
+
+# shellcheck disable=SC1090
+UPDATE_SHA_LIBRARY_ONLY=true source "${root_dir}/ci/update-sha.sh" test 1.2.3 2.0.0 ignored
+
+readme="${work_dir}/README.md"
+printf '%s\n' 'Docker image version 1.2.3.' >"${readme}"
+update_readme "${readme}" 1.2.3 2.0.0
+grep -qx 'Docker image version 2.0.0.' "${readme}"
+
+printf '%s\n' 'Docker image version 9.9.9.' >"${readme}"
+if update_readme "${readme}" 1.2.3 2.0.0; then
+ echo "Missing README source version unexpectedly succeeded" >&2
+ exit 1
+fi
+
+printf '%s\n' 'First 1.2.3.' 'Second 1.2.3.' >"${readme}"
+if update_readme "${readme}" 1.2.3 2.0.0; then
+ echo "Ambiguous README source version unexpectedly succeeded" >&2
+ exit 1
+fi
diff --git a/ci/update-sha.sh b/ci/update-sha.sh
index fd8a26f6..4e13299b 100755
--- a/ci/update-sha.sh
+++ b/ci/update-sha.sh
@@ -19,37 +19,124 @@ update_dockerfile_sha() {
local ARG="$2"
local DOCKERFILES=("${@:3}")
local SHA
- curl -fLs "$URL" -o curl.resp || echo "Request failed with exit code $?"
- SHA=$(shasum -a 256 curl.resp | awk '{print $1}')
+ local DOWNLOAD
+ local dockerfile
+ DOWNLOAD=$(mktemp)
+
+ if ! curl \
+ --fail \
+ --location \
+ --retry 3 \
+ --retry-all-errors \
+ --connect-timeout 20 \
+ --max-time 600 \
+ --silent \
+ --show-error \
+ --output "$DOWNLOAD" \
+ "$URL"; then
+ rm -f "$DOWNLOAD"
+ echo "Failed to download release artifact: $URL" >&2
+ return 1
+ fi
- if [[ "$OSTYPE" == "darwin"* ]]; then
- sed -i '' 's|^ARG '"$ARG"'=.*|ARG '"$ARG"'="'"$SHA"'"|g' "${DOCKERFILES[@]}"
- else
- sed -i 's|^ARG '"$ARG"'=.*|ARG '"$ARG"'="'"$SHA"'"|g' "${DOCKERFILES[@]}"
+ SHA=$(shasum -a 256 "$DOWNLOAD" | awk '{print $1}')
+ if [[ ! "$SHA" =~ ^[0-9a-f]{64}$ ]]; then
+ rm -f "$DOWNLOAD"
+ echo "Failed to calculate SHA256 for release artifact: $URL" >&2
+ return 1
fi
- rm curl.resp
+
+ for dockerfile in "${DOCKERFILES[@]}"; do
+ if [[ $(grep -Ec "^[[:space:]]*(ARG[[:space:]]+)?${ARG}=\"?[[:xdigit:]]{64}\"?" "${dockerfile}") -ne 1 ]]; then
+ rm -f "$DOWNLOAD"
+ echo "Expected exactly one existing ${ARG} checksum in ${dockerfile}" >&2
+ return 1
+ fi
+
+ if [[ "$OSTYPE" == "darwin"* ]]; then
+ sed -E -i '' "s|^([[:space:]]*(ARG[[:space:]]+)?${ARG}=)\"?[[:xdigit:]]{64}\"?(.*)$|\\1\"${SHA}\"\\3|" "${dockerfile}"
+ else
+ sed -E -i "s|^([[:space:]]*(ARG[[:space:]]+)?${ARG}=)\"?[[:xdigit:]]{64}\"?(.*)$|\\1\"${SHA}\"\\3|" "${dockerfile}"
+ fi
+
+ if ! grep -Eq "^[[:space:]]*(ARG[[:space:]]+)?${ARG}=\"${SHA}\"" "${dockerfile}"; then
+ rm -f "$DOWNLOAD"
+ echo "Failed to update ${ARG} in ${dockerfile}" >&2
+ return 1
+ fi
+ done
+ rm -f "$DOWNLOAD"
}
update_readme() {
local README="$1"
local OLD_VERSION="$2"
local NEW_VERSION="$3"
- # update the README to specify the new version
- if [ "$README" != "" ]; then
- if [[ "$OSTYPE" == "darwin"* ]]; then
- sed -i '' "s/${OLD_VERSION}\.$/${NEW_VERSION}\./" "$README"
- else
- sed -i "s/${OLD_VERSION}\.$/${NEW_VERSION}\./" "$README"
- fi
+ local match_count
+ local new_match_count
+ local replacement
+
+ if [ -z "$README" ]; then
+ return 0
+ fi
+ if [ ! -f "$README" ]; then
+ echo "Configured README does not exist: $README" >&2
+ return 1
+ fi
+
+ match_count=$(awk -v suffix="${OLD_VERSION}." '
+ length($0) >= length(suffix) && substr($0, length($0) - length(suffix) + 1) == suffix { count++ }
+ END { print count + 0 }
+ ' "$README")
+ if [ "$match_count" -ne 1 ]; then
+ echo "Expected exactly one README line ending in ${OLD_VERSION}. in ${README}; found ${match_count}" >&2
+ return 1
+ fi
+
+ replacement=$(mktemp)
+ if ! awk -v old_suffix="${OLD_VERSION}." -v new_suffix="${NEW_VERSION}." '
+ length($0) >= length(old_suffix) && substr($0, length($0) - length(old_suffix) + 1) == old_suffix {
+ print substr($0, 1, length($0) - length(old_suffix)) new_suffix
+ next
+ }
+ { print }
+ ' "$README" >"$replacement"; then
+ rm -f "$replacement"
+ echo "Failed to prepare README update for ${README}" >&2
+ return 1
+ fi
+ if cmp -s "$README" "$replacement"; then
+ rm -f "$replacement"
+ echo "README replacement did not change ${README}" >&2
+ return 1
+ fi
+ command cat "$replacement" >"$README"
+ rm -f "$replacement"
+
+ new_match_count=$(awk -v suffix="${NEW_VERSION}." '
+ length($0) >= length(suffix) && substr($0, length($0) - length(suffix) + 1) == suffix { count++ }
+ END { print count + 0 }
+ ' "$README")
+ if [ "$new_match_count" -ne 1 ]; then
+ echo "Failed to verify README version ${NEW_VERSION} in ${README}" >&2
+ return 1
fi
}
+if [ "${UPDATE_SHA_LIBRARY_ONLY:-false}" = "true" ]; then
+ if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+ exit 0
+ fi
+ return 0
+fi
+
echo "Updating SHA for $DEP@$NEW_VERSION"
if [ "$DEP" = "alpaca" ] ; then
URL="https://github.com/islandora/alpaca/archive/refs/tags/${NEW_VERSION}.tar.gz"
ARG=ALPACA_SHA256
DOCKERFILES=("images/alpaca/Dockerfile")
+ README="images/alpaca/README.md"
elif [ "$DEP" = "apache-tomcat9" ]; then
URL="https://downloads.apache.org/tomcat/tomcat-9/v$NEW_VERSION/bin/apache-tomcat-$NEW_VERSION.tar.gz"
@@ -109,10 +196,19 @@ elif [ "$DEP" = "fcrepo7" ]; then
DOCKERFILES=("images/fcrepo7/Dockerfile")
README="images/fcrepo7/README.md"
-elif [ "$DEP" = "islandora-syn" ]; then
+elif [ "$DEP" = "islandora-syn-fcrepo6" ]; then
URL="https://github.com/Islandora/Syn/releases/download/v${NEW_VERSION}/islandora-syn-${NEW_VERSION}-all.jar"
ARG="SYN_SHA256"
- DOCKERFILES=("images/fcrepo6/Dockerfile" "images/fcrepo7/Dockerfile")
+ DOCKERFILES=("images/fcrepo6/Dockerfile")
+
+elif [ "$DEP" = "islandora-syn-fcrepo7" ]; then
+ URL="https://github.com/Islandora/Syn/releases/download/v${NEW_VERSION}/islandora-syn-${NEW_VERSION}-all.jar"
+ ARG="SYN_SHA256"
+ DOCKERFILES=("images/fcrepo7/Dockerfile")
+
+elif [ "$DEP" = "islandora-syn" ]; then
+ echo "Use islandora-syn-fcrepo6 or islandora-syn-fcrepo7 so Syn major lines remain independent" >&2
+ exit 1
elif [ "$DEP" = "fcrepo-import-export" ]; then
URL="https://github.com/fcrepo-exts/fcrepo-import-export/releases/download/fcrepo-import-export-${NEW_VERSION}/fcrepo-import-export-${NEW_VERSION}.jar"
@@ -214,8 +310,8 @@ elif [ "$DEP" = "s6-overlay" ]; then
exit 0
else
- echo "DEP not found"
- exit 0
+ echo "Unsupported dependency: $DEP" >&2
+ exit 1
fi
update_dockerfile_sha "$URL" "$ARG" "${DOCKERFILES[@]}"
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 68fa4e62..ab9969f7 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -97,8 +97,8 @@ LOCAL_TAG_SUFFIXES = {
"activemq5" = "5"
"activemq6" = "6"
"alpaca" = ""
- "archivesspace" = "4.2.0"
- "archivesspace-solr" = "4.2.0"
+ "archivesspace" = ""
+ "archivesspace-solr" = ""
"base" = ""
"blazegraph" = ""
"crayfits" = ""
@@ -248,14 +248,19 @@ function "tags" {
result = equal("", suffix) ? [for tag in split(" ", TAGS): "${REPOSITORY}/${PUBLISHED_IMAGES[image]}:${tagName(image, tag)}"] : [for tag in split(" ", TAGS): "${REPOSITORY}/${PUBLISHED_IMAGES[image]}:${tagName(image, tag)}-${suffix}"]
}
+function "normalizeTag" {
+ params = [value]
+ result = trim(regex_replace(value, "[^A-Za-z0-9_.-]+", "-"), "-")
+}
+
function "cacheFrom" {
params = [image, arch]
- result = equal("", arch) ? [] : ["type=registry,ref=${CACHE_FROM_REPOSITORY}/cache:${image}-main-${arch}", notequal("", BRANCH) ? "type=registry,ref=${CACHE_FROM_REPOSITORY}/cache:${image}-${BRANCH}-${arch}" : ""]
+ result = equal("", arch) ? [] : ["type=registry,ref=${CACHE_FROM_REPOSITORY}/cache:${image}-main-${arch}", notequal("", normalizeTag(BRANCH)) ? "type=registry,ref=${CACHE_FROM_REPOSITORY}/cache:${image}-${normalizeTag(BRANCH)}-${arch}" : ""]
}
function "cacheTo" {
params = [image, arch]
- result = [notequal("", BRANCH) ? "type=registry,oci-mediatypes=true,mode=max,compression=estargz,compression-level=5,ref=${CACHE_TO_REPOSITORY}/cache:${image}-${BRANCH}-${arch}" : ""]
+ result = [notequal("", normalizeTag(BRANCH)) ? "type=registry,oci-mediatypes=true,mode=max,compression=estargz,compression-level=5,ref=${CACHE_TO_REPOSITORY}/cache:${image}-${normalizeTag(BRANCH)}-${arch}" : ""]
}
function "context" {
diff --git a/images/activemq5/Dockerfile b/images/activemq5/Dockerfile
index a0b73b3b..be9facff 100644
--- a/images/activemq5/Dockerfile
+++ b/images/activemq5/Dockerfile
@@ -27,10 +27,10 @@ RUN --mount=type=cache,id=activemq-downloads-${TARGETARCH},sharing=locked,target
ENV \
ACTIVEMQ_AUDIT_LOG_LEVEL=INFO \
ACTIVEMQ_LOG_LEVEL=INFO \
- ACTIVEMQ_PASSWORD=password \
+ ACTIVEMQ_PASSWORD= \
ACTIVEMQ_USER=admin \
ACTIVEMQ_WEB_ADMIN_NAME=admin \
- ACTIVEMQ_WEB_ADMIN_PASSWORD=password \
+ ACTIVEMQ_WEB_ADMIN_PASSWORD= \
ACTIVEMQ_WEB_ADMIN_ROLES=admin
COPY --link rootfs /
@@ -38,8 +38,4 @@ COPY --link rootfs /
RUN create-service-user.sh --name activemq && \
cleanup.sh
-HEALTHCHECK CMD curl -s \
- -u admin:"$(cat /var/run/s6/container_environment/ACTIVEMQ_WEB_ADMIN_PASSWORD)" \
- -H origin:localhost \
- "http://localhost:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost,service=Health/CurrentStatus" \
- | jq .value | grep -q Good
+HEALTHCHECK CMD activemq-healthcheck.sh
diff --git a/images/activemq5/README.md b/images/activemq5/README.md
index 63fb4164..416740a2 100644
--- a/images/activemq5/README.md
+++ b/images/activemq5/README.md
@@ -6,16 +6,21 @@ Built from [libops/isle-buildkit activemq](https://github.com/libops/buildkit/tr
Please refer to the [ActiveMQ Documentation] for more in-depth information.
-As a quick example this will bring up an instance of ActiveMQ, and allow you to
-log into the [WebConsole] on `http://localhost:8161` as the user `admin` with
-the password `password`.
+As a quick example this will generate separate broker and web-console
+credentials, bring up ActiveMQ, and allow you to log into the [WebConsole] on
+`http://localhost:8161` as `admin` using the value of
+`ACTIVEMQ_WEB_ADMIN_PASSWORD`.
```bash
-docker run --rm -ti -p 8161:8161 libops/activemq
+export ACTIVEMQ_PASSWORD="$(openssl rand -hex 32)"
+export ACTIVEMQ_WEB_ADMIN_PASSWORD="$(openssl rand -hex 32)"
+docker run --rm -ti -p 8161:8161 \
+ --env ACTIVEMQ_PASSWORD \
+ --env ACTIVEMQ_WEB_ADMIN_PASSWORD \
+ libops/activemq:5
```
-> N.B. if no credentials are given you will not be able to log in via the
-[WebConsole].
+Both credentials are required; the container fails closed when either is empty.
## Dependencies
@@ -46,10 +51,10 @@ additional settings, volumes, ports, etc.
| :-------------------------- | :------- | :----------------------------------------------------------------------------- |
| ACTIVEMQ_AUDIT_LOG_LEVEL | INFO | Log level. Possible Values: OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE or ALL |
| ACTIVEMQ_LOG_LEVEL | INFO | Log level. Possible Values: OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE or ALL |
-| ACTIVEMQ_PASSWORD | password | See [Security]: credentials.properties |
+| ACTIVEMQ_PASSWORD | | See [Security]: credentials.properties; required at startup |
| ACTIVEMQ_USER | admin | See [Security]: credentials.properties |
| ACTIVEMQ_WEB_ADMIN_NAME | admin | See [WebConsole]: jetty-realm.properties |
-| ACTIVEMQ_WEB_ADMIN_PASSWORD | password | See [WebConsole]: jetty-realm.properties |
+| ACTIVEMQ_WEB_ADMIN_PASSWORD | | See [WebConsole]: jetty-realm.properties; required at startup |
| ACTIVEMQ_WEB_ADMIN_ROLES | admin | See [WebConsole]: jetty-realm.properties |
Additional users/groups/etc can be defined by adding more environment variables,
diff --git a/images/activemq5/rootfs/etc/confd/templates/credentials.properties.tmpl b/images/activemq5/rootfs/etc/confd/templates/credentials.properties.tmpl
index 4952c702..86ddec53 100644
--- a/images/activemq5/rootfs/etc/confd/templates/credentials.properties.tmpl
+++ b/images/activemq5/rootfs/etc/confd/templates/credentials.properties.tmpl
@@ -1,3 +1,10 @@
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
# Defines credentials that will be used by components (like web console) to access the broker
-activemq.username={{ getenv "ACTIVEMQ_USER" }}
-activemq.password={{ getenv "ACTIVEMQ_PASSWORD" }}
+activemq.username={{ template "propertiesValueEscape" (getenv "ACTIVEMQ_USER") }}
+activemq.password={{ template "propertiesValueEscape" (getenv "ACTIVEMQ_PASSWORD") }}
diff --git a/images/activemq5/rootfs/etc/confd/templates/groups.properties.tmpl b/images/activemq5/rootfs/etc/confd/templates/groups.properties.tmpl
index 8e26887d..470cb092 100644
--- a/images/activemq5/rootfs/etc/confd/templates/groups.properties.tmpl
+++ b/images/activemq5/rootfs/etc/confd/templates/groups.properties.tmpl
@@ -1,4 +1,22 @@
+{{- define "propertiesKeyEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- $spaces := replace $tabs " " "\\ " -1 -}}
+{{- $colons := replace $spaces ":" "\\:" -1 -}}
+{{- $equals := replace $colons "=" "\\=" -1 -}}
+{{- $hashes := replace $equals "#" "\\#" -1 -}}
+{{- replace $hashes "!" "\\!" -1 -}}
+{{- end -}}
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
# Defines groups and the users that belong to them.
# group=user[,user ...]
-{{ range $dir := lsdir "/activemq/group" }}{{ getv (printf "/activemq/group/%s/name" $dir) }}={{ getv (printf "/activemq/group/%s/members" $dir) }}
+{{ range $dir := lsdir "/activemq/group" }}{{ template "propertiesKeyEscape" (getv (printf "/activemq/group/%s/name" $dir)) }}={{ template "propertiesValueEscape" (getv (printf "/activemq/group/%s/members" $dir)) }}
{{ end }}
diff --git a/images/activemq5/rootfs/etc/confd/templates/jetty-realm.properties.tmpl b/images/activemq5/rootfs/etc/confd/templates/jetty-realm.properties.tmpl
index 31a932a4..524995b7 100644
--- a/images/activemq5/rootfs/etc/confd/templates/jetty-realm.properties.tmpl
+++ b/images/activemq5/rootfs/etc/confd/templates/jetty-realm.properties.tmpl
@@ -1,5 +1,23 @@
+{{- define "propertiesKeyEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- $spaces := replace $tabs " " "\\ " -1 -}}
+{{- $colons := replace $spaces ":" "\\:" -1 -}}
+{{- $equals := replace $colons "=" "\\=" -1 -}}
+{{- $hashes := replace $equals "#" "\\#" -1 -}}
+{{- replace $hashes "!" "\\!" -1 -}}
+{{- end -}}
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
# Defines users that can access the web (console, demo, etc.)
# username: password [,rolename ...]
-{{ getenv "ACTIVEMQ_WEB_ADMIN_NAME" }}: {{ getenv "ACTIVEMQ_WEB_ADMIN_PASSWORD" }}, {{ getenv "ACTIVEMQ_WEB_ADMIN_ROLES" }}
-{{ range $dir := lsdir "/activemq/web/user" }}{{ getv (printf "/activemq/web/user/%s/name" $dir) }}: {{ getv (printf "/activemq/web/user/%s/password" $dir) }}, {{ getv (printf "/activemq/web/user/%s/roles" $dir) }}
+{{ template "propertiesKeyEscape" (getenv "ACTIVEMQ_WEB_ADMIN_NAME") }}: {{ template "propertiesValueEscape" (getenv "ACTIVEMQ_WEB_ADMIN_PASSWORD") }}, {{ template "propertiesValueEscape" (getenv "ACTIVEMQ_WEB_ADMIN_ROLES") }}
+{{ range $dir := lsdir "/activemq/web/user" }}{{ template "propertiesKeyEscape" (getv (printf "/activemq/web/user/%s/name" $dir)) }}: {{ template "propertiesValueEscape" (getv (printf "/activemq/web/user/%s/password" $dir)) }}, {{ template "propertiesValueEscape" (getv (printf "/activemq/web/user/%s/roles" $dir)) }}
{{ end }}
diff --git a/images/activemq5/rootfs/etc/confd/templates/users.properties.tmpl b/images/activemq5/rootfs/etc/confd/templates/users.properties.tmpl
index 669a832d..cc1d1d95 100644
--- a/images/activemq5/rootfs/etc/confd/templates/users.properties.tmpl
+++ b/images/activemq5/rootfs/etc/confd/templates/users.properties.tmpl
@@ -1,2 +1,20 @@
-{{ range $dir := lsdir "/activemq/user" }}{{ getv (printf "/activemq/user/%s/name" $dir) }}={{ getv (printf "/activemq/user/%s/password" $dir) }}
+{{- define "propertiesKeyEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- $spaces := replace $tabs " " "\\ " -1 -}}
+{{- $colons := replace $spaces ":" "\\:" -1 -}}
+{{- $equals := replace $colons "=" "\\=" -1 -}}
+{{- $hashes := replace $equals "#" "\\#" -1 -}}
+{{- replace $hashes "!" "\\!" -1 -}}
+{{- end -}}
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
+{{ range $dir := lsdir "/activemq/user" }}{{ template "propertiesKeyEscape" (getv (printf "/activemq/user/%s/name" $dir)) }}={{ template "propertiesValueEscape" (getv (printf "/activemq/user/%s/password" $dir)) }}
{{ end }}
diff --git a/images/activemq5/rootfs/etc/s6-overlay/s6-rc.d/activemq/run b/images/activemq5/rootfs/etc/s6-overlay/s6-rc.d/activemq/run
index 9ea0dc80..9ec0b40a 100755
--- a/images/activemq5/rootfs/etc/s6-overlay/s6-rc.d/activemq/run
+++ b/images/activemq5/rootfs/etc/s6-overlay/s6-rc.d/activemq/run
@@ -1,7 +1,16 @@
-#!/usr/bin/env bash
+#!/command/with-contenv bash
+# shellcheck shell=bash
set -e
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+
+require_environment_variables ACTIVEMQ_USER ACTIVEMQ_PASSWORD \
+ ACTIVEMQ_WEB_ADMIN_NAME ACTIVEMQ_WEB_ADMIN_PASSWORD
+
# When bind mounting we need to ensure that we
# actually can write to the folder.
chown activemq:activemq /opt/activemq/data
+unset ACTIVEMQ_PASSWORD ACTIVEMQ_WEB_ADMIN_PASSWORD
+unset DB_ROOT_PASSWORD
exec s6-setuidgid activemq /opt/activemq/bin/activemq console
diff --git a/images/activemq5/rootfs/usr/local/bin/activemq-healthcheck.sh b/images/activemq5/rootfs/usr/local/bin/activemq-healthcheck.sh
new file mode 100755
index 00000000..92a25067
--- /dev/null
+++ b/images/activemq5/rootfs/usr/local/bin/activemq-healthcheck.sh
@@ -0,0 +1,25 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+require_environment_variables ACTIVEMQ_WEB_ADMIN_NAME ACTIVEMQ_WEB_ADMIN_PASSWORD
+
+umask 077
+curl_config=$(mktemp -t activemq-healthcheck.XXXXXXXXXX)
+trap 'rm -f -- "${curl_config}"' EXIT
+chmod 0600 "${curl_config}"
+
+# Keep the credential out of curl's argv. The temporary curl configuration is
+# root-only and contains only a derived Basic authorization value.
