mirror of
https://github.com/go-sigma/sigma.git
synced 2026-10-28 18:35:31 +08:00
Tosone
940ab15dd4
Update direct Go module dependencies to their latest patch/minor releases, including security and bug fixes across registry, scanning, storage and build backends. Align the grype, syft, buildkit, cosign and swagger-ui versions pinned in the Dockerfile with their upstream releases. Direct upgrades: - github.com/alicebob/miniredis/v2 v2.39.0 -> v2.40.0 - github.com/anchore/grype v0.120.0 -> v0.121.0 - github.com/anchore/syft v1.54.0 -> v1.55.0 - github.com/aws/aws-sdk-go-v2 v1.47.1 -> v1.47.3 - github.com/aws/aws-sdk-go-v2/config v1.33.6 -> v1.33.9 - github.com/aws/aws-sdk-go-v2/service/s3 v1.114.0 -> v1.114.3 - github.com/aws/smithy-go v1.28.2 -> v1.28.5 - github.com/docker/cli v29.8.2+incompatible -> v29.9.2+incompatible - github.com/mark3labs/mcp-go v1.1.1 -> v1.2.1 - github.com/moby/buildkit v0.33.1 -> v0.34.1 - github.com/pressly/goose/v3 v3.28.0 -> v3.29.0 - github.com/prometheus/client_golang v1.24.1 -> v1.25.0 - github.com/sigstore/cosign/v3 v3.1.3 -> v3.1.4 - go.podman.io/podman/v6 v6.1.3 -> v6.1.4 - golang.org/x/crypto v0.57.0 -> v0.58.0 - golang.org/x/net v0.59.0 -> v0.61.0 - golang.org/x/sync v0.23.0 -> v0.24.0 - turso.tech/database/tursogo v0.8.2 -> v0.8.3 Dockerfile: - build/Dockerfile: SYFT_VERSION 1.54.0 -> 1.55.0, GRYPE_VERSION 0.120.0 -> 0.121.0, COSIGN_VERSION v3.1.3 -> v3.1.4, SWAGGER_UI_VERSION 5.33.1 -> 5.33.2, BUILDKIT_VERSION v0.33.1-rootless -> v0.34.1-rootless Notable transitive bumps: grpc 1.83.2 -> 1.84.0, prometheus/common 0.70.1 -> 0.72.0, sigstore/sigstore 1.10.8 -> v1.11.1, sigstore/sigstore-go v1.2.2 -> v1.3.0, rekor v1.5.3 -> v1.5.4, go-openapi v0.x -> v1.0.0 across analysis/spec/validate, google.golang.org/api v0.294.0 -> v0.301.0, klauspost/compress 1.20.0 -> 1.20.1, and the podman buildah/storage modules. cloud.google.com/go/auth resolves to the pseudo-version v0.24.1-0.20261001053825-dbc26066f70a because the cosign KMS/GCS dependency chain requires a commit that has no tagged release yet. Verification: - go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./... - go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./... - golangci-lint v2.15.0 run --build-tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" (0 issues) - go mod tidy
201 lines
8.2 KiB
Docker
201 lines
8.2 KiB
Docker
# =============================================================
|
|
# Global build-arg declarations (available to every stage)
|
|
# =============================================================
|
|
ARG ALPINE_VERSION=3.24
|
|
ARG GOLANG_VERSION=1.27-alpine3.24
|
|
ARG BUN_VERSION=1.4.2-alpine
|
|
ARG BUILDKIT_VERSION=v0.34.1-rootless
|
|
ARG SWAGGER_UI_VERSION=5.33.2
|
|
|
|
# =============================================================
|
|
# base stages (originally Dockerfile.base)
|
|
# =============================================================
|
|
FROM alpine:${ALPINE_VERSION} AS syft
|
|
|
|
ARG SYFT_VERSION=1.55.0
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
ARG USE_MIRROR=false
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache wget upx && \
|
|
wget --progress=dot:giga -O syft_"${SYFT_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz https://github.com/anchore/syft/releases/download/v"${SYFT_VERSION}"/syft_"${SYFT_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz && \
|
|
tar -xzf syft_"${SYFT_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz && \
|
|
upx -9 syft && \
|
|
mv syft /usr/local/bin/syft && \
