Merge pull request #474 from splunk/develop

Release/8.1.3

Author: alishamayor

.circleci/config.yml

@@ -83,10 +83,13 @@ jobs:
       - run:
           name: Scan images
           command: |
+            mkdir -p trivy-results
             for image in ./workspace_cache/*.tar; do
               [ -e "$image" ] || continue
-              ./trivy image --exit-code 0 --ignore-unfixed --severity "HIGH,CRITICAL" --no-progress -i "$image"
+              ./trivy image --exit-code 1 --format template --template "@contrib/junit.tpl" -o trivy-results/`basename $image`.xml --ignore-unfixed --severity "HIGH,CRITICAL" --no-progress -i "$image"
             done
+      - store_test_results:
+          path: trivy-results
 
   scan_images_anchore:
     executor: anchore/anchore_engine

.trivyignore

@@ -0,0 +1,4 @@
+# Both of these are coming from this file, but it's not actually installed in the container
+# /usr/lib/python3.7/site-packages/ansible_collections/netbox/netbox/poetry.lock
+CVE-2020-36242
+CVE-2020-14343

Makefile

@@ -7,8 +7,8 @@ SPLUNK_ANSIBLE_BRANCH ?= develop
 SPLUNK_COMPOSE ?= cluster_absolute_unit.yaml
 # Set Splunk version/build parameters here to define downstream URLs and file names
 SPLUNK_PRODUCT := splunk
-SPLUNK_VERSION := 8.1.2
-SPLUNK_BUILD := 545206cc9f70
+SPLUNK_VERSION := 8.1.3
+SPLUNK_BUILD := 63079c59e632
 ifeq ($(shell arch), s390x)
 	SPLUNK_ARCH = s390x
 else

README.md

@@ -8,7 +8,7 @@ Welcome to the official Splunk repository of Dockerfiles for building Splunk Ent
 
 ----
 
-> :warning: **DEPRECATION NOTICE**  
+> :warning: **DEPRECATION NOTICE**  
 We will no longer be releasing Debian images on Docker Hub after Spring of 2021.
 
 ----

base/debian-10/Dockerfile

@@ -18,7 +18,8 @@ LABEL maintainer="[email protected]"
 ARG SCLOUD_URL
 ENV SCLOUD_URL=${SCLOUD_URL} \
     DEBIAN_FRONTEND=noninteractive \
-    PYTHON_VERSION=3.7.9
+    PYTHON_VERSION=3.7.10 \
+    PYTHON_MD5=0b19e34a6dabc4bf15fdcdf9e77e9856
 
 COPY install.sh /install.sh
 RUN /install.sh && rm -rf /install.sh

base/debian-10/install.sh

@@ -38,6 +38,7 @@ apt-get install -y --no-install-recommends curl sudo libgssapi-krb5-2 busybox pr
 # Install Python and necessary packages
 PY_SHORT=${PYTHON_VERSION%.*}
 wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
+echo "$PYTHON_MD5  /tmp/python.tgz" | md5sum --check
 mkdir -p /tmp/pyinstall
 tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz
 rm /tmp/python.tgz
@@ -50,16 +51,18 @@ ln -sf /usr/bin/pip${PY_SHORT} /usr/bin/pip
 # For ansible apt module
 cd /tmp
 apt-get download python3-apt=1.8.4.3
-dpkg -x python3-apt_1.8.4.3_amd64.deb python3-apt
-rm python3-apt_1.8.4.3_amd64.deb
+ARCH=`arch`
+PKG_ARCH=`dpkg --print-architecture`
+dpkg -x python3-apt_1.8.4.3_${PKG_ARCH}.deb python3-apt
+rm python3-apt_1.8.4.3_${PKG_ARCH}.deb
 cp -r /tmp/python3-apt/usr/lib/python3/dist-packages/* /usr/lib/python${PY_SHORT}/site-packages/
 cd /usr/lib/python${PY_SHORT}/site-packages/
-cp apt_pkg.cpython-37m-x86_64-linux-gnu.so apt_pkg.so
-cp apt_inst.cpython-37m-x86_64-linux-gnu.so apt_inst.so
+cp apt_pkg.cpython-37m-${ARCH}-linux-gnu.so apt_pkg.so
+cp apt_inst.cpython-37m-${ARCH}-linux-gnu.so apt_inst.so
 rm -rf /tmp/python3-apt
 # Install splunk-ansible dependencies
 cd /
-pip -q --no-cache-dir install six wheel requests ansible jmespath --upgrade
+pip -q --no-cache-dir install six wheel requests cryptography==3.3.2 ansible jmespath --upgrade
 # Remove tests packaged in python libs
 find /usr/lib/ -depth \( -type d -a -not -wholename '*/ansible/plugins/test' -a \( -name test -o -name tests -o -name idle_test \) \) -exec rm -rf '{}' \;
 find /usr/lib/ -depth \( -type f -a -name '*.pyc' -o -name '*.pyo' -o -name '*.a' \) -exec rm -rf '{}' \;