+authorization=$(printf '%s:%s' "${ACTIVEMQ_WEB_ADMIN_NAME}" "${ACTIVEMQ_WEB_ADMIN_PASSWORD}" | base64 | tr -d '\n')
+{
+ printf '%s\n' 'fail' 'silent' 'show-error'
+ printf 'header = "Origin: localhost"\n'
+ printf 'header = "Authorization: Basic %s"\n' "${authorization}"
+ printf 'url = "%s"\n' 'http://localhost:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost,service=Health/CurrentStatus'
+} >"${curl_config}"
+
+curl --config "${curl_config}" | jq -e '.value == "Good"' >/dev/null
diff --git a/images/activemq5/tests/ServiceHealthcheck/docker-compose.yml b/images/activemq5/tests/ServiceHealthcheck/docker-compose.yml
index b72dd41d..7d3d45d9 100644
--- a/images/activemq5/tests/ServiceHealthcheck/docker-compose.yml
+++ b/images/activemq5/tests/ServiceHealthcheck/docker-compose.yml
@@ -8,6 +8,14 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_USER_ESCAPE_NAME: 'broker:user=name'
+ ACTIVEMQ_USER_ESCAPE_PASSWORD: ' broker:p\a=ss:word'
+ ACTIVEMQ_GROUP_ESCAPE_NAME: 'operators:admin=team'
+ ACTIVEMQ_GROUP_ESCAPE_MEMBERS: 'broker:user=name'
+ ACTIVEMQ_WEB_ADMIN_NAME: healthcheck-user
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: 'web:p"a\ss&+=word'
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/activemq5/tests/ServiceHealthcheck/test.sh b/images/activemq5/tests/ServiceHealthcheck/test.sh
index dd1d6bdf..a7317ec5 100755
--- a/images/activemq5/tests/ServiceHealthcheck/test.sh
+++ b/images/activemq5/tests/ServiceHealthcheck/test.sh
@@ -2,13 +2,16 @@
# shellcheck shell=bash
# Invoked indirectly by the SIGTERM trap below.
-# shellcheck disable=SC2329
+# shellcheck disable=SC2317,SC2329
on_terminate() {
echo "Termination signal received. Exiting..."
exit 0
}
trap 'on_terminate' SIGTERM
+grep -Fqx 'broker\:user\=name=\ broker:p\\a=ss:word' /opt/activemq/conf/users.properties
+grep -Fqx 'operators\:admin\=team=broker:user=name' /opt/activemq/conf/groups.properties
+
sleep 60
# The kotlin check should be stopping this container
diff --git a/images/activemq5/tests/ServiceStartsWithDefaults/docker-compose.yml b/images/activemq5/tests/ServiceStartsWithDefaults/docker-compose.yml
index ebca7ded..652d1963 100644
--- a/images/activemq5/tests/ServiceStartsWithDefaults/docker-compose.yml
+++ b/images/activemq5/tests/ServiceStartsWithDefaults/docker-compose.yml
@@ -11,6 +11,9 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/activemq6/Dockerfile b/images/activemq6/Dockerfile
index e7303298..6e8364c7 100644
--- a/images/activemq6/Dockerfile
+++ b/images/activemq6/Dockerfile
@@ -27,10 +27,10 @@ RUN --mount=type=cache,id=activemq-downloads-${TARGETARCH},sharing=locked,target
ENV \
ACTIVEMQ_AUDIT_LOG_LEVEL=INFO \
ACTIVEMQ_LOG_LEVEL=INFO \
- ACTIVEMQ_PASSWORD=password \
+ ACTIVEMQ_PASSWORD= \
ACTIVEMQ_USER=admin \
ACTIVEMQ_WEB_ADMIN_NAME=admin \
- ACTIVEMQ_WEB_ADMIN_PASSWORD=password \
+ ACTIVEMQ_WEB_ADMIN_PASSWORD= \
ACTIVEMQ_WEB_ADMIN_ROLES=admin
COPY --link rootfs /
@@ -38,8 +38,4 @@ COPY --link rootfs /
RUN create-service-user.sh --name activemq && \
cleanup.sh
-HEALTHCHECK CMD curl -s \
- -u admin:"$(cat /var/run/s6/container_environment/ACTIVEMQ_WEB_ADMIN_PASSWORD)" \
- -H origin:localhost \
- "http://localhost:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost,service=Health/CurrentStatus" \
- | jq .value | grep -q Good
+HEALTHCHECK CMD activemq-healthcheck.sh
diff --git a/images/activemq6/README.md b/images/activemq6/README.md
index 2053d037..3d8ce17b 100644
--- a/images/activemq6/README.md
+++ b/images/activemq6/README.md
@@ -6,16 +6,21 @@ Built from [libops/isle-buildkit activemq7](https://github.com/libops/buildkit/t
Please refer to the [ActiveMQ Documentation] for more in-depth information.
-As a quick example this will bring up an instance of ActiveMQ, and allow you to
-log into the [WebConsole] on `http://localhost:8161` as the user `admin` with
-the password `password`.
+As a quick example this will generate separate broker and web-console
+credentials, bring up ActiveMQ, and allow you to log into the [WebConsole] on
+`http://localhost:8161` as `admin` using the value of
+`ACTIVEMQ_WEB_ADMIN_PASSWORD`.
```bash
-docker run --rm -ti -p 8161:8161 libops/activemq
+export ACTIVEMQ_PASSWORD="$(openssl rand -hex 32)"
+export ACTIVEMQ_WEB_ADMIN_PASSWORD="$(openssl rand -hex 32)"
+docker run --rm -ti -p 8161:8161 \
+ --env ACTIVEMQ_PASSWORD \
+ --env ACTIVEMQ_WEB_ADMIN_PASSWORD \
+ libops/activemq:6
```
-> N.B. if no credentials are given you will not be able to log in via the
-[WebConsole].
+Both credentials are required; the container fails closed when either is empty.
## Dependencies
@@ -46,10 +51,10 @@ additional settings, volumes, ports, etc.
| :-------------------------- | :------- | :----------------------------------------------------------------------------- |
| ACTIVEMQ_AUDIT_LOG_LEVEL | INFO | Log level. Possible Values: OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE or ALL |
| ACTIVEMQ_LOG_LEVEL | INFO | Log level. Possible Values: OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE or ALL |
-| ACTIVEMQ_PASSWORD | password | See [Security]: credentials.properties |
+| ACTIVEMQ_PASSWORD | | See [Security]: credentials.properties; required at startup |
| ACTIVEMQ_USER | admin | See [Security]: credentials.properties |
| ACTIVEMQ_WEB_ADMIN_NAME | admin | See [WebConsole]: jetty-realm.properties |
-| ACTIVEMQ_WEB_ADMIN_PASSWORD | password | See [WebConsole]: jetty-realm.properties |
+| ACTIVEMQ_WEB_ADMIN_PASSWORD | | See [WebConsole]: jetty-realm.properties; required at startup |
| ACTIVEMQ_WEB_ADMIN_ROLES | admin | See [WebConsole]: jetty-realm.properties |
Additional users/groups/etc can be defined by adding more environment variables,
diff --git a/images/activemq6/rootfs/etc/confd/templates/credentials.properties.tmpl b/images/activemq6/rootfs/etc/confd/templates/credentials.properties.tmpl
index 4952c702..86ddec53 100644
--- a/images/activemq6/rootfs/etc/confd/templates/credentials.properties.tmpl
+++ b/images/activemq6/rootfs/etc/confd/templates/credentials.properties.tmpl
@@ -1,3 +1,10 @@
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
# Defines credentials that will be used by components (like web console) to access the broker
-activemq.username={{ getenv "ACTIVEMQ_USER" }}
-activemq.password={{ getenv "ACTIVEMQ_PASSWORD" }}
+activemq.username={{ template "propertiesValueEscape" (getenv "ACTIVEMQ_USER") }}
+activemq.password={{ template "propertiesValueEscape" (getenv "ACTIVEMQ_PASSWORD") }}
diff --git a/images/activemq6/rootfs/etc/confd/templates/groups.properties.tmpl b/images/activemq6/rootfs/etc/confd/templates/groups.properties.tmpl
index 8e26887d..470cb092 100644
--- a/images/activemq6/rootfs/etc/confd/templates/groups.properties.tmpl
+++ b/images/activemq6/rootfs/etc/confd/templates/groups.properties.tmpl
@@ -1,4 +1,22 @@
+{{- define "propertiesKeyEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- $spaces := replace $tabs " " "\\ " -1 -}}
+{{- $colons := replace $spaces ":" "\\:" -1 -}}
+{{- $equals := replace $colons "=" "\\=" -1 -}}
+{{- $hashes := replace $equals "#" "\\#" -1 -}}
+{{- replace $hashes "!" "\\!" -1 -}}
+{{- end -}}
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
# Defines groups and the users that belong to them.
# group=user[,user ...]
-{{ range $dir := lsdir "/activemq/group" }}{{ getv (printf "/activemq/group/%s/name" $dir) }}={{ getv (printf "/activemq/group/%s/members" $dir) }}
+{{ range $dir := lsdir "/activemq/group" }}{{ template "propertiesKeyEscape" (getv (printf "/activemq/group/%s/name" $dir)) }}={{ template "propertiesValueEscape" (getv (printf "/activemq/group/%s/members" $dir)) }}
{{ end }}
diff --git a/images/activemq6/rootfs/etc/confd/templates/jetty-realm.properties.tmpl b/images/activemq6/rootfs/etc/confd/templates/jetty-realm.properties.tmpl
index 31a932a4..524995b7 100644
--- a/images/activemq6/rootfs/etc/confd/templates/jetty-realm.properties.tmpl
+++ b/images/activemq6/rootfs/etc/confd/templates/jetty-realm.properties.tmpl
@@ -1,5 +1,23 @@
+{{- define "propertiesKeyEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- $spaces := replace $tabs " " "\\ " -1 -}}
+{{- $colons := replace $spaces ":" "\\:" -1 -}}
+{{- $equals := replace $colons "=" "\\=" -1 -}}
+{{- $hashes := replace $equals "#" "\\#" -1 -}}
+{{- replace $hashes "!" "\\!" -1 -}}
+{{- end -}}
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
# Defines users that can access the web (console, demo, etc.)
# username: password [,rolename ...]
-{{ getenv "ACTIVEMQ_WEB_ADMIN_NAME" }}: {{ getenv "ACTIVEMQ_WEB_ADMIN_PASSWORD" }}, {{ getenv "ACTIVEMQ_WEB_ADMIN_ROLES" }}
-{{ range $dir := lsdir "/activemq/web/user" }}{{ getv (printf "/activemq/web/user/%s/name" $dir) }}: {{ getv (printf "/activemq/web/user/%s/password" $dir) }}, {{ getv (printf "/activemq/web/user/%s/roles" $dir) }}
+{{ template "propertiesKeyEscape" (getenv "ACTIVEMQ_WEB_ADMIN_NAME") }}: {{ template "propertiesValueEscape" (getenv "ACTIVEMQ_WEB_ADMIN_PASSWORD") }}, {{ template "propertiesValueEscape" (getenv "ACTIVEMQ_WEB_ADMIN_ROLES") }}
+{{ range $dir := lsdir "/activemq/web/user" }}{{ template "propertiesKeyEscape" (getv (printf "/activemq/web/user/%s/name" $dir)) }}: {{ template "propertiesValueEscape" (getv (printf "/activemq/web/user/%s/password" $dir)) }}, {{ template "propertiesValueEscape" (getv (printf "/activemq/web/user/%s/roles" $dir)) }}
{{ end }}
diff --git a/images/activemq6/rootfs/etc/confd/templates/users.properties.tmpl b/images/activemq6/rootfs/etc/confd/templates/users.properties.tmpl
index 669a832d..cc1d1d95 100644
--- a/images/activemq6/rootfs/etc/confd/templates/users.properties.tmpl
+++ b/images/activemq6/rootfs/etc/confd/templates/users.properties.tmpl
@@ -1,2 +1,20 @@
-{{ range $dir := lsdir "/activemq/user" }}{{ getv (printf "/activemq/user/%s/name" $dir) }}={{ getv (printf "/activemq/user/%s/password" $dir) }}
+{{- define "propertiesKeyEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- $spaces := replace $tabs " " "\\ " -1 -}}
+{{- $colons := replace $spaces ":" "\\:" -1 -}}
+{{- $equals := replace $colons "=" "\\=" -1 -}}
+{{- $hashes := replace $equals "#" "\\#" -1 -}}
+{{- replace $hashes "!" "\\!" -1 -}}
+{{- end -}}
+{{- define "propertiesValueEscape" -}}
+{{- $backslashes := replace . "\\" "\\\\" -1 -}}
+{{- $carriageReturns := replace $backslashes "\r" "\\r" -1 -}}
+{{- $newlines := replace $carriageReturns "\n" "\\n" -1 -}}
+{{- $tabs := replace $newlines "\t" "\\t" -1 -}}
+{{- replace $tabs " " "\\ " -1 -}}
+{{- end -}}
+{{ range $dir := lsdir "/activemq/user" }}{{ template "propertiesKeyEscape" (getv (printf "/activemq/user/%s/name" $dir)) }}={{ template "propertiesValueEscape" (getv (printf "/activemq/user/%s/password" $dir)) }}
{{ end }}
diff --git a/images/activemq6/rootfs/etc/s6-overlay/s6-rc.d/activemq/run b/images/activemq6/rootfs/etc/s6-overlay/s6-rc.d/activemq/run
index 9ea0dc80..9ec0b40a 100755
--- a/images/activemq6/rootfs/etc/s6-overlay/s6-rc.d/activemq/run
+++ b/images/activemq6/rootfs/etc/s6-overlay/s6-rc.d/activemq/run
@@ -1,7 +1,16 @@
-#!/usr/bin/env bash
+#!/command/with-contenv bash
+# shellcheck shell=bash
set -e
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+
+require_environment_variables ACTIVEMQ_USER ACTIVEMQ_PASSWORD \
+ ACTIVEMQ_WEB_ADMIN_NAME ACTIVEMQ_WEB_ADMIN_PASSWORD
+
# When bind mounting we need to ensure that we
# actually can write to the folder.
chown activemq:activemq /opt/activemq/data
+unset ACTIVEMQ_PASSWORD ACTIVEMQ_WEB_ADMIN_PASSWORD
+unset DB_ROOT_PASSWORD
exec s6-setuidgid activemq /opt/activemq/bin/activemq console
diff --git a/images/activemq6/rootfs/usr/local/bin/activemq-healthcheck.sh b/images/activemq6/rootfs/usr/local/bin/activemq-healthcheck.sh
new file mode 100755
index 00000000..92a25067
--- /dev/null
+++ b/images/activemq6/rootfs/usr/local/bin/activemq-healthcheck.sh
@@ -0,0 +1,25 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+require_environment_variables ACTIVEMQ_WEB_ADMIN_NAME ACTIVEMQ_WEB_ADMIN_PASSWORD
+
+umask 077
+curl_config=$(mktemp -t activemq-healthcheck.XXXXXXXXXX)
+trap 'rm -f -- "${curl_config}"' EXIT
+chmod 0600 "${curl_config}"
+
+# Keep the credential out of curl's argv. The temporary curl configuration is
+# root-only and contains only a derived Basic authorization value.
+authorization=$(printf '%s:%s' "${ACTIVEMQ_WEB_ADMIN_NAME}" "${ACTIVEMQ_WEB_ADMIN_PASSWORD}" | base64 | tr -d '\n')
+{
+ printf '%s\n' 'fail' 'silent' 'show-error'
+ printf 'header = "Origin: localhost"\n'
+ printf 'header = "Authorization: Basic %s"\n' "${authorization}"
+ printf 'url = "%s"\n' 'http://localhost:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost,service=Health/CurrentStatus'
+} >"${curl_config}"
+
+curl --config "${curl_config}" | jq -e '.value == "Good"' >/dev/null
diff --git a/images/activemq6/tests/ServiceHealthcheck/docker-compose.yml b/images/activemq6/tests/ServiceHealthcheck/docker-compose.yml
index b72dd41d..7d3d45d9 100644
--- a/images/activemq6/tests/ServiceHealthcheck/docker-compose.yml
+++ b/images/activemq6/tests/ServiceHealthcheck/docker-compose.yml
@@ -8,6 +8,14 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_USER_ESCAPE_NAME: 'broker:user=name'
+ ACTIVEMQ_USER_ESCAPE_PASSWORD: ' broker:p\a=ss:word'
+ ACTIVEMQ_GROUP_ESCAPE_NAME: 'operators:admin=team'
+ ACTIVEMQ_GROUP_ESCAPE_MEMBERS: 'broker:user=name'
+ ACTIVEMQ_WEB_ADMIN_NAME: healthcheck-user
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: 'web:p"a\ss&+=word'
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/activemq6/tests/ServiceHealthcheck/test.sh b/images/activemq6/tests/ServiceHealthcheck/test.sh
index dd1d6bdf..a7317ec5 100755
--- a/images/activemq6/tests/ServiceHealthcheck/test.sh
+++ b/images/activemq6/tests/ServiceHealthcheck/test.sh
@@ -2,13 +2,16 @@
# shellcheck shell=bash
# Invoked indirectly by the SIGTERM trap below.
-# shellcheck disable=SC2329
+# shellcheck disable=SC2317,SC2329
on_terminate() {
echo "Termination signal received. Exiting..."
exit 0
}
trap 'on_terminate' SIGTERM
+grep -Fqx 'broker\:user\=name=\ broker:p\\a=ss:word' /opt/activemq/conf/users.properties
+grep -Fqx 'operators\:admin\=team=broker:user=name' /opt/activemq/conf/groups.properties
+
sleep 60
# The kotlin check should be stopping this container
diff --git a/images/activemq6/tests/ServiceStartsWithDefaults/docker-compose.yml b/images/activemq6/tests/ServiceStartsWithDefaults/docker-compose.yml
index ebca7ded..652d1963 100644
--- a/images/activemq6/tests/ServiceStartsWithDefaults/docker-compose.yml
+++ b/images/activemq6/tests/ServiceStartsWithDefaults/docker-compose.yml
@@ -11,6 +11,9 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/alpaca/Dockerfile b/images/alpaca/Dockerfile
index deb46686..26056c00 100644
--- a/images/alpaca/Dockerfile
+++ b/images/alpaca/Dockerfile
@@ -90,7 +90,7 @@ ENV \
ALPACA_JAVA_OPTS= \
ALPACA_JMS_CONNECTIONS=10 \
ALPACA_JMS_CONSUMERS=1 \
- ALPACA_JMS_PASSWORD=password \
+ ALPACA_JMS_PASSWORD= \
ALPACA_JMS_URL=tcp://activemq:61616 \
ALPACA_JMS_USER=admin \
ALPACA_MAX_REDELIVERIES=5 \
diff --git a/images/alpaca/README.md b/images/alpaca/README.md
index 65a6a4b5..83bc8de4 100644
--- a/images/alpaca/README.md
+++ b/images/alpaca/README.md
@@ -1,6 +1,6 @@
# Alpaca
-Docker image for [Alpaca] version 2.2.0.