|
|
rm syft_"${SYFT_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz
|
|
|
|
FROM alpine:${ALPINE_VERSION} AS grype
|
|
|
|
ARG GRYPE_VERSION=0.121.0
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
ARG USE_MIRROR=false
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache wget jq upx && \
|
|
wget --progress=dot:giga -O grype_"${GRYPE_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz https://github.com/anchore/grype/releases/download/v"${GRYPE_VERSION}"/grype_"${GRYPE_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz && \
|
|
tar -xzf grype_"${GRYPE_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz && \
|
|
upx -9 grype && \
|
|
mv grype /usr/local/bin/grype && \
|
|
rm grype_"${GRYPE_VERSION}"_"${TARGETOS}"_"${TARGETARCH}".tar.gz && \
|
|
mkdir -p /opt/grype/ && \
|
|
GRYPE_DB_PATH="$(wget -qO- https://grype.anchore.io/databases/v6/latest.json | jq -r '.path')" && \
|
|
wget --progress=dot:giga -O /opt/grype/"${GRYPE_DB_PATH##*/}" "https://grype.anchore.io/databases/v6/${GRYPE_DB_PATH}"
|
|
|
|
FROM alpine:${ALPINE_VERSION} AS cosign
|
|
|
|
ARG USE_MIRROR=false
|
|
ARG COSIGN_VERSION=v3.1.4
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache wget upx && \
|
|
wget --progress=dot:giga -O /tmp/cosign https://github.com/sigstore/cosign/releases/download/"${COSIGN_VERSION}"/cosign-"${TARGETOS}"-"${TARGETARCH}" && \
|
|
chmod +x /tmp/cosign && \
|
|
upx -9 /tmp/cosign
|
|
|
|
# =============================================================
|
|
# web stage (originally Dockerfile.web)
|
|
# =============================================================
|
|
FROM oven/bun:${BUN_VERSION} AS web
|
|
|
|
ARG USE_MIRROR=false
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache make bash ncurses build-base
|
|
|
|
WORKDIR /web
|
|
|
|
COPY ./web .
|
|
|
|
RUN --mount=type=cache,target=/web/node_modules \
|
|
--mount=type=cache,target=/web/.yarn \
|
|
--mount=type=cache,target=/root/.yarn \
|
|
bun install --frozen-lockfile && \
|
|
bun run build
|
|
|
|
# =============================================================
|
|
# server stage (originally Dockerfile.server)
|
|
# =============================================================
|
|
FROM golang:${GOLANG_VERSION} AS server
|
|
|
|
ARG USE_MIRROR=false
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache make bash ncurses git git-lfs openssl build-base linux-headers zig upx
|
|
|
|
WORKDIR /go/src/github.com/go-sigma/sigma
|
|
|
|
COPY . .
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
go mod download && make build && \
|
|
upx -9 /go/src/github.com/go-sigma/sigma/bin/sigma
|
|
|
|
# =============================================================
|
|
# swagger stage
|
|
# =============================================================
|
|
FROM golang:${GOLANG_VERSION} AS swagger
|
|
|
|
ARG USE_MIRROR=false
|
|
ARG SWAGGER_UI_VERSION
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache make bash ncurses git wget
|
|
|
|
WORKDIR /go/src/github.com/go-sigma/sigma
|
|
|
|
COPY . .
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
set -eux && \
|
|
mkdir -p /app/swag && \
|
|
wget --progress=dot:giga -O /tmp/swagger-ui.tar.gz https://github.com/swagger-api/swagger-ui/archive/refs/tags/v"${SWAGGER_UI_VERSION}".tar.gz && \
|
|
tar -xzf /tmp/swagger-ui.tar.gz -C /tmp && \
|
|
cp -R /tmp/swagger-ui-"${SWAGGER_UI_VERSION}"/dist/. /app/swag/ && \
|
|
sed -i 's#url: "https://petstore.swagger.io/v2/swagger.json"#url: "swagger.json"#' /app/swag/swagger-initializer.js && \
