search

processone / docker-ejabberd

Set of ejabberd Docker images
95 stars 77 forks source link

Use modern alpine #76

Closed StoneCypher closed 2 years ago

StoneCypher commented 2 years ago

Your version of alpine is two years out of date and has some security and library problems. This replaces 3.11 with 3.15

I did not independently test this change because I don't actually know how

p1bot commented 2 years ago

Hi @StoneCypher, many thanks for your contribution!

In order for us to evaluate and accept your PR, we ask that you sign a contribution license agreement. It's all electronic and will take just minutes.

StoneCypher commented 2 years ago

Unfortunately, you seem to be running a Contributor License Agreement bot that wants privileges to know things about me and make decisions about my github account. "Act on your behalf" is a wide ranging permission that allows you to create and destroy my resources, read my code, and spend my money.

I hereby give you full rights to the single byte I changed

I would still like to have my PR merged because I would be proud to be a contributor even in a trivial way

Please fix your CLA bot, it's asking for way too much

image

StoneCypher commented 2 years ago

It's worth noting that the version of Alpine that you're shipping is fully outside of support policy as of more than a month ago

You're shipping a Linux version that does not receive any kind of security notices, it's so obsoleted

StoneCypher commented 2 years ago

note: with 2+ years of changes, the underlying packages have probably changed significantly, and this probably actually causes some breakage

badlop commented 2 years ago

Hi, thanks for reporting this so outdated version!

However, you forgot to update ecs/Dockerfile

On the other hand, 3.15 was just released, 3.14 is good enough to solve the problems that you mentioned. A benefit of 3.14 is that it's already cached in the github actions image used to test this.

The good news is that, apparently, ejabberd runs correctly on Alpine 3.14 (and 3.15).

So, I've updated it to 3.14 in both Dockerfiles

StoneCypher commented 2 years ago

well it fixes my bug but now i have to find some other way to scam my way into the contributor grid

that means i have to do actual work 😭

paulmenzel commented 2 years ago

I am unable to build the ejabberd/mix image: https://github.com/processone/docker-ejabberd/issues/77.