+Docker image for [Alpaca] version 2.4.0.
Built from [libops/isle-buildkit alpaca](https://github.com/libops/buildkit/tree/main/images/alpaca)
@@ -64,7 +64,7 @@ additional settings, volumes, ports, etc.
| ALPACA_JAVA_OPTS | | |
| ALPACA_JMS_CONNECTIONS | 10 | |
| ALPACA_JMS_CONSUMERS | 1 | |
-| ALPACA_JMS_PASSWORD | password | Password to authenticate with |
+| ALPACA_JMS_PASSWORD | | Password to authenticate with; required at startup |
| ALPACA_JMS_URL | tcp://activemq:61616 | The url for connecting to the ActiveMQ broker, shared by all components |
| ALPACA_JMS_USER | admin | User to authenticate as |
| ALPACA_MAX_REDELIVERIES | 5 | Number of attempts to redeliver if an exception occurs |
diff --git a/images/alpaca/rootfs/etc/confd/conf.d/alpaca.properties.toml b/images/alpaca/rootfs/etc/confd/conf.d/alpaca.properties.toml
index 3958ca18..2d84a064 100644
--- a/images/alpaca/rootfs/etc/confd/conf.d/alpaca.properties.toml
+++ b/images/alpaca/rootfs/etc/confd/conf.d/alpaca.properties.toml
@@ -3,5 +3,5 @@ src = "alpaca.properties.tmpl"
dest = "/opt/alpaca/alpaca.properties"
uid = 100
gid = 1000
-mode = "0644"
+mode = "0640"
keys = [ "/" ]
diff --git a/images/alpaca/rootfs/etc/s6-overlay/s6-rc.d/alpaca/run b/images/alpaca/rootfs/etc/s6-overlay/s6-rc.d/alpaca/run
index 20904782..9bfc18b7 100755
--- a/images/alpaca/rootfs/etc/s6-overlay/s6-rc.d/alpaca/run
+++ b/images/alpaca/rootfs/etc/s6-overlay/s6-rc.d/alpaca/run
@@ -2,12 +2,19 @@
# shellcheck shell=bash
set -e
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+
+require_environment_variables ALPACA_JMS_USER ALPACA_JMS_PASSWORD
+
alpaca_java_opts=()
if [ -n "${ALPACA_JAVA_OPTS:-}" ]; then
read -r -a alpaca_java_opts <<<"$ALPACA_JAVA_OPTS"
fi
+unset ALPACA_JMS_PASSWORD
+unset DB_ROOT_PASSWORD
exec s6-setuidgid alpaca java "${alpaca_java_opts[@]}" \
-jar /opt/alpaca/alpaca.jar \
-c /opt/alpaca/alpaca.properties
diff --git a/images/alpaca/tests/ServiceStartsWithDefaults/docker-compose.yml b/images/alpaca/tests/ServiceStartsWithDefaults/docker-compose.yml
index e6619be0..d6d016e4 100644
--- a/images/alpaca/tests/ServiceStartsWithDefaults/docker-compose.yml
+++ b/images/alpaca/tests/ServiceStartsWithDefaults/docker-compose.yml
@@ -8,8 +8,13 @@ services:
alpaca:
<<: *common
image: ${ALPACA:-libops/alpaca:local}
+ environment:
+ ALPACA_JMS_PASSWORD: test-broker-password
depends_on:
- activemq
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
diff --git a/images/archivesspace-solr/Dockerfile b/images/archivesspace-solr/Dockerfile
index 92616191..a1f6b296 100644
--- a/images/archivesspace-solr/Dockerfile
+++ b/images/archivesspace-solr/Dockerfile
@@ -1,6 +1,8 @@
# syntax=docker/dockerfile:1.20.0
FROM solr9
+LABEL org.opencontainers.image.licenses="Apache-2.0 AND ECL-2.0"
+
ARG TARGETARCH
# renovate: datasource=github-releases depName=archivesspace packageName=archivesspace/archivesspace
@@ -17,6 +19,8 @@ RUN --mount=type=cache,id=archivesspace-solr-downloads-${TARGETARCH},sharing=loc
&& \
mkdir -p /opt/solr/server/solr/configsets/archivesspace/conf && \
cp -R /tmp/archivesspace-release/archivesspace/solr/. /opt/solr/server/solr/configsets/archivesspace/conf/ && \
+ mkdir -p /usr/share/licenses/archivesspace-solr && \
+ cp /tmp/archivesspace-release/archivesspace/COPYING /usr/share/licenses/archivesspace-solr/COPYING && \
mkdir -p /opt/solr/server/solr/archivesspace && \
cp -R /opt/solr/server/solr/configsets/archivesspace/. /opt/solr/server/solr/archivesspace/ && \
printf 'name=archivesspace\n' > /opt/solr/server/solr/archivesspace/core.properties && \
diff --git a/images/archivesspace/Dockerfile b/images/archivesspace/Dockerfile
index cec599c4..e051cd0f 100644
--- a/images/archivesspace/Dockerfile
+++ b/images/archivesspace/Dockerfile
@@ -1,6 +1,8 @@
# syntax=docker/dockerfile:1.20.0
FROM java17
+LABEL org.opencontainers.image.licenses="ECL-2.0"
+
ARG TARGETARCH
ARG \
@@ -62,6 +64,8 @@ RUN --mount=type=cache,id=archivesspace-downloads-${TARGETARCH},sharing=locked,t
--sha256 "${MYSQL_CONNECTOR_SHA256}" \
--dest /archivesspace/lib \
&& \
+ mkdir -p /usr/share/licenses/archivesspace && \
+ cp /archivesspace/COPYING /usr/share/licenses/archivesspace/COPYING && \
chmod +x /archivesspace/archivesspace.sh /archivesspace/scripts/*.sh && \
chown -R archivesspace:archivesspace /archivesspace && \
cleanup.sh
@@ -74,7 +78,7 @@ ENV \
ASPACE_JAVA_XMX=-Xmx2048m \
DB_HOST=mariadb \
DB_NAME=archivesspace \
- DB_PASSWORD=changeme \
+ DB_PASSWORD= \
DB_PORT=3306 \
DB_USER=archivesspace \
INGRESS_HOSTNAMES=localhost \
diff --git a/images/archivesspace/rootfs/etc/confd/templates/archivesspace.config.rb.tmpl b/images/archivesspace/rootfs/etc/confd/templates/archivesspace.config.rb.tmpl
index eec1bd6f..b541d5c7 100644
--- a/images/archivesspace/rootfs/etc/confd/templates/archivesspace.config.rb.tmpl
+++ b/images/archivesspace/rootfs/etc/confd/templates/archivesspace.config.rb.tmpl
@@ -10,7 +10,11 @@
{{ $appConfigSolrURL := getenv "APPCONFIG_SOLR_URL" }}
{{ $smtpFrom := getenv "SMTP_FROM" }}
{{ $smtpHost := getenv "SMTP_HOST" }}
-AppConfig[:db_url] = 'jdbc:mysql://{{ template "sqlEscape" $dbHost }}:{{ template "sqlEscape" $dbPort }}/{{ template "sqlEscape" $dbName }}?useUnicode=true&characterEncoding=UTF-8&user={{ template "sqlEscape" $dbUser }}&password={{ template "sqlEscape" $dbPassword }}&useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC'
+require 'uri'
+
+db_user = URI.encode_www_form_component('{{ template "sqlEscape" $dbUser }}')
+db_password = URI.encode_www_form_component('{{ template "sqlEscape" $dbPassword }}')
+AppConfig[:db_url] = 'jdbc:mysql://{{ template "sqlEscape" $dbHost }}:{{ template "sqlEscape" $dbPort }}/{{ template "sqlEscape" $dbName }}?useUnicode=true&characterEncoding=UTF-8&user=' + db_user + '&password=' + db_password + '&useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC'
{{ if ne (getenv "APPCONFIG_SOLR_URL") "" -}}
AppConfig[:solr_url] = '{{ template "sqlEscape" $appConfigSolrURL }}'
{{ else -}}
diff --git a/images/archivesspace/rootfs/etc/s6-overlay/s6-rc.d/archivesspace/run b/images/archivesspace/rootfs/etc/s6-overlay/s6-rc.d/archivesspace/run
index b2d1e63a..f754f7cb 100755
--- a/images/archivesspace/rootfs/etc/s6-overlay/s6-rc.d/archivesspace/run
+++ b/images/archivesspace/rootfs/etc/s6-overlay/s6-rc.d/archivesspace/run
@@ -16,4 +16,5 @@ trap terminate TERM
setsid /usr/local/bin/archivesspace-startup.sh &
child=$!
+unset DB_ROOT_PASSWORD
wait "${child}"
diff --git a/images/archivesspace/rootfs/usr/local/bin/archivesspace-startup.sh b/images/archivesspace/rootfs/usr/local/bin/archivesspace-startup.sh
index 15d41b48..e7b73616 100755
--- a/images/archivesspace/rootfs/usr/local/bin/archivesspace-startup.sh
+++ b/images/archivesspace/rootfs/usr/local/bin/archivesspace-startup.sh
@@ -2,26 +2,21 @@
# shellcheck shell=bash
set -euo pipefail
+# shellcheck disable=SC1091
+source /usr/local/share/libops/database.sh
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+
+require_environment_variables DB_HOST DB_NAME DB_USER DB_PASSWORD
+
data_dir="${APPCONFIG_DATA_DIR:-/archivesspace/data}"
mkdir -p "${data_dir}/tmp"
chown -R archivesspace:archivesspace "${data_dir}" /archivesspace/config
-function root_password {
- printf '%s' "${DB_ROOT_PASSWORD:-}"
-}
-
function create_archivesspace_database {
- local root_password_value
- root_password_value="$(root_password)"
- cat <<-SQL | DB_ROOT_PASSWORD="${root_password_value}" create-database.sh
-CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-
-CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
-GRANT ALL PRIVILEGES ON ${DB_NAME}.* to '${DB_USER}'@'%';
-FLUSH PRIVILEGES;
-
-SET PASSWORD FOR '${DB_USER}'@'%' = PASSWORD('${DB_PASSWORD}');
-SQL
+ DB_CHARACTER_SET=utf8mb4 \
+ DB_COLLATION=utf8mb4_unicode_ci \
+ render-database-bootstrap-sql.sh | create-database.sh
}
if [ -n "${ASPACE_INITIALIZE_PLUGINS:-}" ]; then
@@ -34,10 +29,9 @@ fi
rm -rf "${data_dir:?}/tmp"/*
if [ "${ASPACE_DB_MIGRATE:-true}" = "true" ]; then
- if [ -n "$(root_password)" ]; then
- create_archivesspace_database
- fi
+ database_bootstrap_if_enabled create_archivesspace_database
s6-setuidgid archivesspace /archivesspace/scripts/setup-database.sh
fi
+unset DB_ROOT_PASSWORD
exec s6-setuidgid archivesspace /archivesspace/archivesspace.sh
diff --git a/images/archivesspace/tests/ServiceHealthcheck/docker-compose.yml b/images/archivesspace/tests/ServiceHealthcheck/docker-compose.yml
index bdac72ec..6410d5ff 100644
--- a/images/archivesspace/tests/ServiceHealthcheck/docker-compose.yml
+++ b/images/archivesspace/tests/ServiceHealthcheck/docker-compose.yml
@@ -5,8 +5,7 @@ services:
image: ${ARCHIVESSPACE:-libops/archivesspace:local}
environment:
ASPACE_DB_MIGRATE: "true"
- DB_ROOT_PASSWORD: root
- DB_PASSWORD: password
+ DB_PASSWORD: "archive&=space%#password"
APPCONFIG_SOLR_URL: http://solr:8983/solr/archivesspace
depends_on:
mariadb:
@@ -19,6 +18,6 @@ services:
DB_ROOT_PASSWORD: root
DB_NAME: archivesspace
DB_USER: archivesspace
- DB_PASSWORD: password
+ DB_PASSWORD: "archive&=space%#password"
solr:
image: ${ARCHIVESSPACE_SOLR:-libops/archivesspace-solr:local}
diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index 5c4c1203..113412d7 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -140,15 +140,16 @@ ENV \
# environment variables via ENV.
ENV \
APP_UID=100 \
+ DB_BOOTSTRAP_ENABLED=false \
DB_HOST=mariadb \
DB_NAME=default \
- DB_PASSWORD=password \
+ DB_PASSWORD= \
DB_PORT=3306 \
- DB_ROOT_PASSWORD=password \
+ DB_ROOT_PASSWORD= \
DB_ROOT_USER=root \
DB_USER=default \
DEVELOPMENT_ENVIRONMENT=false \
- JWT_ADMIN_TOKEN=islandora \
+ JWT_ADMIN_TOKEN= \
LIBOPS_PROJECT_ID= \
LIBOPS_SITE_ID= \
UID= \
diff --git a/images/base/README.md b/images/base/README.md
index a1bd09c1..97abbe8e 100644
--- a/images/base/README.md
+++ b/images/base/README.md
@@ -69,7 +69,7 @@ duplication.
| Environment Variable | Default | Description |
| :------------------- | :-------------------------------------------- | :----------------------------------------------------------------------------------------------------------- |
-| JWT_ADMIN_TOKEN | islandora | Used for [bearer authentication] (Only use with HTTPS or over private networks) |
+| JWT_ADMIN_TOKEN | | Used for [bearer authentication]; supply a secret for services that enable Syn |
| JWT_PRIVATE_KEY | @see base/rootfs/etc/defaults/JWT_PRIVATE_KEY | Private key for JWT authentication, RSA PEM Format is expected (should only be used in the Drupal container) |
| JWT_PUBLIC_KEY | @see base/rootfs/etc/defaults/JWT_PUBLIC_KEY | Public key for JWT authentication |
@@ -91,15 +91,16 @@ add `jwt` as a secondary group to your service user.
Database settings target MariaDB.
-| Environment Variable | Default | Description |
-| :------------------- | :--------- | :---------------------------------------------------------------------------------------------- |
-| DB_HOST | mariadb | The database host to use |
-| DB_NAME | default | The name of the default database if no other is specified |
-| DB_PASSWORD | password | The password of the user used by the service (e.g. Drupal) to connect to the database |
-| DB_PORT | 3306 | The database port to use |
-| DB_ROOT_PASSWORD | password | The root user password |
-| DB_ROOT_USER | root | The root user, which is used only on startup to create database / user in the chosen backend |
-| DB_USER | default | The user used by the service (e.g. Drupal) to connect to the database |
+| Environment Variable | Default | Description |
+| :-------------------- | :------ | :----------------------------------------------------------------------------------------------------------- |
+| DB_BOOTSTRAP_ENABLED | false | Explicitly allow an application setup service to create its database and user with root credentials |
+| DB_HOST | mariadb | The database host to use |
+| DB_NAME | default | The name of the default database if no other is specified |
+| DB_PASSWORD | | The password of the scoped user used by the service; required by database-backed applications |
+| DB_PORT | 3306 | The database port to use |
+| DB_ROOT_PASSWORD | | The root password; required only when `DB_BOOTSTRAP_ENABLED=true` and preferably supplied as a file secret |
+| DB_ROOT_USER | root | The root user, used only by an explicitly enabled database bootstrap |
+| DB_USER | default | The user used by the service (e.g. Drupal) to connect to the database |
### Development Settings
diff --git a/images/base/rootfs/etc/s6-overlay/s6-rc.d/confd/run b/images/base/rootfs/etc/s6-overlay/s6-rc.d/confd/run
index 7c942dd3..79896310 100755
--- a/images/base/rootfs/etc/s6-overlay/s6-rc.d/confd/run
+++ b/images/base/rootfs/etc/s6-overlay/s6-rc.d/confd/run
@@ -2,6 +2,10 @@
# shellcheck shell=bash
set -e
+# This long-running renderer only needs the scoped application environment.
+# Do not retain the database administrator credential after initialization.
+unset DB_ROOT_PASSWORD
+
# Only run the service if explicitly told to do so.
if [[ "${CONFD_ENABLE_SERVICE}" == "true" ]]; then
exec confd-render-templates.sh -- -interval "${CONFD_POLLING_INTERVAL}"
diff --git a/images/base/rootfs/etc/s6-overlay/scripts/container-environment.sh b/images/base/rootfs/etc/s6-overlay/scripts/container-environment.sh
index 94984d63..3bce05ea 100755
--- a/images/base/rootfs/etc/s6-overlay/scripts/container-environment.sh
+++ b/images/base/rootfs/etc/s6-overlay/scripts/container-environment.sh
@@ -1,5 +1,6 @@
#!/usr/bin/env bash
set -e
+umask 077
# Sets container environment variables in order of precedence depending on the
# source:
@@ -63,9 +64,17 @@ fi
# Normalize the container environment through confd's env backend. This can only
# import values that are already defined in the environment.
{
+ # shellcheck disable=SC2016 # Literal Go template; shell expansion is unwanted.
+ printf '%s\n' '{{ define "execlineEscape" -}}{{- $escaped := replace . "\\" "\\\\" -1 -}}{{- replace $escaped "\"" "\\\"" -1 -}}{{- end -}}'
for file in /var/run/s6/container_environment/*; do
VAR=$(basename "${file}")
KEY=$(echo "${VAR}" | tr '[:upper:]' '[:lower:]' | tr '_' '/')
- echo "${VAR}=\"{{ getv \"/${KEY}\" (getenv \"${VAR}\") }}\""
+ echo "${VAR}=\"{{ template \"execlineEscape\" (getv \"/${KEY}\" (getenv \"${VAR}\")) }}\""
done
} | /usr/local/bin/confd-import-environment.sh
+
+# These files can include database administrator and application credentials.
+# Startup scripts run as root and import them before dropping privileges, so
+# they do not need to be readable by application service users.
+chmod 0700 /var/run/s6/container_environment
+find /var/run/s6/container_environment -maxdepth 1 -type f -exec chmod 0600 {} +
diff --git a/images/base/rootfs/etc/s6-overlay/scripts/vault-secrets.sh b/images/base/rootfs/etc/s6-overlay/scripts/vault-secrets.sh
index ef07f8bb..f228381b 100755
--- a/images/base/rootfs/etc/s6-overlay/scripts/vault-secrets.sh
+++ b/images/base/rootfs/etc/s6-overlay/scripts/vault-secrets.sh
@@ -341,7 +341,11 @@ write_secret_file() {
chmod 0400 "${tmp}"
if [[ "$(id -u)" = "0" ]]; then
- chown "${app_uid}:0" "${tmp}"
+ if [[ "${name}" = "DB_ROOT_PASSWORD" ]]; then
+ chown 0:0 "${tmp}"
+ else
+ chown "${app_uid}:0" "${tmp}"
+ fi
fi
mv -f "${tmp}" "${target}"
}
diff --git a/images/base/rootfs/usr/local/bin/cleanup.sh b/images/base/rootfs/usr/local/bin/cleanup.sh
index 27c1a9c7..7557c474 100755
--- a/images/base/rootfs/usr/local/bin/cleanup.sh
+++ b/images/base/rootfs/usr/local/bin/cleanup.sh
@@ -22,36 +22,25 @@ EOF
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "hx" OPTION; do
- case $OPTION in
- h)
+ while (($# > 0)); do
+ case "$1" in
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
+ ;;
+ --)
+ shift
+ if (($# > 0)); then
+ echo "cleanup.sh does not accept positional arguments" >&2
+ exit 1
+ fi
;;
*)
- echo "Invalid Option: $OPTION" >&2
- usage
+ echo "Invalid option or argument: $1" >&2
exit 1
;;
esac
@@ -63,7 +52,9 @@ function cmdline {
function main {
cmdline "${ARGS[@]}"
for file in /etc/cleanup.d/*; do
- $file
+ if [[ -f "${file}" && -x "${file}" ]]; then
+ "${file}"
+ fi
done
}
main
diff --git a/images/base/rootfs/usr/local/bin/confd-import-environment.sh b/images/base/rootfs/usr/local/bin/confd-import-environment.sh
index 7782a049..a06c3ee7 100755
--- a/images/base/rootfs/usr/local/bin/confd-import-environment.sh
+++ b/images/base/rootfs/usr/local/bin/confd-import-environment.sh
@@ -29,36 +29,25 @@ EOF
}
function cmdline() {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "hx" OPTION; do
- case $OPTION in
- h)
+ while (($# > 0)); do
+ case "$1" in
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
+ ;;
+ --)
+ shift
+ if (($# > 0)); then
+ echo "confd-import-environment.sh does not accept positional arguments" >&2
+ exit 1
+ fi
;;
*)
- echo "Invalid Option: $OPTION" >&2
- usage
+ echo "Invalid option or argument: $1" >&2
exit 1
;;
esac
@@ -68,12 +57,12 @@ function cmdline() {
}
function main {
- local tmp_dir
cmdline "${ARGS[@]}"
# Temporary directory to deposit generated confd configuration templates and
# output, etc.
tmp_dir="$(mktemp -d -t confd-XXXXXXXXXX)"
+ trap 'rm -rf -- "${tmp_dir}"' EXIT HUP INT TERM
mkdir -p "${tmp_dir}/conf.d" "${tmp_dir}/templates" "${tmp_dir}/out"
# Generate template script that will update the container environment with
@@ -104,7 +93,5 @@ EOF
# Import the variables from confd.
execlineb -P "${tmp_dir}/import.sh"
- # Remove temporary files.