base/debian-9/Dockerfile

@@ -18,7 +18,8 @@ LABEL maintainer="[email protected]"
 ARG SCLOUD_URL
 ENV SCLOUD_URL=${SCLOUD_URL} \
     DEBIAN_FRONTEND=noninteractive \
-    PYTHON_VERSION=3.7.9
+    PYTHON_VERSION=3.7.10 \
+    PYTHON_MD5=0b19e34a6dabc4bf15fdcdf9e77e9856
 
 COPY install.sh /install.sh
 RUN /install.sh && rm -rf /install.sh

base/debian-9/install.sh

@@ -37,6 +37,7 @@ apt-get install -y --no-install-recommends curl sudo libgssapi-krb5-2 busybox pr
 # Install Python and necessary packages
 PY_SHORT=${PYTHON_VERSION%.*}
 wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
+echo "$PYTHON_MD5  /tmp/python.tgz" | md5sum --check
 mkdir -p /tmp/pyinstall
 tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz
 rm /tmp/python.tgz
@@ -58,7 +59,7 @@ cp apt_inst.cpython-35m-x86_64-linux-gnu.so apt_inst.so
 rm -rf /tmp/python3-apt
 # Install splunk-ansible dependencies
 cd /
-pip -q --no-cache-dir install six wheel requests ansible jmespath --upgrade
+pip -q --no-cache-dir install six wheel requests cryptography==3.3.2 ansible jmespath --upgrade
 # Remove tests packaged in python libs
 find /usr/lib/ -depth \( -type d -a -not -wholename '*/ansible/plugins/test' -a \( -name test -o -name tests -o -name idle_test \) \) -exec rm -rf '{}' \;
 find /usr/lib/ -depth \( -type f -a -name '*.pyc' -o -name '*.pyo' -o -name '*.a' \) -exec rm -rf '{}' \;

base/redhat-8/Dockerfile

@@ -16,7 +16,7 @@
 # the container catalog moved from registry.access.redhat.com to registry.redhat.io
 # So at some point before they deprecate the old registry we have to make sure that
 # we have access to the new registry and change where we pull the ubi image from.
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.3-230
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.3-291
 
 LABEL name="splunk" \
       maintainer="[email protected]" \
@@ -27,7 +27,8 @@ LABEL name="splunk" \
 
 ARG SCLOUD_URL
 ENV SCLOUD_URL=${SCLOUD_URL} \
-    PYTHON_VERSION=3.7.9
+    PYTHON_VERSION=3.7.10 \
+    PYTHON_MD5=0b19e34a6dabc4bf15fdcdf9e77e9856
 
 COPY install.sh /install.sh
 

base/redhat-8/install.sh

@@ -29,11 +29,12 @@ export LANG=en_US.utf8
 microdnf -y --nodocs install wget sudo shadow-utils procps tar tzdata make gcc \
                              openssl-devel bzip2-devel libffi-devel findutils
 # Patch security updates
-microdnf -y --nodocs update gnutls kernel-headers librepo libnghttp2
+microdnf -y --nodocs update gnutls kernel-headers librepo libnghttp2 tzdata
 
 # Install Python and necessary packages
 PY_SHORT=${PYTHON_VERSION%.*}
 wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
+echo "$PYTHON_MD5  /tmp/python.tgz" | md5sum --check
 mkdir -p /tmp/pyinstall
 tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz
 rm /tmp/python.tgz
@@ -45,7 +46,7 @@ ln -sf /usr/bin/python${PY_SHORT} /usr/bin/python
 ln -sf /usr/bin/pip${PY_SHORT} /usr/bin/pip
 # Install splunk-ansible dependencies
 cd /
-pip -q --no-cache-dir install six wheel requests ansible jmespath --upgrade
+pip -q --no-cache-dir install six wheel requests cryptography==3.3.2 ansible jmespath --upgrade
 # Remove tests packaged in python libs
 find /usr/lib/ -depth \( -type d -a -not -wholename '*/ansible/plugins/test' -a \( -name test -o -name tests -o -name idle_test \) \) -exec rm -rf '{}' \;
 find /usr/lib/ -depth \( -type f -a -name '*.pyc' -o -name '*.pyo' -o -name '*.a' \) -exec rm -rf '{}' \;