mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-24 07:42:21 +02:00
RaresKeYandLéo
c6d76b9a9b
Repair SearXNG system and certifi stores, validate native amd64/arm64 runtime images through Compose, and publish the exact verified artifacts through a trusted CI job. Adopt released Python, certifi, grpcio, uv and Docker CLI trust fixes, with strict controls for all fourteen public incident chains. Part of #6784 and #6790. Co-authored-by: Léo <leograndcontact@gmail.com>
23 lines
1.2 KiB
Docker
23 lines
1.2 KiB
Docker
# Keep the application version unchanged while correcting its independent trust.
|
|
FROM docker.io/searxng/searxng:2026.9.25-12f8b6515@sha256:5286edb35782454ab8a102c5eff6b54bff745853191b46aeead95f225aa6dfb6 AS base
|
|
|
|
FROM base AS baseline-validation
|
|
COPY docker/searxng/repair_trust.py docker/searxng/blocked-certificates.json docker/searxng/validate_image.py /opt/odysseus-trust/
|
|
COPY tests/fixtures/ca-trust/incident.json /opt/odysseus-trust/incident.json
|
|
RUN /usr/local/searxng/.venv/bin/python /opt/odysseus-trust/validate_image.py --baseline
|
|
|
|
FROM base AS repaired
|
|
COPY docker/searxng/repair_trust.py docker/searxng/blocked-certificates.json /opt/odysseus-trust/
|
|
RUN /usr/local/searxng/.venv/bin/python /opt/odysseus-trust/repair_trust.py
|
|
|
|
# Optional offline validation runs inside the actual SearXNG filesystem.
|
|
FROM repaired AS validation
|
|
COPY tests/fixtures/ca-trust/incident.json /opt/odysseus-trust/incident.json
|
|
COPY docker/searxng/validate_image.py /opt/odysseus-trust/validate_image.py
|
|
RUN /usr/local/searxng/.venv/bin/python /opt/odysseus-trust/validate_image.py
|
|
|
|
FROM validation AS live-validation
|
|
RUN /usr/local/searxng/.venv/bin/python /opt/odysseus-trust/validate_image.py --live
|
|
|
|
FROM repaired AS runtime
|