- rm -fr "${tmp_dir}"
}
main
diff --git a/images/base/rootfs/usr/local/bin/confd-render-templates.sh b/images/base/rootfs/usr/local/bin/confd-render-templates.sh
index 7c8baf0e..902478d7 100755
--- a/images/base/rootfs/usr/local/bin/confd-render-templates.sh
+++ b/images/base/rootfs/usr/local/bin/confd-render-templates.sh
@@ -26,50 +26,31 @@ EOF
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
+ OPTIONS=()
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "hx" OPTION; do
- case $OPTION in
- h)
+ while (($# > 0)); do
+ case "$1" in
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
+ ;;
+ --)
+ shift
+ OPTIONS+=("$@")
+ break
;;
*)
- echo "Invalid Option: $OPTION" >&2
- usage
- exit 1
+ OPTIONS+=("$1")
+ shift
;;
esac
done
- shift $((OPTIND - 1))
-
- # Remaining options to be passed onto the client, preceeded by '--'.
- if [ "$#" -gt 0 ]; then
- readonly OPTIONS=("${@}")
- shift $#
- else
- readonly OPTIONS=()
- fi
+ readonly OPTIONS
return 0
}
diff --git a/images/base/rootfs/usr/local/bin/create-database.sh b/images/base/rootfs/usr/local/bin/create-database.sh
index 0a957259..c62646db 100755
--- a/images/base/rootfs/usr/local/bin/create-database.sh
+++ b/images/base/rootfs/usr/local/bin/create-database.sh
@@ -51,104 +51,95 @@ function fallback {
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --host) args="${args}-b " ;;
- --port) args="${args}-c " ;;
- --user) args="${args}-d " ;;
- --password) args="${args}-e " ;;
- --database) args="${args}-f " ;;
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "b:c:d:e:f:hx" OPTION; do
- case $OPTION in
- b)
- readonly HOST=${OPTARG}
- ;;
- c)
- readonly PORT=${OPTARG}
- ;;
- d)
- readonly USER=${OPTARG}
+ HOST=
+ PORT=
+ USER=
+ PASSWORD=
+ DATABASE_NAME=
+
+ while (($# > 0)); do
+ case "$1" in
+ --host|-b|--port|-c|--user|-d|--password|-e|--database|-f)
+ if (($# < 2)); then
+ echo "Option $1 requires a value" >&2
+ exit 1
+ fi
+ case "$1" in
+ --host|-b) HOST=$2 ;;
+ --port|-c) PORT=$2 ;;
+ --user|-d) USER=$2 ;;
+ --password|-e) PASSWORD=$2 ;;
+ --database|-f) DATABASE_NAME=$2 ;;
+ esac
+ shift 2
;;
- e)
- readonly PASSWORD=${OPTARG}
- ;;
- f)
- readonly DATABASE_NAME=${OPTARG}
- ;;
- h)
+ --host=*) HOST=${1#*=}; shift ;;
+ --port=*) PORT=${1#*=}; shift ;;
+ --user=*) USER=${1#*=}; shift ;;
+ --password=*) PASSWORD=${1#*=}; shift ;;
+ --database=*) DATABASE_NAME=${1#*=}; shift ;;
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
;;
- *)
- echo "Invalid Option: $OPTION" >&2
+ --) shift; break ;;
+ -*)
+ echo "Invalid option: $1" >&2
usage
exit 1
;;
+ *)
+ break
+ ;;
esac
done
if fallback "--database" "DATABASE_NAME" "DB_NAME"; then
- readonly DATABASE_NAME=${DB_NAME}
+ DATABASE_NAME=${DB_NAME}
fi
if fallback "--user" "USER" "DB_ROOT_USER"; then
- readonly USER=${DB_ROOT_USER}
+ USER=${DB_ROOT_USER}
fi
if fallback "--password" "PASSWORD" "DB_ROOT_PASSWORD"; then
- readonly PASSWORD=${DB_ROOT_PASSWORD}
+ PASSWORD=${DB_ROOT_PASSWORD}
fi
if fallback "--host" "HOST" "DB_HOST"; then
- readonly HOST=${DB_HOST}
+ HOST=${DB_HOST}
fi
if fallback "--port" "PORT" "DB_PORT"; then
- readonly PORT=${DB_PORT}
+ PORT=${DB_PORT}
fi
- shift $((OPTIND - 1))
-
# Allow either passing in a file/pipe or reading from stdin by specifiying "-" or
# ommiting completely.
- if [[ -f "${1}" || -p "${1}" ]]; then
- readonly FILE="${1}"
+ if [[ -n "${1:-}" && ( -f "$1" || -p "$1" ) ]]; then
+ FILE=$1
shift
- elif [[ "${1}" == "-" ]]; then
- readonly FILE=/dev/stdin
+ elif [[ "${1:-}" == "-" ]]; then
+ FILE=/dev/stdin
shift
else
- readonly FILE=/dev/stdin
+ FILE=/dev/stdin
fi
+ readonly HOST PORT USER PASSWORD DATABASE_NAME FILE
+
return 0
}
function execute_sql_file {
- execute-sql-file.sh \
+ LIBOPS_DATABASE_PASSWORD="${PASSWORD}" execute-sql-file.sh \
--host "${HOST}" \
--port "${PORT}" \
--user "${USER}" \
- --password "${PASSWORD}" \
"${@}"
}
diff --git a/images/base/rootfs/usr/local/bin/create-service-user.sh b/images/base/rootfs/usr/local/bin/create-service-user.sh
index fe8e39d8..712b9e3f 100755
--- a/images/base/rootfs/usr/local/bin/create-service-user.sh
+++ b/images/base/rootfs/usr/local/bin/create-service-user.sh
@@ -28,58 +28,55 @@ EOF
}
function cmdline() {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --name) args="${args}-n " ;;
- --group) args="${args}-g " ;;
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
+ NAME=
+ GROUP=
+ DIRECTORIES=()
- while getopts "n:g:hx" OPTION; do
- case $OPTION in
- n)
- readonly NAME=${OPTARG}
- ;;
- g)
- readonly GROUP=${OPTARG}
+ while (($# > 0)); do
+ case "$1" in
+ -n|--name|-g|--group)
+ if (($# < 2)); then
+ echo "Option $1 requires a value" >&2
+ exit 1
+ fi
+ case "$1" in
+ -n|--name) NAME=$2 ;;
+ -g|--group) GROUP=$2 ;;
+ esac
+ shift 2
;;
- h)
+ --name=*) NAME=${1#*=}; shift ;;
+ --group=*) GROUP=${1#*=}; shift ;;
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
;;
- *)
- echo "Invalid Option: $OPTION" >&2
- usage
+ --)
+ shift
+ DIRECTORIES+=("$@")
+ break
+ ;;
+ -*)
+ echo "Invalid option: $1" >&2
exit 1
;;
+ *)
+ DIRECTORIES+=("$1")
+ shift
+ ;;
esac
done
- if [[ ! -v NAME ]]; then
+ if [[ -z ${NAME} ]]; then
echo "Missing one or more required options: --name" >&2
exit 1
fi
- # All remaning parameters are directories to be created.
- shift $((OPTIND - 1))
- DIRECTORIES=("$@")
- readonly DIRECTORIES
+ readonly NAME GROUP DIRECTORIES
return 0
}
@@ -104,7 +101,7 @@ function main {
addgroup "${user}" tty
fi
# Optional secondary group.
- if [[ -v GROUP ]]; then
+ if [[ -n "${GROUP}" ]]; then
if ! id -nG "${user}" | tr ' ' '\n' | grep -qx "${GROUP}"; then
addgroup "${NAME}" "${GROUP}"
fi
diff --git a/images/base/rootfs/usr/local/bin/download.sh b/images/base/rootfs/usr/local/bin/download.sh
index 413a1bed..f6a5317a 100755
--- a/images/base/rootfs/usr/local/bin/download.sh
+++ b/images/base/rootfs/usr/local/bin/download.sh
@@ -34,73 +34,73 @@ EOF
}
function cmdline {
- local arg=
- local args=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --url) args="${args}-u " ;;
- --sha256) args="${args}-c " ;;
- --dest) args="${args}-d " ;;
- --strip) args="${args}-s " ;;
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "u:c:d:shx" OPTION; do
- case $OPTION in
- u)
- readonly URL=${OPTARG}
- ;;
- c)
- readonly CHECKSUM=${OPTARG}
+ URL=
+ CHECKSUM=
+ DEST=
+ STRIP=false
+ REMOVE=()
+
+ while (($# > 0)); do
+ case "$1" in
+ -u|--url|-c|--sha256|-d|--dest)
+ if (($# < 2)); then
+ echo "Option $1 requires a value" >&2
+ exit 1
+ fi
+ case "$1" in
+ -u|--url) URL=$2 ;;
+ -c|--sha256) CHECKSUM=$2 ;;
+ -d|--dest) DEST=$2 ;;
+ esac
+ shift 2
;;
- d)
- readonly DEST=${OPTARG}
+ --url=*) URL=${1#*=}; shift ;;
+ --sha256=*) CHECKSUM=${1#*=}; shift ;;
+ --dest=*) DEST=${1#*=}; shift ;;
+ -s|--strip)
+ STRIP=true
+ shift
;;
- s)
- readonly STRIP=true
- ;;
- h)
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
;;
- *)
- echo "Invalid Option: $OPTION" >&2
- usage
+ --)
+ shift
+ REMOVE+=("$@")
+ break
+ ;;
+ -*)
+ echo "Invalid option: $1" >&2
exit 1
;;
+ *)
+ REMOVE+=("$1")
+ shift
+ ;;
esac
done
- if [[ -z $URL || -z $CHECKSUM ]]; then
- echo "Missing one or more required options: --url --sha256"
+ if [[ -z ${URL} || -z ${CHECKSUM} ]]; then
+ echo "Missing one or more required options: --url --sha256" >&2
exit 1
fi
- # All remaning parameters are files to be removed from the installation.
- shift $((OPTIND-1))
- readonly REMOVE=("$@")
+ readonly URL CHECKSUM DEST STRIP REMOVE
return 0
}
function validate {
local file=${1}
- sha256sum "${file}" | cut -f1 -d' ' | xargs test "${CHECKSUM}" ==
+ local actual
+ actual=$(sha256sum <"${file}")
+ actual=${actual%% *}
+ [[ "${actual}" == "${CHECKSUM}" ]]
}
function unpack {
@@ -109,7 +109,7 @@ function unpack {
local args=()
local filename=
mkdir -p "${dest}"
- if [[ -v STRIP ]]; then
+ if [[ "${STRIP}" == "true" ]]; then
args+=("--strip-components" "1")
fi
filename=$(basename "${file}")
@@ -124,15 +124,22 @@ function unpack {
gunzip "${file}" -f -c > "${dest}/${filename%.*}"
;;
*.zip | *.war)
- if [[ -v STRIP ]]; then
- mkdir -p /tmp/unpack
- unzip "${file}" -d /tmp/unpack
- local unpack_root
- unpack_root="$(find /tmp/unpack/ -type d -mindepth 1 -maxdepth 1)"
- shopt -s dotglob nullglob
- mv "${unpack_root}"/* "${dest}"
- shopt -u dotglob nullglob
- rm -fr /tmp/unpack
+ if [[ "${STRIP}" == "true" ]]; then
+ (
+ local unpack_dir unpack_root
+ local top_level=()
+ unpack_dir=$(mktemp -d -t download-unpack.XXXXXXXXXX)
+ trap 'rm -rf -- "${unpack_dir}"' EXIT HUP INT TERM
+ unzip "${file}" -d "${unpack_dir}"
+ mapfile -d '' top_level < <(find "${unpack_dir}" -mindepth 1 -maxdepth 1 -print0)
+ if ((${#top_level[@]} != 1)) || [[ ! -d "${top_level[0]}" ]]; then
+ echo "ZIP strip requires exactly one top-level directory: ${file}" >&2
+ exit 1
+ fi
+ unpack_root=${top_level[0]}
+ shopt -s dotglob nullglob
+ mv "${unpack_root}"/* "${dest}"
+ )
else
unzip "${file}" -d "${dest}"
fi
@@ -163,8 +170,11 @@ function main {
wget -N -P "${DOWNLOAD_CACHE_DIRECTORY}" "${URL}"
# Return non-zero if the checksum does not match the downloaded file.
validate "${file}"
- if [[ -v DEST ]]; then
+ if [[ -n "${DEST}" ]]; then
unpack "${file}" "${DEST}"
fi
}
-main
+
+if [[ "${DOWNLOAD_LIBRARY_ONLY:-false}" != "true" ]]; then
+ main
+fi
diff --git a/images/base/rootfs/usr/local/bin/execute-sql-file.sh b/images/base/rootfs/usr/local/bin/execute-sql-file.sh
index dc7dcad2..3e19b479 100755
--- a/images/base/rootfs/usr/local/bin/execute-sql-file.sh
+++ b/images/base/rootfs/usr/local/bin/execute-sql-file.sh
@@ -4,6 +4,12 @@ ARGS=("$@")
PROGNAME=$(basename "$0")
readonly ARGS PROGNAME
+# shellcheck source=images/base/rootfs/usr/local/share/libops/database.sh
+source "${LIBOPS_DATABASE_LIBRARY:-/usr/local/share/libops/database.sh}"
+
+CLIENT_DEFAULTS_FILE=
+REMOVE_CLIENT_DEFAULTS_FILE=false
+
function usage {
cat <<-EOF
usage: $PROGNAME options FILE
@@ -23,6 +29,7 @@ function usage {
--port The database port.
--user The user to connect as.
--password The password to use for the user.
+ --defaults-extra-file Existing MariaDB client option file containing the password.
--database The database to run the sql command against. (Optional)
-h --help Show this help.
-x --debug Debug this script.
@@ -54,58 +61,54 @@ function fallback {
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --host) args="${args}-b " ;;
- --port) args="${args}-c " ;;
- --user) args="${args}-d " ;;
- --password) args="${args}-e " ;;
- --database) args="${args}-f " ;;
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
+ HOST=
+ PORT=
+ USER=
+ PASSWORD=
+ DATABASE=
+ DEFAULTS_EXTRA_FILE=
+
+ while (($# > 0)); do
+ case "$1" in
+ --host|-b|--port|-c|--user|-d|--password|-e|--database|-f|--defaults-extra-file)
+ if (($# < 2)); then
+ echo "Option $1 requires a value" >&2
+ exit 1
+ fi
+ case "$1" in
+ --host|-b) HOST=$2 ;;
+ --port|-c) PORT=$2 ;;
+ --user|-d) USER=$2 ;;
+ --password|-e) PASSWORD=$2 ;;
+ --database|-f) DATABASE=$2 ;;
+ --defaults-extra-file) DEFAULTS_EXTRA_FILE=$2 ;;
+ esac
+ shift 2
;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "b:c:d:e:f:hx" OPTION; do
- case $OPTION in
- b)
- HOST=${OPTARG}
- ;;
- c)
- PORT=${OPTARG}
- ;;
- d)
- USER=${OPTARG}
- ;;
- e)
- PASSWORD=${OPTARG}
- ;;
- f)
- DATABASE=${OPTARG}
- ;;
- h)
+ --host=*) HOST=${1#*=}; shift ;;
+ --port=*) PORT=${1#*=}; shift ;;
+ --user=*) USER=${1#*=}; shift ;;
+ --password=*) PASSWORD=${1#*=}; shift ;;
+ --database=*) DATABASE=${1#*=}; shift ;;
+ --defaults-extra-file=*) DEFAULTS_EXTRA_FILE=${1#*=}; shift ;;
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
;;
- *)
- echo "Invalid Option: $OPTION" >&2
+ --) shift; break ;;
+ -) break ;;
+ -*)
+ echo "Invalid option: $1" >&2
usage
exit 1
;;
+ *)
+ break
+ ;;
esac
done
@@ -113,7 +116,9 @@ function cmdline {
USER=${DB_ROOT_USER}
fi
- if fallback "--password" "PASSWORD" "DB_ROOT_PASSWORD"; then
+ if [[ -z "${PASSWORD}" && -n "${LIBOPS_DATABASE_PASSWORD:-}" ]]; then
+ PASSWORD=${LIBOPS_DATABASE_PASSWORD}
+ elif [[ -z "${PASSWORD}" && -z "${DEFAULTS_EXTRA_FILE}" ]] && fallback "--password" "PASSWORD" "DB_ROOT_PASSWORD"; then
PASSWORD=${DB_ROOT_PASSWORD}
fi
@@ -125,14 +130,12 @@ function cmdline {
PORT=${DB_PORT}
fi
- shift $((OPTIND - 1))
-
# Allow either passing in a file or reading from stdin by specifiying "-" or
# ommiting completely.
- if [[ -f "${1}" || -p "${1}" ]]; then
- FILE="${1}"