|
|
go mod download && \
|
|
go tool swag init --output /app/swag --outputTypes json
|
|
|
|
# =============================================================
|
|
# sigma-server (originally Dockerfile, bake target: sigma-server)
|
|
# Build: docker build --target sigma-server ...
|
|
# =============================================================
|
|
FROM alpine:${ALPINE_VERSION} AS sigma-server
|
|
|
|
LABEL org.opencontainers.image.title="sigma" \
|
|
org.opencontainers.image.description="Sigma is a lightweight, easy-to-deploy OCI artifact registry that implements the OCI Distribution Specification 1.1 and can serve as a private or public registry on any cloud or on-premises." \
|
|
org.opencontainers.image.url="https://hub.docker.com/r/sigmago/sigma" \
|
|
org.opencontainers.image.source="https://github.com/go-sigma/sigma" \
|
|
org.opencontainers.image.licenses="Apache-2.0" \
|
|
org.opencontainers.image.version="v1.0.0"
|
|
|
|
ARG USE_MIRROR=false
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache ca-certificates mailcap nginx tini tzdata && \
|
|
install -d -m 0755 /etc/sigma
|
|
|
|
COPY --chmod=0755 ./build/entrypoint /usr/local/bin/sigma-server-entrypoint
|
|
COPY --chmod=0644 ./conf/default.conf.template /etc/nginx/nginx.conf
|
|
COPY --chmod=0644 ./conf/config.yaml /etc/sigma/config.yaml
|
|
|
|
COPY --from=syft --chmod=0755 /usr/local/bin/syft /usr/local/bin/syft
|
|
COPY --from=cosign --chmod=0755 /tmp/cosign /usr/local/bin/cosign
|
|
COPY --from=grype --chmod=0755 /usr/local/bin/grype /usr/local/bin/grype
|
|
COPY --from=grype --chown=1001:1001 --chmod=0755 /opt/grype/ /opt/grype/
|
|
COPY --from=server --chmod=0755 /go/src/github.com/go-sigma/sigma/bin/sigma /usr/local/bin/sigma
|
|
COPY --from=web --chmod=755 /web/dist /app
|
|
COPY --from=swagger --chmod=0755 /app/swag /app/swag
|
|
|
|
RUN adduser --disabled-password -h /home/sigma -s /bin/sh -u 1001 sigma && \
|
|
install -d -o 1001 -g 1001 /var/lib/sigma /code/
|
|
|
|
WORKDIR /home/sigma
|
|
|
|
USER sigma
|
|
|
|
CMD ["tini", "--", "sigma-server-entrypoint"]
|
|
|
|
# =============================================================
|
|
# sigma-builder (originally Dockerfile.builder, bake target: sigma-builder)
|
|
# Build: docker build --target sigma-builder ...
|
|
# =============================================================
|
|
FROM moby/buildkit:${BUILDKIT_VERSION} AS sigma-builder
|
|
|
|
LABEL org.opencontainers.image.title="sigma" \
|
|
org.opencontainers.image.description="Sigma is a lightweight, easy-to-deploy OCI artifact registry that implements the OCI Distribution Specification 1.1 and can serve as a private or public registry on any cloud or on-premises." \
|
|
org.opencontainers.image.url="https://hub.docker.com/r/sigmago/sigma" \
|
|
org.opencontainers.image.source="https://github.com/go-sigma/sigma" \
|
|
org.opencontainers.image.licenses="Apache-2.0" \
|
|
org.opencontainers.image.version="v1.0.0"
|
|
|
|
ARG USE_MIRROR=false
|
|
|
|
USER root
|
|
|
|
RUN set -eux && \
|
|
if [ "$USE_MIRROR" = true ]; then sed -i "s/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g" /etc/apk/repositories; fi && \
|
|
apk add --no-cache curl git git-lfs && \
|
|
mkdir -p /code/ && \
|
|
chown -R 1000:1000 /opt/ && \
|
|
chown -R 1000:1000 /code/
|
|
|
|
COPY --from=cosign /tmp/cosign /usr/local/bin/cosign
|
|
COPY --from=server /go/src/github.com/go-sigma/sigma/bin/sigma /usr/local/bin/sigma
|
|
|
|
WORKDIR /code
|
|
|
|
USER 1000:1000
|