+ if [[ -n "${1:-}" && ( -f "$1" || -p "$1" ) ]]; then
+ FILE=$1
shift
- elif [[ "${1}" == "-" ]]; then
+ elif [[ "${1:-}" == "-" ]]; then
FILE=/dev/stdin
shift
else
@@ -140,7 +143,7 @@ function cmdline {
fi
# Remaining options to be passed onto the client, preceeded by '--'.
- if [[ "${1}" == "--" ]]; then
+ if [[ "${1:-}" == "--" ]]; then
shift
fi
@@ -151,7 +154,12 @@ function cmdline {
OPTIONS=()
fi
- readonly HOST PORT USER PASSWORD DATABASE FILE OPTIONS
+ if [[ -n "${DEFAULTS_EXTRA_FILE}" && ! -r "${DEFAULTS_EXTRA_FILE}" ]]; then
+ echo "MariaDB client option file is not readable: ${DEFAULTS_EXTRA_FILE}" >&2
+ exit 1
+ fi
+
+ readonly HOST PORT USER PASSWORD DATABASE DEFAULTS_EXTRA_FILE FILE OPTIONS
return 0
}
@@ -163,33 +171,52 @@ function wait_for_access {
--host "${HOST}" \
--port "${PORT}" \
--user "${USER}" \
- --password "${PASSWORD}" >&2
+ --defaults-extra-file "${CLIENT_DEFAULTS_FILE}" >&2
}
function mysql_execute_sql_file {
- local database_arg=
+ local database_args=()
if [[ -n "${DATABASE}" ]]; then
- database_arg="--database=${DATABASE}"
+ database_args+=("--database=${DATABASE}")
fi
mariadb \
+ --defaults-extra-file="${CLIENT_DEFAULTS_FILE}" \
--host="${HOST}" \
--port="${PORT}" \
--user="${USER}" \
- --password="${PASSWORD}" \
--protocol=tcp \
- "${database_arg}" \
+ "${database_args[@]}" \
"${OPTIONS[@]}" \
<"${FILE}"
}
+function prepare_client_defaults_file {
+ if [[ -n "${DEFAULTS_EXTRA_FILE}" ]]; then
+ CLIENT_DEFAULTS_FILE=${DEFAULTS_EXTRA_FILE}
+ return 0
+ fi
+
+ CLIENT_DEFAULTS_FILE=$(mktemp -t mariadb-client.XXXXXXXXXX)
+ database_write_client_defaults_file "${CLIENT_DEFAULTS_FILE}" "${PASSWORD}"
+ REMOVE_CLIENT_DEFAULTS_FILE=true
+}
+
+function cleanup_client_defaults_file {
+ if [[ "${REMOVE_CLIENT_DEFAULTS_FILE}" = "true" && -n "${CLIENT_DEFAULTS_FILE}" ]]; then
+ rm -f -- "${CLIENT_DEFAULTS_FILE}"
+ fi
+}
+
function execute_sql_file {
mysql_execute_sql_file
}
function main {
cmdline "${ARGS[@]}"
+ prepare_client_defaults_file
+ trap cleanup_client_defaults_file EXIT
wait_for_access
execute_sql_file
}
diff --git a/images/base/rootfs/usr/local/bin/render-database-bootstrap-sql.sh b/images/base/rootfs/usr/local/bin/render-database-bootstrap-sql.sh
new file mode 100755
index 00000000..0a1aaf8d
--- /dev/null
+++ b/images/base/rootfs/usr/local/bin/render-database-bootstrap-sql.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# shellcheck source=images/base/rootfs/usr/local/share/libops/database.sh
+source "${LIBOPS_DATABASE_LIBRARY:-/usr/local/share/libops/database.sh}"
+
+: "${DB_NAME:?DB_NAME is required}"
+: "${DB_USER:?DB_USER is required}"
+: "${DB_PASSWORD:?DB_PASSWORD is required}"
+
+DB_CHARACTER_SET=${DB_CHARACTER_SET:-utf8mb4}
+DB_COLLATION=${DB_COLLATION:-utf8mb4_unicode_ci}
+
+database_validate_identifier DB_NAME "${DB_NAME}"
+database_validate_identifier DB_USER "${DB_USER}"
+database_validate_identifier DB_CHARACTER_SET "${DB_CHARACTER_SET}"
+database_validate_identifier DB_COLLATION "${DB_COLLATION}"
+
+db_user_sql=$(database_escape_sql_literal "${DB_USER}")
+db_password_sql=$(database_escape_sql_literal "${DB_PASSWORD}")
+
+cat <<-SQL
+CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\` CHARACTER SET ${DB_CHARACTER_SET} COLLATE ${DB_COLLATION};
+CREATE USER IF NOT EXISTS '${db_user_sql}'@'%' IDENTIFIED BY '${db_password_sql}';
+GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${db_user_sql}'@'%';
+SET PASSWORD FOR '${db_user_sql}'@'%' = PASSWORD('${db_password_sql}');
+FLUSH PRIVILEGES;
+SQL
diff --git a/images/base/rootfs/usr/local/bin/wait-for-database.sh b/images/base/rootfs/usr/local/bin/wait-for-database.sh
index 70120f14..353c1c91 100755
--- a/images/base/rootfs/usr/local/bin/wait-for-database.sh
+++ b/images/base/rootfs/usr/local/bin/wait-for-database.sh
@@ -5,6 +5,12 @@ ARGS=("$@")
PROGNAME=$(basename "$0")
readonly ARGS PROGNAME
+# shellcheck source=images/base/rootfs/usr/local/share/libops/database.sh
+source "${LIBOPS_DATABASE_LIBRARY:-/usr/local/share/libops/database.sh}"
+
+CLIENT_DEFAULTS_FILE=
+REMOVE_CLIENT_DEFAULTS_FILE=false
+
function usage {
cat <<-EOF
usage: $PROGNAME options
@@ -19,6 +25,7 @@ function usage {
--port The database port.
--user The user to connect as.
--password The password to use for the user.
+ --defaults-extra-file Existing MariaDB client option file containing the password.
--timeout Time to wait for a connection to the database, defaults to 5 minutes. (Optional)
-h --help Show this help.
-x --debug Debug this script.
@@ -34,77 +41,89 @@ EOF
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --host) args="${args}-b " ;;
- --port) args="${args}-c " ;;
- --user) args="${args}-d " ;;
- --password) args="${args}-e " ;;
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "b:c:d:e:hx" OPTION; do
- case $OPTION in
- b)
- readonly HOST=${OPTARG}
+ HOST=
+ PORT=
+ USER=
+ PASSWORD=
+ DEFAULTS_EXTRA_FILE=
+ TIMEOUT=300
+
+ while (($# > 0)); do
+ case "$1" in
+ --host|-b|--port|-c|--user|-d|--password|-e|--timeout|-t|--defaults-extra-file)
+ if (($# < 2)); then
+ echo "Option $1 requires a value" >&2
+ exit 1
+ fi
+ case "$1" in
+ --host|-b) HOST=$2 ;;
+ --port|-c) PORT=$2 ;;
+ --user|-d) USER=$2 ;;
+ --password|-e) PASSWORD=$2 ;;
+ --timeout|-t) TIMEOUT=$2 ;;
+ --defaults-extra-file) DEFAULTS_EXTRA_FILE=$2 ;;
+ esac
+ shift 2
;;
- c)
- readonly PORT=${OPTARG}
- ;;
- d)
- readonly USER=${OPTARG}
- ;;
- e)
- readonly PASSWORD=${OPTARG}
- ;;
- h)
+ --host=*) HOST=${1#*=}; shift ;;
+ --port=*) PORT=${1#*=}; shift ;;
+ --user=*) USER=${1#*=}; shift ;;
+ --password=*) PASSWORD=${1#*=}; shift ;;
+ --timeout=*) TIMEOUT=${1#*=}; shift ;;
+ --defaults-extra-file=*) DEFAULTS_EXTRA_FILE=${1#*=}; shift ;;
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
;;
- *)
- echo "Invalid Option: $OPTION" >&2
+ --) shift; break ;;
+ -*)
+ echo "Invalid option: $1" >&2
usage
exit 1
;;
+ *)
+ break
+ ;;
esac
done
- if [[ -z $HOST || -z $PORT || -z $USER || -z $PASSWORD ]]; then
- echo "Missing one of required options: --host --port --user --password" >&2
+ if [[ -z "${PASSWORD}" && -n "${LIBOPS_DATABASE_PASSWORD:-}" ]]; then
+ PASSWORD=${LIBOPS_DATABASE_PASSWORD}
+ elif [[ -z "${PASSWORD}" && -n "${DB_ROOT_PASSWORD:-}" ]]; then
+ PASSWORD=${DB_ROOT_PASSWORD}
+ fi
+
+ if [[ -z $HOST || -z $PORT || -z $USER || ( -z $PASSWORD && -z $DEFAULTS_EXTRA_FILE ) ]]; then
+ echo "Missing one of required options: --host --port --user and --password/--defaults-extra-file" >&2
+ exit 1
+ fi
+
+ if [[ -n "${DEFAULTS_EXTRA_FILE}" && ! -r "${DEFAULTS_EXTRA_FILE}" ]]; then
+ echo "MariaDB client option file is not readable: ${DEFAULTS_EXTRA_FILE}" >&2
exit 1
fi
+ readonly HOST PORT USER PASSWORD DEFAULTS_EXTRA_FILE TIMEOUT
+
return 0
}
function wait_for_connection {
- local duration=${TIMEOUT:-300}
+ local duration=${TIMEOUT}
echo "Waiting for up to ${duration} seconds to connect to Database ${HOST}:${PORT}" >&2
timeout "${duration}" wait-for-open-port.sh "${HOST}" "${PORT}"
}
function mysql_validate_credentials {
mariadb \
+ --defaults-extra-file="${CLIENT_DEFAULTS_FILE}" \
--batch \
--skip-column-names \
--user="${USER}" \
- --password="${PASSWORD}" \
--host="${HOST}" \
--port="${PORT}" \
--protocol=tcp \
@@ -112,6 +131,23 @@ function mysql_validate_credentials {
>/dev/null
}
+function prepare_client_defaults_file {
+ if [[ -n "${DEFAULTS_EXTRA_FILE}" ]]; then
+ CLIENT_DEFAULTS_FILE=${DEFAULTS_EXTRA_FILE}
+ return 0
+ fi
+
+ CLIENT_DEFAULTS_FILE=$(mktemp -t mariadb-client.XXXXXXXXXX)
+ database_write_client_defaults_file "${CLIENT_DEFAULTS_FILE}" "${PASSWORD}"
+ REMOVE_CLIENT_DEFAULTS_FILE=true
+}
+
+function cleanup_client_defaults_file {
+ if [[ "${REMOVE_CLIENT_DEFAULTS_FILE}" = "true" && -n "${CLIENT_DEFAULTS_FILE}" ]]; then
+ rm -f -- "${CLIENT_DEFAULTS_FILE}"
+ fi
+}
+
function validate_credentials {
echo "Validating Database credentials" >&2
mysql_validate_credentials
@@ -119,20 +155,22 @@ function validate_credentials {
function main {
cmdline "${ARGS[@]}"
+ prepare_client_defaults_file
+ trap cleanup_client_defaults_file EXIT
if wait_for_connection; then
echo "Database found" >&2
else
echo "Timed out waiting for database connection" >&2
- exit 1
+ return 1
fi
if validate_credentials; then
echo "Credentials are valid" >&2
- exit 0
+ return 0
else
echo "Credentials are invalid" >&2
- exit 1
+ return 1
fi
}
main
diff --git a/images/base/rootfs/usr/local/bin/wait-for-open-port.sh b/images/base/rootfs/usr/local/bin/wait-for-open-port.sh
index ee427c55..26c32b76 100755
--- a/images/base/rootfs/usr/local/bin/wait-for-open-port.sh
+++ b/images/base/rootfs/usr/local/bin/wait-for-open-port.sh
@@ -24,52 +24,43 @@ EOF
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
+ local positional=()
- while getopts "hx" OPTION; do
- case $OPTION in
- h)
+ while (($# > 0)); do
+ case "$1" in
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
;;
- *)
- echo "Invalid Option: $OPTION" >&2
- usage
+ --)
+ shift
+ positional+=("$@")
+ break
+ ;;
+ -*)
+ echo "Invalid option: $1" >&2
exit 1
;;
+ *)
+ positional+=("$1")
+ shift
+ ;;
esac
done
- shift $((OPTIND - 1))
-
- if [ "$#" -ne 2 ]; then
+ if [ "${#positional[@]}" -ne 2 ]; then
echo "Illegal number of parameters" >&2
usage
return 1
fi
- readonly HOST=${1}
- shift
- readonly PORT=${1}
+ HOST=${positional[0]}
+ PORT=${positional[1]}
+ readonly HOST PORT
return 0
}
diff --git a/images/base/rootfs/usr/local/share/libops/database.sh b/images/base/rootfs/usr/local/share/libops/database.sh
new file mode 100755
index 00000000..b4f0e52f
--- /dev/null
+++ b/images/base/rootfs/usr/local/share/libops/database.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+
+function database_validate_identifier {
+ local name=$1
+ local value=$2
+
+ if [[ ! "${value}" =~ ^[A-Za-z0-9_]+$ ]]; then
+ echo "${name} must contain only letters, numbers, and underscores" >&2
+ return 1
+ fi
+}
+
+function database_escape_sql_literal {
+ local value=$1
+
+ value=${value//\\/\\\\}
+ value=${value//\'/\'\'}
+ printf '%s' "${value}"
+}
+
+function database_escape_option_file_value {
+ local value=$1
+
+ value=${value//\\/\\\\}
+ value=${value//$'\n'/\\n}
+ value=${value//$'\r'/\\r}
+ value=${value//$'\t'/\\t}
+ value=${value//\"/\\\"}
+ printf '%s' "${value}"
+}
+
+function database_write_client_defaults_file {
+ local file=$1
+ local password=$2
+ local password_escaped
+
+ password_escaped=$(database_escape_option_file_value "${password}")
+ (
+ umask 077
+ printf '[client]\npassword="%s"\n' "${password_escaped}" >"${file}"
+ chmod 0600 "${file}"
+ )
+}
+
+function database_mariadb_with_password {
+ local password=$1
+ shift
+
+ (
+ local client_defaults_file
+ client_defaults_file=$(mktemp -t mariadb-client.XXXXXXXXXX)
+ trap 'rm -f -- "${client_defaults_file}"' EXIT
+ database_write_client_defaults_file "${client_defaults_file}" "${password}"
+ command mariadb --defaults-extra-file="${client_defaults_file}" "$@"
+ )
+}
+
+function database_require_root_credentials {
+ if [ -z "${DB_ROOT_USER:-}" ]; then
+ echo "DB_ROOT_USER must not be empty" >&2
+ return 1
+ fi
+ if [ -z "${DB_ROOT_PASSWORD:-}" ]; then
+ echo "DB_ROOT_PASSWORD must not be empty" >&2
+ return 1
+ fi
+}
+
+# Return 0 when application-side database bootstrap was explicitly enabled,
+# 1 when it is disabled, and 2 for an unsafe or invalid configuration.
+function database_bootstrap_enabled {
+ case "${DB_BOOTSTRAP_ENABLED:-false}" in
+ 1 | [Tt][Rr][Uu][Ee] | [Yy][Ee][Ss] | [Oo][Nn])
+ if ! database_require_root_credentials; then
+ echo "Root credentials are required when DB_BOOTSTRAP_ENABLED=true" >&2
+ return 2
+ fi
+ return 0
+ ;;
+ '' | 0 | [Ff][Aa][Ll][Ss][Ee] | [Nn][Oo] | [Oo][Ff][Ff])
+ return 1
+ ;;
+ *)
+ echo "DB_BOOTSTRAP_ENABLED must be true or false" >&2
+ return 2
+ ;;
+ esac
+}
+
+function database_bootstrap_if_enabled {
+ local status=0
+
+ database_bootstrap_enabled || status=$?
+ case "${status}" in
+ 0)
+ "$@"
+ ;;
+ 1)
+ return 0
+ ;;
+ *)
+ return "${status}"
+ ;;
+ esac
+}
diff --git a/images/base/rootfs/usr/local/share/libops/environment.sh b/images/base/rootfs/usr/local/share/libops/environment.sh
new file mode 100755
index 00000000..d5505902
--- /dev/null
+++ b/images/base/rootfs/usr/local/share/libops/environment.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+
+function require_environment_variables {
+ local name value missing=false
+
+ for name in "$@"; do
+ value=${!name-}
+ if [ -z "${value}" ]; then
+ echo "${name} must not be empty" >&2
+ missing=true
+ fi
+ done
+ if [ "${missing}" = "true" ]; then
+ return 1
+ fi
+}
diff --git a/images/base/tests/DatabaseHelperArgumentSafety/docker-compose.yml b/images/base/tests/DatabaseHelperArgumentSafety/docker-compose.yml
new file mode 100644
index 00000000..581a6f2b
--- /dev/null
+++ b/images/base/tests/DatabaseHelperArgumentSafety/docker-compose.yml
@@ -0,0 +1,9 @@
+---
+name: base-databasehelperargumentsafety
+services:
+ base:
+ image: ${BASE:-libops/base:local}
+ volumes:
+ - ./test.sh:/test.sh:ro
+ command:
+ - /test.sh
diff --git a/images/base/tests/DatabaseHelperArgumentSafety/test.sh b/images/base/tests/DatabaseHelperArgumentSafety/test.sh
new file mode 100755
index 00000000..76fd5b48
--- /dev/null
+++ b/images/base/tests/DatabaseHelperArgumentSafety/test.sh
@@ -0,0 +1,239 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+set -euo pipefail
+
+stub_dir="$(mktemp -d)"
+capture="$(mktemp)"
+marker=/tmp/database-helper-injected
+# shellcheck disable=SC2016 # Literal command substitution is an injection payload.
+password='space "$(touch /tmp/database-helper-injected)" quote'"'"' semicolon; back\slash end'
+
+cleanup() {
+ rm -rf "${stub_dir}" "${capture}" "${marker}"
+}
+trap cleanup EXIT
+
+cat >"${stub_dir}/mariadb" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+for argument in "$@"; do
+ if [[ "${argument}" == --password* ]]; then
+ echo "Password was exposed in MariaDB argv" >&2
+ exit 1
+ fi
+ if [[ "${argument}" == --defaults-extra-file=* ]]; then
+ defaults_file=${argument#*=}
+ test -r "${defaults_file}"
+ test "$(stat -c '%a' "${defaults_file}")" = 600
+ fi
+done
+printf '%s\n' "$@" >>"${DATABASE_HELPER_CAPTURE:?}"
+EOF
+
+cat >"${stub_dir}/wait-for-open-port.sh" <<'EOF'
+#!/usr/bin/env bash
+exit 0
+EOF
+
+cat >"${stub_dir}/wget" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+destination=
+url=${!#}
+while (($# > 0)); do
+ case "$1" in
+ -P) destination=$2; shift 2 ;;
+ *) shift ;;
+ esac
+done
+printf '%s' "${url}" >"${DOWNLOAD_ARGUMENT_CAPTURE:?}"
+mkdir -p "${destination}"
+: >"${destination}/$(basename "${url}")"
+EOF
+
+cat >"${stub_dir}/nc" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$@" >"${PORT_ARGUMENT_CAPTURE:?}"
+EOF
+
+cat >"${stub_dir}/confd" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$@" >"${CONFD_ARGUMENT_CAPTURE:?}"
+EOF
+
+chmod +x "${stub_dir}/mariadb" "${stub_dir}/wait-for-open-port.sh" \
+ "${stub_dir}/wget" "${stub_dir}/nc" "${stub_dir}/confd"
+export DATABASE_HELPER_CAPTURE="${capture}"
+export PATH="${stub_dir}:${PATH}"
+export LIBOPS_DATABASE_LIBRARY=${LIBOPS_DATABASE_LIBRARY:-/usr/local/share/libops/database.sh}
+export LIBOPS_BIN_DIRECTORY=${LIBOPS_BIN_DIRECTORY:-/usr/local/bin}
+# shellcheck disable=SC1090
+source "${LIBOPS_DATABASE_LIBRARY}"
+# shellcheck disable=SC1090
+source "${LIBOPS_ENVIRONMENT_LIBRARY:-/usr/local/share/libops/environment.sh}"
+
+client_defaults_file=$(mktemp)
+database_write_client_defaults_file "${client_defaults_file}" "${password}"
+test "$(stat -c '%a' "${client_defaults_file}")" = 600
+expected_client_defaults=$(cat <<'EOF'
+[client]
+password="space \"$(touch /tmp/database-helper-injected)\" quote' semicolon; back\\slash end"
+EOF
+)
+test "$(cat "${client_defaults_file}")" = "${expected_client_defaults}"
+rm -f "${client_defaults_file}"
+
+if REQUIRED_TEST_VALUE='' require_environment_variables REQUIRED_TEST_VALUE 2>/dev/null; then
+ echo "Empty required environment value was accepted" >&2
+ exit 1
+fi
+REQUIRED_TEST_VALUE=present require_environment_variables REQUIRED_TEST_VALUE
+
+if DB_ROOT_USER=root DB_ROOT_PASSWORD='' database_require_root_credentials 2>/dev/null; then
+ echo "Empty database root password was accepted" >&2
+ exit 1
+fi
+if DB_ROOT_USER='' DB_ROOT_PASSWORD=root database_require_root_credentials 2>/dev/null; then
+ echo "Empty database root user was accepted" >&2
+ exit 1
+fi
+
+bootstrap_marker="${stub_dir}/bootstrap-called"
+export DB_ROOT_USER=root
+record_bootstrap() {
+ touch "${bootstrap_marker}"
+}
+
+DB_BOOTSTRAP_ENABLED=false \
+ DB_ROOT_PASSWORD=password \
+ database_bootstrap_if_enabled record_bootstrap
+test ! -e "${bootstrap_marker}"
+
+if DB_BOOTSTRAP_ENABLED=true \
+ DB_ROOT_PASSWORD='' \
+ database_bootstrap_if_enabled record_bootstrap 2>/dev/null; then
+ echo "Database bootstrap accepted an empty root password" >&2
+ exit 1
+fi
+test ! -e "${bootstrap_marker}"
+
+if DB_BOOTSTRAP_ENABLED=invalid \
+ DB_ROOT_PASSWORD=root \
+ database_bootstrap_if_enabled record_bootstrap 2>/dev/null; then
+ echo "Database bootstrap accepted an invalid enable flag" >&2
+ exit 1
+fi
+test ! -e "${bootstrap_marker}"
+
+DB_BOOTSTRAP_ENABLED=true \
+ DB_ROOT_PASSWORD=root \
+ database_bootstrap_if_enabled record_bootstrap
+test -e "${bootstrap_marker}"
+rm "${bootstrap_marker}"
+
+# shellcheck disable=SC2016 # Literal command substitution is an injection payload.
+malicious_argument='space "$(touch /tmp/database-helper-injected)" quote'"'"' and back\slash'
+download_capture="${stub_dir}/download-argument"
+port_capture="${stub_dir}/port-argument"
+confd_capture="${stub_dir}/confd-argument"
+export DOWNLOAD_ARGUMENT_CAPTURE="${download_capture}"
+export PORT_ARGUMENT_CAPTURE="${port_capture}"
+export CONFD_ARGUMENT_CAPTURE="${confd_capture}"
+
+DOWNLOAD_CACHE_DIRECTORY="${stub_dir}/downloads" \
+ download.sh \
+ --url "https://example.invalid/${malicious_argument}" \
+ --sha256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+test "$(cat "${download_capture}")" = "https://example.invalid/${malicious_argument}"
+
+"${LIBOPS_BIN_DIRECTORY}/wait-for-open-port.sh" "${malicious_argument}" "33 06"
+mapfile -t port_args <"${port_capture}"
+test "${port_args[2]}" = "${malicious_argument}"
+test "${port_args[3]}" = "33 06"
+
+CONFD_LOG_LEVEL=error confd-render-templates.sh -- -config-file "${malicious_argument}"
+mapfile -t confd_args <"${confd_capture}"
+test "${confd_args[5]}" = "${malicious_argument}"
+
+for helper in create-service-user.sh cleanup.sh confd-import-environment.sh; do
+ "${helper}" --help "${malicious_argument}" >/dev/null
+done
+test ! -e "${marker}"
+
+sql=$(
+ DB_NAME="database_name" \
+ DB_USER="database_user" \
+ DB_PASSWORD="${password}" \
+ render-database-bootstrap-sql.sh
+)
+expected_sql=$(cat <<'EOF'
+CREATE DATABASE IF NOT EXISTS `database_name` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+CREATE USER IF NOT EXISTS 'database_user'@'%' IDENTIFIED BY 'space "$(touch /tmp/database-helper-injected)" quote'' semicolon; back\\slash end';
+GRANT ALL PRIVILEGES ON `database_name`.* TO 'database_user'@'%';
+SET PASSWORD FOR 'database_user'@'%' = PASSWORD('space "$(touch /tmp/database-helper-injected)" quote'' semicolon; back\\slash end');
+FLUSH PRIVILEGES;
+EOF
+)
+test "${sql}" = "${expected_sql}"
+
+if DB_NAME="invalid-name" \
+ DB_USER="database_user" \
+ DB_PASSWORD="${password}" \
+ render-database-bootstrap-sql.sh >/dev/null 2>&1; then
+ echo "Invalid database identifier was accepted" >&2
+ exit 1
+fi
+
+wait-for-database.sh \
+ --host "database host" \
+ --port 3306 \
+ --user "database user" \
+ --password "${password}" \
+ --timeout 1
+
+grep -Fqx -- "--host=database host" "${capture}"
+grep -Fqx -- "--user=database user" "${capture}"
+if grep -Eq '^--password(=|$)' "${capture}"; then
+ echo "Database password was exposed in client argv" >&2
+ exit 1
+fi
+
+printf 'SELECT 1;\n' | execute-sql-file.sh \
+ --host "database host" \
+ --port 3306 \
+ --user "database user" \
+ --password "${password}" \
+ --database "database name" \
+ -- - --skip-column-names
+
+grep -Fqx -- "--database=database name" "${capture}"
+grep -Fqx -- "--skip-column-names" "${capture}"
+
+# A lone dash is also the documented FILE argument and must not be rejected as
+# an unknown option when callers do not use an option delimiter before it.
+printf 'SELECT 1;\n' | execute-sql-file.sh \
+ --host "database host" \
+ --port 3306 \
+ --user "database user" \
+ --password "${password}" \
+ --database "database name" \
+ - -- --batch
+
+grep -Fqx -- "--batch" "${capture}"
+
+printf 'SELECT 1;\n' | \
+ DB_HOST="database host" \
+ DB_PORT=3306 \
+ DB_NAME="database name" \
+ DB_ROOT_USER="database user" \
+ DB_ROOT_PASSWORD="${password}" \
+ create-database.sh
+
+if grep -Eq '^--password(=|$)' "${capture}"; then
+ echo "Database password was exposed in client argv" >&2
+ exit 1
+fi
+test ! -e "${marker}"
diff --git a/images/base/tests/EnvironmentPrecedence/secrets/DB_PASSWORD b/images/base/tests/EnvironmentPrecedence/secrets/DB_PASSWORD
index ab0bcb16..1fe4d989 100644
--- a/images/base/tests/EnvironmentPrecedence/secrets/DB_PASSWORD
+++ b/images/base/tests/EnvironmentPrecedence/secrets/DB_PASSWORD
@@ -1 +1 @@
-DB_PASSWORD secret value
\ No newline at end of file
+DB_PASSWORD secret "quote" \ value
diff --git a/images/base/tests/EnvironmentPrecedence/test.sh b/images/base/tests/EnvironmentPrecedence/test.sh
index d10163ad..46fe7a96 100755
--- a/images/base/tests/EnvironmentPrecedence/test.sh
+++ b/images/base/tests/EnvironmentPrecedence/test.sh
@@ -18,7 +18,7 @@ source /usr/local/share/isle/utilities.sh
# For ease of reading overridden values follow the format:
# ENV_VAR_NAME="ENV_VAR_NAME SOURCE value"
expect "JWT_ADMIN_TOKEN" "JWT_ADMIN_TOKEN secret value" # Secret should take precedence
-expect "DB_PASSWORD" "DB_PASSWORD secret value" # Secret should take precedence
+expect "DB_PASSWORD" 'DB_PASSWORD secret "quote" \ value' # Secret should take precedence and preserve special characters
expect "GOOGLE_APPLICATION_CREDENTIALS" "/run/secrets/GOOGLE_APPLICATION_CREDENTIALS" # Google credentials should remain file based
expect "DB_NAME" "DB_NAME passed in value" # Environment passed into the container should take precedence
expect "DB_USER" "default" # Environment variables defined in Dockerfile should take precedence
diff --git a/images/drupal/Dockerfile b/images/drupal/Dockerfile
index 58b053d6..611489a1 100644
--- a/images/drupal/Dockerfile
+++ b/images/drupal/Dockerfile
@@ -2,6 +2,8 @@
ARG PHP_BASE=nginx-php83
FROM ${PHP_BASE}
+LABEL org.opencontainers.image.licenses="GPL-2.0-or-later"
+
ARG PHP_FPM_SOCKET=/run/php-fpm/php-fpm.sock
EXPOSE 80
@@ -28,17 +30,17 @@ ENV \
DB_PORT=3306 \
DB_NAME=drupal \
DB_USER=drupal \
- DB_PASSWORD=changeme \
+ DB_PASSWORD= \
DRUPAL_DEFAULT_ACCOUNT_EMAIL=webmaster@localhost.com \
DRUPAL_DEFAULT_ACCOUNT_NAME=admin \
- DRUPAL_DEFAULT_ACCOUNT_PASSWORD=password \
+ DRUPAL_DEFAULT_ACCOUNT_PASSWORD= \
DRUPAL_DEFAULT_CONFIGDIR=/var/www/drupal/config/sync \
DRUPAL_DEFAULT_INSTALL_EXISTING_CONFIG=false \
DRUPAL_DEFAULT_EMAIL=webmaster@localhost.com \
DRUPAL_DEFAULT_LOCALE=en \
DRUPAL_DEFAULT_NAME=Drupal \
DRUPAL_DEFAULT_PROFILE=standard \
- DRUPAL_DEFAULT_SALT=9PPaL0CxZAIcq6h5wxgDGlCZrp7JdT_x7v9gVzpdbUjMt1PqDz3uD0Zy-i16DuJ1-Htfshhqeg \
+ DRUPAL_DEFAULT_SALT= \
DRUPAL_DEFAULT_SOLR_CORE=default \
DRUPAL_DEFAULT_SOLR_HOST=solr \
DRUPAL_DEFAULT_SOLR_PORT=8983 \
@@ -78,4 +80,4 @@ COPY --link rootfs /
RUN chown -R nginx:nginx /var/www/drupal
-HEALTHCHECK CMD { [ ! -f /var/www/drupal/web/core/lib/Drupal.php ] || [ -f /installed ]; } && curl -s http://localhost/status | grep -q pool
+HEALTHCHECK CMD { [ ! -f /var/www/drupal/web/core/lib/Drupal.php ] || [ -f /installed ]; } && curl -fsS http://localhost/status | grep -q pool
diff --git a/images/drupal/rootfs/etc/confd/conf.d/drupal.libops.settings.toml b/images/drupal/rootfs/etc/confd/conf.d/drupal.libops.settings.toml
index f9aa0770..b69bee30 100644
--- a/images/drupal/rootfs/etc/confd/conf.d/drupal.libops.settings.toml
+++ b/images/drupal/rootfs/etc/confd/conf.d/drupal.libops.settings.toml
@@ -2,6 +2,6 @@
src = "drupal.libops.settings.php.tmpl"
dest = "/etc/drupal/libops.settings.php"
uid = 0
-gid = 0
-mode = "0644"
+gid = 101
+mode = "0640"
keys = [ "/" ]
diff --git a/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh b/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh
index fbd4305c..ef3a774b 100755
--- a/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh
+++ b/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh
@@ -4,29 +4,33 @@ set -euo pipefail
export PATH="/var/www/drupal/vendor/bin:${PATH}"
-function mysql_create_database {
- cat <<-SQL | create-database.sh
-CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-
-CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
-GRANT ALL PRIVILEGES ON ${DB_NAME}.* to '${DB_USER}'@'%';
-FLUSH PRIVILEGES;
+# shellcheck source=images/base/rootfs/usr/local/share/libops/database.sh
+source "${LIBOPS_DATABASE_LIBRARY:-/usr/local/share/libops/database.sh}"
+# shellcheck source=images/base/rootfs/usr/local/share/libops/environment.sh
+source "${LIBOPS_ENVIRONMENT_LIBRARY:-/usr/local/share/libops/environment.sh}"
-SET PASSWORD FOR ${DB_USER}@'%' = PASSWORD('${DB_PASSWORD}');
-SQL
+function mysql_create_database {
+ DB_CHARACTER_SET=utf8mb4 \
+ DB_COLLATION=utf8mb4_unicode_ci \
+ render-database-bootstrap-sql.sh | create-database.sh
}
function mysql_count_query {
cat <<-SQL
SELECT COUNT(DISTINCT table_name)
FROM information_schema.columns
-WHERE table_schema = '${DB_NAME}';
+WHERE table_schema = DATABASE();
SQL
}
function installed {
local count
- count=$(execute-sql-file.sh <(mysql_count_query) -- -N 2>/dev/null) || return 1
+ count=$(LIBOPS_DATABASE_PASSWORD="${DB_PASSWORD}" execute-sql-file.sh \
+ --host "${DB_HOST}" \
+ --port "${DB_PORT}" \
+ --user "${DB_USER}" \
+ --database "${DB_NAME}" \
+ <(mysql_count_query) -- -N 2>/dev/null) || return 1
[[ ${count:-0} -ne 0 ]]
}
@@ -53,7 +57,7 @@ function install_site {
existing_config_arg=("--existing-config")
fi
- drush \
+ DRUSH_COMMAND_SITE_INSTALL_OPTIONS_ACCOUNT_PASS="${DRUPAL_DEFAULT_ACCOUNT_PASSWORD}" drush \
-n \
-r /var/www/drupal/web \
site:install "${DRUPAL_DEFAULT_PROFILE}" \
@@ -62,10 +66,8 @@ function install_site {
--site-name="${DRUPAL_DEFAULT_NAME}" \
--site-mail="${DRUPAL_DEFAULT_EMAIL}" \
--account-name="${DRUPAL_DEFAULT_ACCOUNT_NAME}" \
- --account-pass="${DRUPAL_DEFAULT_ACCOUNT_PASSWORD}" \
--account-mail="${DRUPAL_DEFAULT_ACCOUNT_EMAIL}" \
- --locale="${DRUPAL_DEFAULT_LOCALE}" \
- --db-url="mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}"
+ --locale="${DRUPAL_DEFAULT_LOCALE}"
}
function run_install_hooks {
@@ -127,14 +129,19 @@ function main {
return 0
fi
+ require_environment_variables DB_HOST DB_NAME DB_USER DB_PASSWORD DRUPAL_DEFAULT_SALT
+
cd /var/www/drupal
drush_cache_setup
setup_directories
- mysql_create_database
+ if [ "${DB_HOST}" = "mariadb" ]; then
+ database_bootstrap_if_enabled mysql_create_database
+ fi
if installed; then
echo "Already Installed"
else
+ require_environment_variables DRUPAL_DEFAULT_ACCOUNT_PASSWORD
echo "Installing"
install_site
run_install_hooks
@@ -142,4 +149,7 @@ function main {
fi
finished
}
-main
+
+if [ "${DRUPAL_SETUP_LIBRARY_ONLY:-false}" != "true" ]; then
+ main
+fi
diff --git a/images/drupal/rootfs/usr/local/bin/install-drupal-site.sh b/images/drupal/rootfs/usr/local/bin/install-drupal-site.sh
index 78c10639..d4b5a273 100755
--- a/images/drupal/rootfs/usr/local/bin/install-drupal-site.sh
+++ b/images/drupal/rootfs/usr/local/bin/install-drupal-site.sh
@@ -14,8 +14,7 @@ function usage {
OPTIONS:
--host The database host.
--port The database port.
- --db-user The user to connect as.
- --db-password The password to use for the user.
+ --db-user The user to connect as.
--db-name The name of the database to install into.
-h --help Show this help.
@@ -23,90 +22,84 @@ function usage {
Examples:
Install default Drupal site:
- $PROGNAME \\
+ LIBOPS_DRUPAL_INSTALL_DB_PASSWORD=password $PROGNAME \\
--host "mariadb" \\
--port "3306" \\
--db-user "root" \\
- --db-password "password" \\
--db-name "drupal_default" \\
standard --sites-subdir=default --site-name=Islandora
EOF
}
function cmdline {
- local arg=
- for arg; do
- local delim=""
- case "$arg" in
- # Translate --gnu-long-options to -g (short options)
- --host) args="${args}-b " ;;
- --port) args="${args}-c " ;;
- --db-user) args="${args}-d " ;;
- --db-password) args="${args}-e " ;;
- --db-name) args="${args}-f " ;;
- --help) args="${args}-h " ;;
- --debug) args="${args}-x " ;;
- # Pass through anything else
- *)
- [[ "${arg:0:1}" == "-" ]] || delim="\""
- args="${args}${delim}${arg}${delim} "
- ;;
- esac
- done
-
- # Reset the positional parameters to the short options
- eval set -- "${args}"
-
- while getopts "b:c:d:e:f:hx" OPTION; do
- case $OPTION in
- b)
- readonly HOST=${OPTARG}
- ;;
- c)
- readonly PORT=${OPTARG}
- ;;
- d)
- readonly DB_USER=${OPTARG}
- ;;
- e)
- readonly DB_PASSWORD=${OPTARG}
+ HOST=
+ PORT=
+ DB_USER=
+ DB_PASSWORD=${LIBOPS_DRUPAL_INSTALL_DB_PASSWORD:-}
+ DB_NAME=
+ DRUSH_ARGS=()
+
+ while (($# > 0)); do
+ case "$1" in
+ -b|--host|-c|--port|-d|--db-user|-f|--db-name)
+ if (($# < 2)); then
+ echo "Option $1 requires a value" >&2
+ exit 1
+ fi
+ case "$1" in
+ -b|--host) HOST=$2 ;;
+ -c|--port) PORT=$2 ;;
+ -d|--db-user) DB_USER=$2 ;;
+ -f|--db-name) DB_NAME=$2 ;;
+ esac
+ shift 2
;;
- f)
- readonly DB_NAME=${OPTARG}
- ;;
- h)
+ --host=*) HOST=${1#*=}; shift ;;
+ --port=*) PORT=${1#*=}; shift ;;
+ --db-user=*) DB_USER=${1#*=}; shift ;;
+ --db-name=*) DB_NAME=${1#*=}; shift ;;
+ -h|--help)
usage
exit 0
;;
- x)
+ -x|--debug)
set -x
+ shift
+ ;;
+ --)
+ shift
+ DRUSH_ARGS+=("$@")
+ break
+ ;;
+ -*)
+ # The first unrecognized option and all following arguments belong
+ # to drush, allowing its own option syntax to pass through intact.
+ DRUSH_ARGS+=("$@")
+ break
;;
*)
- echo "Invalid Option: $OPTION" >&2
- usage
- exit 1
+ DRUSH_ARGS+=("$1")
+ shift
;;
esac
done
if [[ -z $HOST || -z $PORT || -z $DB_USER || -z $DB_PASSWORD || -z $DB_NAME ]]; then
- echo "Missing one of required options: --host --port --db-user --db-password --db-name"
+ echo "Missing one of required settings: --host --port --db-user --db-name LIBOPS_DRUPAL_INSTALL_DB_PASSWORD"
exit 1
fi
- # All remaning parameters are passed to 'drush site-install'.
- shift $((OPTIND - 1))
- readonly DRUSH_ARGS=("$@")
+ readonly HOST PORT DB_USER DB_PASSWORD DB_NAME DRUSH_ARGS
return 0
}
function execute_sql_file {
- execute-sql-file.sh \
+ LIBOPS_DATABASE_PASSWORD="${DB_PASSWORD}" execute-sql-file.sh \
--host "${HOST}" \
--port "${PORT}" \
--user "${DB_USER}" \
- --password "${DB_PASSWORD}" \
+ --database "${DB_NAME}" \
"${@}"
}
@@ -114,7 +107,7 @@ function mysql_count_query {
cat <<-EOF
SELECT COUNT(DISTINCT table_name)
FROM information_schema.columns
-WHERE table_schema = '${DB_NAME}';
+WHERE table_schema = DATABASE();
EOF
}
@@ -122,6 +115,19 @@ function mysql_count {
execute_sql_file <(mysql_count_query) -- -N 2>/dev/null
}
+function uri_encode {
+ LIBOPS_DRUPAL_URI_COMPONENT="$1" php -r 'echo rawurlencode((string) getenv("LIBOPS_DRUPAL_URI_COMPONENT"));'
+}
+
+function database_url {
+ local encoded_name encoded_password encoded_user
+ encoded_user=$(uri_encode "${DB_USER}")
+ encoded_password=$(uri_encode "${DB_PASSWORD}")
+ encoded_name=$(uri_encode "${DB_NAME}")
+ printf 'mysql://%s:%s@%s:%s/%s' \
+ "${encoded_user}" "${encoded_password}" "${HOST}" "${PORT}" "${encoded_name}"
+}
+
# Check the number of tables to determine if it has already been installed.
function installed {
local count=
@@ -130,15 +136,18 @@ function installed {
}
function main {
+ local drush_database_url
cmdline "${ARGS[@]}"
if installed; then
echo "Site already is installed."
return 0
fi
echo "Installing site."
- drush \
+ drush_database_url=$(database_url)
+ DRUSH_COMMAND_SITE_INSTALL_OPTIONS_ACCOUNT_PASS="${LIBOPS_DRUPAL_INSTALL_ACCOUNT_PASSWORD:-}" \
+ DRUSH_COMMAND_SITE_INSTALL_OPTIONS_DB_URL="${drush_database_url}" \
+ drush \
-n \
- si "${DRUSH_ARGS[@]}" \
- --db-url="mysql://${DB_USER}:${DB_PASSWORD}@${HOST}:${PORT}/${DB_NAME}"
+ si "${DRUSH_ARGS[@]}"
}
main
diff --git a/images/fcrepo6/Dockerfile b/images/fcrepo6/Dockerfile
index e58165c0..eae0882b 100644
--- a/images/fcrepo6/Dockerfile
+++ b/images/fcrepo6/Dockerfile
@@ -8,6 +8,7 @@ ARG FCREPO_FILE=fcrepo-webapp-${SOFTWARE_VERSION}.war
ARG FCREPO_URL=https://github.com/fcrepo/fcrepo/releases/download/fcrepo-${SOFTWARE_VERSION}/${FCREPO_FILE}
ARG FCREPO_SHA256="5091550fe31e7693f36396e0ea3231c990648f14d914597124b84971a9daaae5"
+# renovate: datasource=github-releases depName=islandora-syn-fcrepo6 packageName=Islandora/Syn
ARG SYN_VERSION=1.1.1
ARG SYN_FILE=islandora-syn-${SYN_VERSION}-all.jar
ARG SYN_URL=https://github.com/islandora/Syn/releases/download/v${SYN_VERSION}/${SYN_FILE}
@@ -51,7 +52,7 @@ RUN --mount=type=cache,id=fcrepo6-downloads-${TARGETARCH},sharing=locked,target=
ENV \
DB_NAME=fcrepo \
- DB_PASSWORD=password \
+ DB_PASSWORD= \
DB_USER=fcrepo \
FCREPO_ACTIVEMQ_BROKER=tcp://activemq:61616 \
FCREPO_ACTIVEMQ_QUEUE=fedora \
@@ -64,4 +65,4 @@ COPY --link rootfs /
RUN chown -R tomcat:tomcat /opt/tomcat
-HEALTHCHECK CMD curl -s http://localhost:8080/fcrepo/rest/fcr:systeminfo | jq -e .version
+HEALTHCHECK CMD curl -fsS http://localhost:8080/fcrepo/rest/fcr:systeminfo | jq -e .version
diff --git a/images/fcrepo6/README.md b/images/fcrepo6/README.md
index 7c23bb0d..d44c8b38 100644
--- a/images/fcrepo6/README.md
+++ b/images/fcrepo6/README.md
@@ -74,14 +74,7 @@ Change `SOFTWARE_VERSION` and then generate the `FCREPO_SHA256` with the followi
commands:
```bash
-SOFTWARE_VERSION=$(cat fcrepo6/Dockerfile | grep -o 'SOFTWARE_VERSION=.*' | cut -f2 -d=)
-FCREPO_FILE=$(cat fcrepo6/Dockerfile | grep -o 'FCREPO_FILE=.*' | cut -f2 -d=)
-FCREPO_URL=$(cat fcrepo6/Dockerfile | grep -o 'FCREPO_URL=.*' | cut -f2 -d=)
-FCREPO_FILE=$(eval "echo $FCREPO_FILE")
-FCREPO_URL=$(eval "echo $FCREPO_URL")
-wget --quiet "${FCREPO_URL}"
-shasum -a 256 "${FCREPO_FILE}" | cut -f1 -d' '
-rm "${FCREPO_FILE}"
+./ci/update-sha.sh fcrepo6 OLD_VERSION NEW_VERSION ''
```
You can change the version used for [syn] by modifying the build argument
@@ -91,14 +84,7 @@ Change `SYN_VERSION` and then generate the `SYN_SHA256` with the following
commands:
```bash
-SYN_VERSION=$(cat fcrepo6/Dockerfile | grep -o 'SYN_VERSION=.*' | cut -f2 -d=)
-SYN_FILE=$(cat fcrepo6/Dockerfile | grep -o 'SYN_FILE=.*' | cut -f2 -d=)
-SYN_URL=$(cat fcrepo6/Dockerfile | grep -o 'SYN_URL=.*' | cut -f2 -d=)
-SYN_FILE=$(eval "echo $SYN_FILE")
-SYN_URL=$(eval "echo $SYN_URL")
-wget --quiet "${SYN_URL}"
-shasum -a 256 "${SYN_FILE}" | cut -f1 -d' '
-rm "${SYN_FILE}"
+./ci/update-sha.sh islandora-syn-fcrepo6 OLD_VERSION NEW_VERSION ''
```
You can change the version used for [fcrepo-import-export] by modifying the
@@ -109,14 +95,7 @@ Change `IMPORT_EXPORT_VERSION` and then generate the `IMPORT_EXPORT_SHA256` with
the following commands:
```bash
-IMPORT_EXPORT_VERSION=$(cat fcrepo6/Dockerfile | grep -o 'IMPORT_EXPORT_VERSION=.*' | cut -f2 -d=)
-IMPORT_EXPORT_FILE=$(cat fcrepo6/Dockerfile | grep -o 'IMPORT_EXPORT_FILE=.*' | cut -f2 -d=)
-IMPORT_EXPORT_URL=$(cat fcrepo6/Dockerfile | grep -o 'IMPORT_EXPORT_URL=.*' | cut -f2 -d=)
-IMPORT_EXPORT_FILE=$(eval "echo $IMPORT_EXPORT_FILE")
-IMPORT_EXPORT_URL=$(eval "echo $IMPORT_EXPORT_URL")
-wget --quiet "${IMPORT_EXPORT_URL}"
-shasum -a 256 "${IMPORT_EXPORT_FILE}" | cut -f1 -d' '
-rm "${IMPORT_EXPORT_FILE}"
+./ci/update-sha.sh fcrepo-import-export OLD_VERSION NEW_VERSION ''
```
You can change the version used for [fcrepo-upgrade-utils] by modifying the
@@ -127,14 +106,7 @@ Change `UPGRADE_UTILS_VERSION` and then generate the `UPGRADE_UTILS_SHA256` with
the following commands:
```bash
-UPGRADE_UTILS_VERSION=$(cat fcrepo6/Dockerfile | grep -o 'UPGRADE_UTILS_VERSION=.*' | cut -f2 -d=)
-UPGRADE_UTILS_FILE=$(cat fcrepo6/Dockerfile | grep -o 'UPGRADE_UTILS_FILE=.*' | cut -f2 -d=)
-UPGRADE_UTILS_URL=$(cat fcrepo6/Dockerfile | grep -o 'UPGRADE_UTILS_URL=.*' | cut -f2 -d=)
-UPGRADE_UTILS_FILE=$(eval "echo $UPGRADE_UTILS_FILE")
-UPGRADE_UTILS_URL=$(eval "echo $UPGRADE_UTILS_URL")
-wget --quiet "${UPGRADE_UTILS_URL}"
-shasum -a 256 "${UPGRADE_UTILS_FILE}" | cut -f1 -d' '
-rm "${UPGRADE_UTILS_FILE}"
+./ci/update-sha.sh fcrepo-upgrade-utils OLD_VERSION NEW_VERSION ''
```
[base image]: ../base/README.md
diff --git a/images/fcrepo6/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh b/images/fcrepo6/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh
index f35ebb00..abaf0528 100755
--- a/images/fcrepo6/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh
+++ b/images/fcrepo6/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh
@@ -2,19 +2,15 @@
# shellcheck shell=bash
set -e
-function mysql_create_database {
- cat <<-EOF | create-database.sh
--- Create fcrepo database in mariadb or mysql.
-CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8 COLLATE utf8_general_ci;
-
--- Create fcrepo user and grant rights.
-CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
-GRANT ALL PRIVILEGES ON ${DB_NAME}.* to '${DB_USER}'@'%';
-FLUSH PRIVILEGES;
+# shellcheck disable=SC1091
+source /usr/local/share/libops/database.sh
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
--- Update fcrepo password if changed.
-SET PASSWORD FOR ${DB_USER}@'%' = PASSWORD('${DB_PASSWORD}')
-EOF
+function mysql_create_database {
+ DB_CHARACTER_SET=utf8 \
+ DB_COLLATION=utf8_general_ci \
+ render-database-bootstrap-sql.sh | create-database.sh
}
function wait_for_broker {
@@ -32,7 +28,14 @@ function wait_for_broker {
}
function main {
- mysql_create_database
+ require_environment_variables DB_HOST DB_NAME DB_USER DB_PASSWORD
+ if [ "${DB_HOST}" = "mariadb" ]; then
+ database_bootstrap_if_enabled mysql_create_database
+ fi
+ LIBOPS_DATABASE_PASSWORD="${DB_PASSWORD}" wait-for-database.sh \
+ --host "${DB_HOST}" \
+ --port "${DB_PORT}" \
+ --user "${DB_USER}"
# When bind mounting we need to ensure that we
# actually can write to the folder.
chown tomcat:tomcat /data
diff --git a/images/fcrepo6/tests/ServiceHealthcheck/docker-compose.yml b/images/fcrepo6/tests/ServiceHealthcheck/docker-compose.yml
index 3f02fb21..1d4b163d 100644
--- a/images/fcrepo6/tests/ServiceHealthcheck/docker-compose.yml
+++ b/images/fcrepo6/tests/ServiceHealthcheck/docker-compose.yml
@@ -8,9 +8,20 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
mariadb:
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
+ DB_NAME: fcrepo
+ DB_USER: fcrepo
+ DB_PASSWORD: test-database-password
fcrepo:
+ environment:
+ DB_PASSWORD: test-database-password
+ JWT_ADMIN_TOKEN: islandora
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/fcrepo6/tests/ServiceHealthcheck/test.sh b/images/fcrepo6/tests/ServiceHealthcheck/test.sh
index dd1d6bdf..e84270db 100755
--- a/images/fcrepo6/tests/ServiceHealthcheck/test.sh
+++ b/images/fcrepo6/tests/ServiceHealthcheck/test.sh
@@ -2,7 +2,7 @@
# shellcheck shell=bash
# Invoked indirectly by the SIGTERM trap below.
-# shellcheck disable=SC2329
+# shellcheck disable=SC2317,SC2329
on_terminate() {
echo "Termination signal received. Exiting..."
exit 0
diff --git a/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/docker-compose.yml b/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/docker-compose.yml
index bd543553..8fe1cb51 100644
--- a/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/docker-compose.yml
+++ b/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/docker-compose.yml
@@ -10,9 +10,20 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
mariadb:
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
+ DB_NAME: fcrepo
+ DB_USER: fcrepo
+ DB_PASSWORD: test-database-password
fcrepo:
+ environment:
+ DB_PASSWORD: test-database-password
+ JWT_ADMIN_TOKEN: islandora
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/test.sh b/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/test.sh
index f9ef12dd..14dd561f 100755
--- a/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/test.sh
+++ b/images/fcrepo6/tests/ServiceStartsWithBackendMySQL/test.sh
@@ -5,7 +5,9 @@
source /usr/local/share/isle/utilities.sh
function count {
- cat <<-EOF | execute-sql-file.sh --database "fcrepo" - -- -N 2>/dev/null
+ cat <<-EOF | LIBOPS_DATABASE_PASSWORD="${DB_PASSWORD}" execute-sql-file.sh \
+ --host "${DB_HOST}" --port "${DB_PORT}" --user "${DB_USER}" \
+ --database "${DB_NAME}" - -- -N 2>/dev/null
SELECT COUNT(*) as count FROM containment;
EOF
}
diff --git a/images/fcrepo6/tests/SynAuthentication/docker-compose.yml b/images/fcrepo6/tests/SynAuthentication/docker-compose.yml
index a43596ad..bd3f90e8 100644
--- a/images/fcrepo6/tests/SynAuthentication/docker-compose.yml
+++ b/images/fcrepo6/tests/SynAuthentication/docker-compose.yml
@@ -8,9 +8,20 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
mariadb:
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
+ DB_NAME: fcrepo
+ DB_USER: fcrepo
+ DB_PASSWORD: test-database-password
fcrepo:
+ environment:
+ DB_PASSWORD: test-database-password
+ JWT_ADMIN_TOKEN: islandora
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/fcrepo7/Dockerfile b/images/fcrepo7/Dockerfile
index e6cdbfee..e40e21b2 100644
--- a/images/fcrepo7/Dockerfile
+++ b/images/fcrepo7/Dockerfile
@@ -2,12 +2,13 @@ FROM java21 AS syn-builder
ARG TARGETARCH
-ARG SYN_VERSION=fix-tomcat11-release-2x
-ARG SYN_REF=refs/heads/${SYN_VERSION}
+# renovate: datasource=github-releases depName=islandora-syn-fcrepo7 packageName=Islandora/Syn
+ARG SYN_VERSION=2.0.1
+ARG SYN_REF=refs/tags/v${SYN_VERSION}
ARG SYN_REPOSITORY=https://github.com/Islandora/Syn.git
ARG SYN_FILE=islandora-syn-${SYN_VERSION}-all.jar
ARG SYN_RELEASE_URL=https://github.com/Islandora/Syn/releases/download/v${SYN_VERSION}/${SYN_FILE}
-ARG SYN_SHA256=2ee12833f46aab8980e872a255612865323bf22165f86b8f5208018c1775afa5
+ARG SYN_SHA256=dde30978ca103a78d88f98ee0d2e95b767566377b29b3e8b680831fef8662bd8
WORKDIR /build/syn
@@ -72,7 +73,7 @@ RUN --mount=type=cache,id=fcrepo7-downloads-${TARGETARCH},sharing=locked,target=
ENV \
DB_NAME=fcrepo \
- DB_PASSWORD=password \
+ DB_PASSWORD= \
DB_USER=fcrepo \
FCREPO_ACTIVEMQ_BROKER=tcp://activemq:61616 \
FCREPO_ACTIVEMQ_QUEUE=fedora \
@@ -87,4 +88,4 @@ COPY --link rootfs /
RUN chown -R tomcat:tomcat /opt/tomcat
-HEALTHCHECK CMD curl -s http://localhost:8080/fcrepo/rest/fcr:systeminfo | jq -e .version
+HEALTHCHECK CMD curl -fsS http://localhost:8080/fcrepo/rest/fcr:systeminfo | jq -e .version
diff --git a/images/fcrepo7/README.md b/images/fcrepo7/README.md
index 5b5bc53b..7dbafb38 100644
--- a/images/fcrepo7/README.md
+++ b/images/fcrepo7/README.md
@@ -74,23 +74,22 @@ Change `SOFTWARE_VERSION` and then generate the `FCREPO_SHA256` with the followi
commands:
```bash
-SOFTWARE_VERSION=$(cat fcrepo7/Dockerfile | grep -o 'SOFTWARE_VERSION=.*' | cut -f2 -d=)
-FCREPO_FILE=$(cat fcrepo7/Dockerfile | grep -o 'FCREPO_FILE=.*' | cut -f2 -d=)
-FCREPO_URL=$(cat fcrepo7/Dockerfile | grep -o 'FCREPO_URL=.*' | cut -f2 -d=)
-FCREPO_FILE=$(eval "echo $FCREPO_FILE")
-FCREPO_URL=$(eval "echo $FCREPO_URL")
-wget --quiet "${FCREPO_URL}"
-shasum -a 256 "${FCREPO_FILE}" | cut -f1 -d' '
-rm "${FCREPO_FILE}"
+./ci/update-sha.sh fcrepo7 OLD_VERSION NEW_VERSION ''
```
You can change the version used for [syn] by modifying the build arguments
`SYN_VERSION` and `SYN_REF` in the `Dockerfile`.
-By default, the image fetches `refs/heads/${SYN_VERSION}` from the Syn
-repository and builds it with `./gradlew`. To build a tagged Syn release
-artifact instead, set `SYN_VERSION`, `SYN_REF=refs/tags/v${SYN_VERSION}`, and
-`SYN_SHA256` for that tag's release artifact.
+By default, the image downloads the checksum-pinned `v${SYN_VERSION}` release
+artifact. Change `SYN_VERSION` and then generate `SYN_SHA256` with:
+
+```bash
+./ci/update-sha.sh islandora-syn-fcrepo7 OLD_VERSION NEW_VERSION ''
+```
+
+To test an unreleased Syn branch, set `SYN_VERSION` and
+`SYN_REF=refs/heads/${SYN_VERSION}`. The image then builds Syn with `./gradlew`
+instead of downloading a release artifact.
You can change the version used for [fcrepo-import-export] by modifying the
build argument `IMPORT_EXPORT_VERSION` and `IMPORT_EXPORT_SHA256` in the
@@ -100,14 +99,7 @@ Change `IMPORT_EXPORT_VERSION` and then generate the `IMPORT_EXPORT_SHA256` with
the following commands:
```bash
-IMPORT_EXPORT_VERSION=$(cat fcrepo7/Dockerfile | grep -o 'IMPORT_EXPORT_VERSION=.*' | cut -f2 -d=)
-IMPORT_EXPORT_FILE=$(cat fcrepo7/Dockerfile | grep -o 'IMPORT_EXPORT_FILE=.*' | cut -f2 -d=)
-IMPORT_EXPORT_URL=$(cat fcrepo7/Dockerfile | grep -o 'IMPORT_EXPORT_URL=.*' | cut -f2 -d=)
-IMPORT_EXPORT_FILE=$(eval "echo $IMPORT_EXPORT_FILE")
-IMPORT_EXPORT_URL=$(eval "echo $IMPORT_EXPORT_URL")
-wget --quiet "${IMPORT_EXPORT_URL}"
-shasum -a 256 "${IMPORT_EXPORT_FILE}" | cut -f1 -d' '
-rm "${IMPORT_EXPORT_FILE}"
+./ci/update-sha.sh fcrepo-import-export OLD_VERSION NEW_VERSION ''
```
You can change the version used for [fcrepo-upgrade-utils] by modifying the
@@ -118,14 +110,7 @@ Change `UPGRADE_UTILS_VERSION` and then generate the `UPGRADE_UTILS_SHA256` with
the following commands:
```bash
-UPGRADE_UTILS_VERSION=$(cat fcrepo7/Dockerfile | grep -o 'UPGRADE_UTILS_VERSION=.*' | cut -f2 -d=)
-UPGRADE_UTILS_FILE=$(cat fcrepo7/Dockerfile | grep -o 'UPGRADE_UTILS_FILE=.*' | cut -f2 -d=)
-UPGRADE_UTILS_URL=$(cat fcrepo7/Dockerfile | grep -o 'UPGRADE_UTILS_URL=.*' | cut -f2 -d=)
-UPGRADE_UTILS_FILE=$(eval "echo $UPGRADE_UTILS_FILE")
-UPGRADE_UTILS_URL=$(eval "echo $UPGRADE_UTILS_URL")
-wget --quiet "${UPGRADE_UTILS_URL}"
-shasum -a 256 "${UPGRADE_UTILS_FILE}" | cut -f1 -d' '
-rm "${UPGRADE_UTILS_FILE}"
+./ci/update-sha.sh fcrepo-upgrade-utils OLD_VERSION NEW_VERSION ''
```
[base image]: ../base/README.md
diff --git a/images/fcrepo7/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh b/images/fcrepo7/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh
index f35ebb00..abaf0528 100755
--- a/images/fcrepo7/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh
+++ b/images/fcrepo7/rootfs/etc/s6-overlay/scripts/fcrepo-setup.sh
@@ -2,19 +2,15 @@
# shellcheck shell=bash
set -e
-function mysql_create_database {
- cat <<-EOF | create-database.sh
--- Create fcrepo database in mariadb or mysql.
-CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8 COLLATE utf8_general_ci;
-
--- Create fcrepo user and grant rights.
-CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
-GRANT ALL PRIVILEGES ON ${DB_NAME}.* to '${DB_USER}'@'%';
-FLUSH PRIVILEGES;
+# shellcheck disable=SC1091
+source /usr/local/share/libops/database.sh
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
--- Update fcrepo password if changed.
-SET PASSWORD FOR ${DB_USER}@'%' = PASSWORD('${DB_PASSWORD}')
-EOF
+function mysql_create_database {
+ DB_CHARACTER_SET=utf8 \
+ DB_COLLATION=utf8_general_ci \
+ render-database-bootstrap-sql.sh | create-database.sh
}
function wait_for_broker {
@@ -32,7 +28,14 @@ function wait_for_broker {
}
function main {
- mysql_create_database
+ require_environment_variables DB_HOST DB_NAME DB_USER DB_PASSWORD
+ if [ "${DB_HOST}" = "mariadb" ]; then
+ database_bootstrap_if_enabled mysql_create_database
+ fi
+ LIBOPS_DATABASE_PASSWORD="${DB_PASSWORD}" wait-for-database.sh \
+ --host "${DB_HOST}" \
+ --port "${DB_PORT}" \
+ --user "${DB_USER}"
# When bind mounting we need to ensure that we
# actually can write to the folder.
chown tomcat:tomcat /data
diff --git a/images/fcrepo7/tests/ServiceHealthcheck/docker-compose.yml b/images/fcrepo7/tests/ServiceHealthcheck/docker-compose.yml
index 94254798..4413223e 100644
--- a/images/fcrepo7/tests/ServiceHealthcheck/docker-compose.yml
+++ b/images/fcrepo7/tests/ServiceHealthcheck/docker-compose.yml
@@ -8,9 +8,20 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
mariadb:
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
+ DB_NAME: fcrepo
+ DB_USER: fcrepo
+ DB_PASSWORD: test-database-password
fcrepo:
+ environment:
+ DB_PASSWORD: test-database-password
+ JWT_ADMIN_TOKEN: islandora
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/fcrepo7/tests/ServiceHealthcheck/test.sh b/images/fcrepo7/tests/ServiceHealthcheck/test.sh
index dd1d6bdf..e84270db 100755
--- a/images/fcrepo7/tests/ServiceHealthcheck/test.sh
+++ b/images/fcrepo7/tests/ServiceHealthcheck/test.sh
@@ -2,7 +2,7 @@
# shellcheck shell=bash
# Invoked indirectly by the SIGTERM trap below.
-# shellcheck disable=SC2329
+# shellcheck disable=SC2317,SC2329
on_terminate() {
echo "Termination signal received. Exiting..."
exit 0
diff --git a/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/docker-compose.yml b/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/docker-compose.yml
index 690dfaea..c390f8cb 100644
--- a/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/docker-compose.yml
+++ b/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/docker-compose.yml
@@ -10,9 +10,20 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
mariadb:
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
+ DB_NAME: fcrepo
+ DB_USER: fcrepo
+ DB_PASSWORD: test-database-password
fcrepo:
+ environment:
+ DB_PASSWORD: test-database-password
+ JWT_ADMIN_TOKEN: islandora
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/test.sh b/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/test.sh
index f9ef12dd..14dd561f 100755
--- a/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/test.sh
+++ b/images/fcrepo7/tests/ServiceStartsWithBackendMySQL/test.sh
@@ -5,7 +5,9 @@
source /usr/local/share/isle/utilities.sh
function count {
- cat <<-EOF | execute-sql-file.sh --database "fcrepo" - -- -N 2>/dev/null
+ cat <<-EOF | LIBOPS_DATABASE_PASSWORD="${DB_PASSWORD}" execute-sql-file.sh \
+ --host "${DB_HOST}" --port "${DB_PORT}" --user "${DB_USER}" \
+ --database "${DB_NAME}" - -- -N 2>/dev/null
SELECT COUNT(*) as count FROM containment;
EOF
}
diff --git a/images/fcrepo7/tests/SynAuthentication/docker-compose.yml b/images/fcrepo7/tests/SynAuthentication/docker-compose.yml
index 2bb8e6ff..3048047b 100644
--- a/images/fcrepo7/tests/SynAuthentication/docker-compose.yml
+++ b/images/fcrepo7/tests/SynAuthentication/docker-compose.yml
@@ -8,9 +8,20 @@ services:
activemq:
<<: *common
image: ${ACTIVEMQ:-libops/activemq:local}
+ environment:
+ ACTIVEMQ_PASSWORD: test-broker-password
+ ACTIVEMQ_WEB_ADMIN_PASSWORD: test-web-password
mariadb:
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
+ DB_NAME: fcrepo
+ DB_USER: fcrepo
+ DB_PASSWORD: test-database-password
fcrepo:
+ environment:
+ DB_PASSWORD: test-database-password
+ JWT_ADMIN_TOKEN: islandora
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/islandora/Dockerfile b/images/islandora/Dockerfile
index 37b50092..f3ef28c5 100644
--- a/images/islandora/Dockerfile
+++ b/images/islandora/Dockerfile
@@ -18,4 +18,4 @@ COPY --link rootfs /
RUN mkdir -p /var/www/drupal && \
chown -R nginx:nginx /var/www/drupal
-HEALTHCHECK CMD { [ ! -f /var/www/drupal/web/core/lib/Drupal.php ] || [ -f /installed ]; } && curl -s http://localhost/status | grep -q pool
+HEALTHCHECK CMD { [ ! -f /var/www/drupal/web/core/lib/Drupal.php ] || [ -f /installed ]; } && curl -fsS http://localhost/status | grep -q pool
diff --git a/images/islandora/README.md b/images/islandora/README.md
index 7c38e2a1..1aaed527 100644
--- a/images/islandora/README.md
+++ b/images/islandora/README.md
@@ -53,7 +53,7 @@ derivative service and `fcrepo` based containers.
| :------------------------------ | :---------------------- | :------------------------------------------------- |
| DRUPAL_DEFAULT_ACCOUNT_EMAIL | webmaster@localhost.com | The email to use for the admin account |
| DRUPAL_DEFAULT_ACCOUNT_NAME | admin | The Drupal administrator user |
-| DRUPAL_DEFAULT_ACCOUNT_PASSWORD | password | The Drupal administrator user password |
+| DRUPAL_DEFAULT_ACCOUNT_PASSWORD | | The Drupal administrator password; required when installing a site |
| DRUPAL_DEFAULT_EMAIL | webmaster@localhost.com | The Drupal administrators email |
| DRUPAL_DEFAULT_LOCALE | en | The Drupal sites locale |
| DRUPAL_DEFAULT_NAME | default | The Drupal sites name |
@@ -62,7 +62,8 @@ derivative service and `fcrepo` based containers.
| DRUPAL_DEFAULT_CONFIGDIR | | Install using existing config files from directory |
| DRUPAL_DEFAULT_INSTALL | true | Perform install if not already installed |
-Provide your own passwords when running in production.
+The image has no administrator password default and fails closed when
+`DRUPAL_DEFAULT_INSTALL=true` without an explicit password.
[base image]: ../base/README.md
[Drupal]: https://www.drupal.org/
diff --git a/images/islandora/rootfs/etc/islandora/utilities.sh b/images/islandora/rootfs/etc/islandora/utilities.sh
index 7c6eb270..fe1a9af5 100755
--- a/images/islandora/rootfs/etc/islandora/utilities.sh
+++ b/images/islandora/rootfs/etc/islandora/utilities.sh
@@ -100,11 +100,10 @@ function execute_sql_file {
port=$(drupal_site_env "${site}" "DB_PORT")
user=$(drupal_site_env "${site}" "DB_ROOT_USER")
password=$(drupal_site_env "${site}" "DB_ROOT_PASSWORD")
- execute-sql-file.sh \
+ LIBOPS_DATABASE_PASSWORD="${password}" execute-sql-file.sh \
--host "${host}" \
--port "${port}" \
--user "${user}" \
- --password "${password}" \
"${@}"
}
@@ -115,16 +114,12 @@ function mysql_query {
db_name=$(drupal_site_env "${site}" "DB_NAME")
db_user=$(drupal_site_env "${site}" "DB_USER")
db_password=$(drupal_site_env "${site}" "DB_PASSWORD")
- cat <<-EOF
--- Create if does not exist.
-CREATE DATABASE IF NOT EXISTS ${db_name} CHARACTER SET utf8 COLLATE utf8_general_ci;
-CREATE USER IF NOT EXISTS ${db_user}@'%' IDENTIFIED BY "${db_password}";
-GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON ${db_name}.* to ${db_user}@'%' IDENTIFIED BY "${db_password}";
-FLUSH PRIVILEGES;
-
--- Update DB_USER password if changed.
-SET PASSWORD FOR ${db_user}@'%' = PASSWORD('${db_password}');
-EOF
+ DB_NAME="${db_name}" \
+ DB_USER="${db_user}" \
+ DB_PASSWORD="${db_password}" \
+ DB_CHARACTER_SET=utf8 \
+ DB_COLLATION=utf8_general_ci \
+ render-database-bootstrap-sql.sh
}
function mysql_create_database {
@@ -209,16 +204,16 @@ function install_site {
echo "USE_EXISTIG_CONFIG: ${use_existing_config_arg}"
echo "EVERYTHING ELSE: $*"
+ LIBOPS_DRUPAL_INSTALL_ACCOUNT_PASSWORD="${account_password}" \
+ LIBOPS_DRUPAL_INSTALL_DB_PASSWORD="${password}" \
/usr/local/bin/install-drupal-site.sh \
--host "${host}" \
--port "${port}" \
--db-user "${user}" \
- --db-password "${password}" \
--db-name "${db_name}" \
"${profile}" \
--account-mail="${account_email}" \
--account-name="${account_name}" \
- --account-pass="${account_password}" \
--site-mail="${site_email}" \
--locale="${site_locale}" \
--site-name="${site_name}" \
diff --git a/images/islandora/rootfs/etc/s6-overlay/scripts/install.d/50-islandora.sh b/images/islandora/rootfs/etc/s6-overlay/scripts/install.d/50-islandora.sh
index bfae00b7..0719ca00 100755
--- a/images/islandora/rootfs/etc/s6-overlay/scripts/install.d/50-islandora.sh
+++ b/images/islandora/rootfs/etc/s6-overlay/scripts/install.d/50-islandora.sh
@@ -2,8 +2,6 @@
# shellcheck shell=bash
set -euo pipefail
-readonly SITE="default"
-
function ingress_primary_hostname {
local hostnames hostname
hostnames="${INGRESS_HOSTNAMES:-localhost}"
diff --git a/images/java25/README.md b/images/java25/README.md
index a326586c..4d5f5275 100644
--- a/images/java25/README.md
+++ b/images/java25/README.md
@@ -1,8 +1,8 @@
-# Java 21
+# Java 25
-Docker image for [Java] OpenJDK version 21.
+Docker image for [Java] OpenJDK version 25.
-Built from [libops/isle-buildkit java21](https://github.com/libops/buildkit/tree/main/images/java21)
+Built from [libops/buildkit java25](https://github.com/libops/buildkit/tree/main/images/java25)
Please refer to the [Java Documentation] for more in-depth information.
diff --git a/images/mariadb11/README.md b/images/mariadb11/README.md
index eec5cd60..c600cfd4 100644
--- a/images/mariadb11/README.md
+++ b/images/mariadb11/README.md
@@ -1,17 +1,20 @@
# MariaDB 11
-Docker image for [MariaDB] version 11.4.12
+Docker image for [MariaDB] version 11.8.8.
Built from [libops/isle-buildkit mariadb11](https://github.com/libops/buildkit/tree/main/images/mariadb11)
Please refer to the [MariaDB Documentation] for more in-depth information.
-As a quick example this will bring up an instance of MariaDB, and allow you to
-log in with client as the user `root` with the password `password`.
+As a quick example this will generate a root password, bring up MariaDB, and
+connect as `root` using that generated credential.
```bash
-docker run --rm -d -name mariadb libops/mariadb
-docker exec -ti mariadb mysql -u root --password='password'
+export DB_ROOT_PASSWORD="$(openssl rand -hex 32)"
+docker run --rm -d --name mariadb \
+ --env DB_ROOT_PASSWORD \
+ libops/mariadb:11
+docker exec -ti --env MYSQL_PWD="${DB_ROOT_PASSWORD}" mariadb mariadb -u root
```
## Dependencies
@@ -41,8 +44,11 @@ default database connection configuration.
| Environment Variable | Default | Description |
| :------------------- | :------ | :------------------------------------------------------------------------------------ |
-| MYSQL_ROOT_PASSWORD | | The database root user password. Defaults to `DB_ROOT_PASSWORD` |
-| MYSQL_ROOT_USER | | The database root user (used to create the site database). Defaults to `DB_ROOT_USER` |
+| DB_ROOT_PASSWORD | | The database root password; required at startup |
+| DB_ROOT_USER | root | The database root user |
+| DB_NAME | default | Optional scoped database to create when `DB_PASSWORD` is set |
+| DB_USER | default | Optional scoped database user to create when `DB_PASSWORD` is set |
+| DB_PASSWORD | | Scoped user password; leave empty when provisioning through a separate initializer |
| MYSQL_MAX_ALLOWED_PACKET | 16777216 | Max packet length to send to or receive from the server, [documentation](https://mariadb.com/docs/server/ref/mdb/system-variables/max_allowed_packet/)
| MYSQL_TRANSACTION_ISOLATION | READ-COMMITTED | The isolation level for transactions.
diff --git a/images/mariadb11/rootfs/etc/s6-overlay/s6-rc.d/mysqld/run b/images/mariadb11/rootfs/etc/s6-overlay/s6-rc.d/mysqld/run
index 8a29d178..b705d4ef 100755
--- a/images/mariadb11/rootfs/etc/s6-overlay/s6-rc.d/mysqld/run
+++ b/images/mariadb11/rootfs/etc/s6-overlay/s6-rc.d/mysqld/run
@@ -1,3 +1,4 @@
#!/usr/bin/env bash
set -e
+unset DB_ROOT_PASSWORD
exec s6-setuidgid mysql /usr/bin/mariadbd
diff --git a/images/mariadb11/rootfs/etc/s6-overlay/scripts/mysql-setup.sh b/images/mariadb11/rootfs/etc/s6-overlay/scripts/mysql-setup.sh
index 9899706e..72bf06bb 100755
--- a/images/mariadb11/rootfs/etc/s6-overlay/scripts/mysql-setup.sh
+++ b/images/mariadb11/rootfs/etc/s6-overlay/scripts/mysql-setup.sh
@@ -2,6 +2,23 @@
# shellcheck shell=bash
set -e
+# shellcheck disable=SC1091
+source /usr/local/share/libops/database.sh
+# shellcheck disable=SC1091
+source /usr/local/share/libops/environment.sh
+
+# Never initialize a network-accessible root account with empty credentials.
+database_require_root_credentials
+
+# A scoped database can be provisioned by the database container for isolated
+# tests or simple deployments. Production templates use a dedicated one-shot
+# initializer and therefore do not pass DB_PASSWORD to this service.
+bootstrap_sql=
+if [ -n "${DB_PASSWORD:-}" ]; then
+ require_environment_variables DB_NAME DB_USER
+ bootstrap_sql=$(render-database-bootstrap-sql.sh)
+fi
+
# Make run directory if it does not exist.
mkdir /run/mysqld &>/dev/null || true
chown mysql:mysql /run/mysqld
@@ -22,12 +39,16 @@ done
# Change the root users password.
echo "Changing the root users (${DB_ROOT_USER}) password."
+database_validate_identifier DB_ROOT_USER "${DB_ROOT_USER}"
+db_root_user_sql=$(database_escape_sql_literal "${DB_ROOT_USER}")
+db_root_password_sql=$(database_escape_sql_literal "${DB_ROOT_PASSWORD}")
cat <<-EOF | mariadb --no-defaults --protocol=socket --user="${DB_ROOT_USER}"
- CREATE USER IF NOT EXISTS '${DB_ROOT_USER}'@'%';
- GRANT ALL PRIVILEGES ON *.* TO '${DB_ROOT_USER}'@'%' WITH GRANT OPTION;
- SET PASSWORD FOR '${DB_ROOT_USER}'@'localhost' = PASSWORD('${DB_ROOT_PASSWORD}');
- SET PASSWORD FOR '${DB_ROOT_USER}'@'%' = PASSWORD('${DB_ROOT_PASSWORD}');
+ CREATE USER IF NOT EXISTS '${db_root_user_sql}'@'%';
+ GRANT ALL PRIVILEGES ON *.* TO '${db_root_user_sql}'@'%' WITH GRANT OPTION;
+ SET PASSWORD FOR '${db_root_user_sql}'@'localhost' = PASSWORD('${db_root_password_sql}');
+ SET PASSWORD FOR '${db_root_user_sql}'@'%' = PASSWORD('${db_root_password_sql}');
FLUSH PRIVILEGES;
+ ${bootstrap_sql}
EOF
# Stop the database.
diff --git a/images/mariadb11/tests/RejectsEmptyRootPassword/docker-compose.yml b/images/mariadb11/tests/RejectsEmptyRootPassword/docker-compose.yml
new file mode 100644
index 00000000..d768c432
--- /dev/null
+++ b/images/mariadb11/tests/RejectsEmptyRootPassword/docker-compose.yml
@@ -0,0 +1,7 @@
+---
+name: mariadb11-rejectsemptyrootpassword
+services:
+ mariadb:
+ image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: ""
diff --git a/images/mariadb11/tests/ServiceHealthcheck/docker-compose.yml b/images/mariadb11/tests/ServiceHealthcheck/docker-compose.yml
index 37a1e4ea..4b792668 100644
--- a/images/mariadb11/tests/ServiceHealthcheck/docker-compose.yml
+++ b/images/mariadb11/tests/ServiceHealthcheck/docker-compose.yml
@@ -8,6 +8,8 @@ services:
mariadb:
<<: *common
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/mariadb11/tests/ServiceHealthcheck/test.sh b/images/mariadb11/tests/ServiceHealthcheck/test.sh
index dd1d6bdf..e84270db 100755
--- a/images/mariadb11/tests/ServiceHealthcheck/test.sh
+++ b/images/mariadb11/tests/ServiceHealthcheck/test.sh
@@ -2,7 +2,7 @@
# shellcheck shell=bash
# Invoked indirectly by the SIGTERM trap below.
-# shellcheck disable=SC2329
+# shellcheck disable=SC2317,SC2329
on_terminate() {
echo "Termination signal received. Exiting..."
exit 0
diff --git a/images/mariadb11/tests/ServiceStartsWithDefaults/docker-compose.yml b/images/mariadb11/tests/ServiceStartsWithDefaults/docker-compose.yml
index 485d12e0..cc527808 100644
--- a/images/mariadb11/tests/ServiceStartsWithDefaults/docker-compose.yml
+++ b/images/mariadb11/tests/ServiceStartsWithDefaults/docker-compose.yml
@@ -8,6 +8,8 @@ services:
mariadb:
<<: *common
image: ${MARIADB11:-libops/mariadb:local-11}
+ environment:
+ DB_ROOT_PASSWORD: root
volumes:
- ./test.sh:/test.sh # Test to run.
command:
diff --git a/images/nginx/Dockerfile b/images/nginx/Dockerfile
index c3522b99..1f6da414 100644
--- a/images/nginx/Dockerfile
+++ b/images/nginx/Dockerfile
@@ -43,4 +43,4 @@ ENV \
COPY --link rootfs /
-HEALTHCHECK CMD curl -s http://localhost/status | grep -q pool
+HEALTHCHECK CMD curl -fsS http://localhost/status | grep -q pool
diff --git a/images/nginx/rootfs/etc/s6-overlay/s6-rc.d/nginx/run b/images/nginx/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
index 65719fcb..bccb8b44 100755
--- a/images/nginx/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
+++ b/images/nginx/rootfs/etc/s6-overlay/s6-rc.d/nginx/run
@@ -1,3 +1,6 @@
#!/usr/bin/env bash
set -e
+unset DB_ROOT_PASSWORD
+unset DRUPAL_DEFAULT_ACCOUNT_PASSWORD OJS_ADMIN_PASSWORD \
+ OMEKA_CLASSIC_ADMIN_PASSWORD OMEKA_S_ADMIN_PASSWORD WORDPRESS_ADMIN_PASSWORD
exec s6-notifyoncheck -t 30000 -n 1 /usr/sbin/nginx
diff --git a/images/ojs/Dockerfile b/images/ojs/Dockerfile
index 184c38b6..cad02818 100644
--- a/images/ojs/Dockerfile
+++ b/images/ojs/Dockerfile
@@ -2,6 +2,8 @@
ARG PHP_BASE=nginx-php83
FROM ${PHP_BASE}
+LABEL org.opencontainers.image.licenses="GPL-3.0-only"
+
ARG TARGETARCH
ARG PHP_FPM_SOCKET=/run/php-fpm/php-fpm.sock
ARG PHP_PACKAGE=php83
@@ -14,11 +16,19 @@ ARG \
# renovate: datasource=repology depName=alpine_3_24/npm
NPM_VERSION=11.12.1-r0 \
# renovate: datasource=repology depName=alpine_3_24/poppler-utils
- POPPLER_VERSION=25.12.0-r1
+ POPPLER_VERSION=25.12.0-r1 \
+ # renovate: datasource=custom.ojs depName=ojs
+ SOFTWARE_VERSION=3.5.0-5
+
+ARG FILE=ojs-${SOFTWARE_VERSION}.tar.gz
+ARG URL=https://pkp.sfu.ca/ojs/download/${FILE}
+ARG SHA256="fd59cb1add60ab4e56e40ed843ea43ff84af11f0b64c3940f2e03186ad11445e"
EXPOSE 80
WORKDIR /var/www/ojs
+COPY --link patches /opt/ojs-patches
+
RUN --mount=type=cache,id=ojs-apk-${TARGETARCH},sharing=locked,target=/var/cache/apk \
apk add \
antiword=="${ANTIWORD_VERSION}" \
@@ -29,7 +39,33 @@ RUN --mount=type=cache,id=ojs-apk-${TARGETARCH},sharing=locked,target=/var/cache
"${PHP_PACKAGE}-ftp" \
"${PHP_PACKAGE}-gettext" \
&& \
+ cleanup.sh
+
+# Fresh OJS installations normally fetch mutable ROR and IP geolocation datasets
+# while creating the database. Defer those network-backed tasks to OJS's scheduler
+# so first boot remains bounded and can run without outbound network access. Verify
+# the pinned release still contains exactly the two expected actions before changing
+# its install descriptor; upgrades use a separate descriptor and are unaffected.
+RUN --mount=type=cache,id=ojs-downloads-${TARGETARCH},sharing=locked,target=/opt/downloads \
+ download.sh \
+ --url "${URL}" \
+ --sha256 "${SHA256}" \
+ --strip \
+ --dest /var/www/ojs \
+ && \
+ test "$(grep -Fc '