Skip to content

Commit f25cad4

Browse files
JessicaBarhJessicaBarh
authored
Merge pull request #252 from StatCan/vulnerability-fix
fix: repo build errors and vscode issues
2 parents 1f265e1 + 9774611 commit f25cad4

27 files changed

+185
-63
lines changed

Diff for: ‎.github/containerscan/allowedlist.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,4 @@ general:
99
- NSWG-ECO-427
1010
- CVE-2019-10746
1111
- CVE-2019-10747
12-
- CVE-2019-0228
13-
- CVE-2021-28918
12+
- CVE-2021-23334 # static-eval - was deemed not a vulnerability

Diff for: ‎Makefile

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
# https://github.com/jupyter/docker-stacks
99

1010
# The docker-stacks tag
11-
DOCKER-STACKS-UPSTREAM-TAG := r-4.0.3
11+
DOCKER-STACKS-UPSTREAM-TAG := 512afd49b925
1212

1313
tensorflow-CUDA := 11.1
1414
pytorch-CUDA := 11.0
@@ -103,6 +103,7 @@ rstudio: cpu
103103
$(SRC)/4_CLI.Dockerfile \
104104
$(SRC)/5_DB-Drivers.Dockerfile \
105105
$(SRC)/6_$(@).Dockerfile \
106+
$(SRC)/7_remove_vulnerabilities.Dockerfile \
106107
$(SRC)/∞_CMD.Dockerfile \
107108
> $(OUT)/$@/Dockerfile
108109

@@ -118,6 +119,7 @@ jupyterlab: pytorch tensorflow cpu
118119
$(SRC)/4_CLI.Dockerfile \
119120
$(SRC)/5_DB-Drivers.Dockerfile \
120121
$(SRC)/6_$(@).Dockerfile \
122+
$(SRC)/7_remove_vulnerabilities.Dockerfile \
121123
$(SRC)/∞_CMD.Dockerfile \
122124
> $(OUT)/$@-$${type}/Dockerfile; \
123125
done
@@ -135,6 +137,7 @@ remote-desktop:
135137
$(SRC)/3_Kubeflow.Dockerfile \
136138
$(SRC)/4_CLI.Dockerfile \
137139
$(SRC)/6_remote-desktop.Dockerfile \
140+
$(SRC)/7_remove_vulnerabilities.Dockerfile \
138141
$(SRC)/∞_CMD_remote-desktop.Dockerfile \
139142
> $(OUT)/$@/Dockerfile
140143

Diff for: ‎docker-bits/0_Rocker.Dockerfile

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
FROM rocker/geospatial:4.0.3
1+
# Rocker/geospatial is tagged by R version number. They are not clear on whether they'll change those tagged
2+
# images for hotfixes, so always pin tag and digest to prevent unexpected upstream changes
3+
FROM rocker/geospatial:4.0.3@sha256:9e00ab4fec7b38a0edbadb07e7554bf3b7fa34d15c6fe42522a09ae88d336219
24

35
# For compatibility with docker stacks
46
ARG NB_USER="jovyan"

Diff for: ‎docker-bits/0_cpu.Dockerfile

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1-
ARG BASE_VERSION=r-4.0.3
1+
# Docker-stacks version tags (eg: `r-4.0.3`) are LIVE images that are frequently updated. To avoid unexpected
2+
# image updates, pin to the docker-stacks git commit SHA tag.
3+
# It can be obtained by running `docker inspect repo/imagename:tag@digest` or from
4+
# https://github.com/jupyter/docker-stacks/wiki
5+
6+
ARG BASE_VERSION=512afd49b925
27
FROM jupyter/datascience-notebook:$BASE_VERSION
38

49
USER root
10+
511
ENV PATH="/home/jovyan/.local/bin/:${PATH}"
612

713
RUN apt-get update --yes \

Diff for: ‎docker-bits/6_jupyterlab.Dockerfile

+12-11
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# installs vscode server, python & conda packages and jupyter lab extensions.
22

3-
# Using JupyterLab 3.0 inherited docker-stacks base image. A few extensions we used to install do not yet support
3+
# Using JupyterLab 3.0 inherited docker-stacks base image. A few extensions we used to install do not yet support
44
# this version of Jupyterlab and/or are not OL-compliant so they have been removed until new compatible versions are available:
55
# jupyterlab-kale
66
# jupyterlab-variableinspector
@@ -11,8 +11,8 @@
1111
# TODO: use official package jupyterlab-language-pack-fr-FR when released by Jupyterlab instead of the StatCan/jupyterlab-language-pack-fr_FR repo.
1212

1313
# Install vscode
14-
ARG VSCODE_VERSION=3.8.0
15-
ARG VSCODE_SHA=ee10f45b570050939cafd162fbdc52feaa03f2da89d7cdb8c42bea0a0358a32a
14+
ARG VSCODE_VERSION=3.10.0
15+
ARG VSCODE_SHA=ce4e252a47682319e27d836bb443d6246938db4be2c3bfbc80793a5939e35604
1616
ARG VSCODE_URL=https://github.com/cdr/code-server/releases/download/v${VSCODE_VERSION}/code-server_${VSCODE_VERSION}_amd64.deb
1717

1818
USER root
@@ -29,15 +29,17 @@ RUN wget -q "${VSCODE_URL}" -O ./vscode.deb \
2929
ENV XDG_DATA_HOME=/etc/share
3030
ENV SERVICE_URL=https://extensions.coder.com/api
3131
COPY vscode-overrides.json $XDG_DATA_HOME/code-server/User/settings.json
32-
ARG SHA256py=a4191fefc0e027fbafcd87134ac89a8b1afef4fd8b9dc35f14d6ee7bdf186348
32+
ARG SHA256py=d32d8737858661451705faa9f176f8a1a03485b2d9984de40d45cc0403a3bcf4
33+
# Languagepacks.json needs to exist for code-server to recognize the languagepack
34+
COPY languagepacks.json $XDG_DATA_HOME/code-server/
3335

34-
RUN VS_PYTHON_VERSION="2020.5.86806" && \
36+
RUN VS_PYTHON_VERSION="2021.5.829140558" && \
3537
wget --quiet --no-check-certificate https://github.com/microsoft/vscode-python/releases/download/$VS_PYTHON_VERSION/ms-python-release.vsix && \
3638
echo "${SHA256py} ms-python-release.vsix" | sha256sum -c - && \
3739
code-server --install-extension ms-python-release.vsix && \
3840
rm ms-python-release.vsix && \
39-
code-server --install-extension [email protected].2 && \
40-
code-server --install-extension MS-CEINTL.vscode-language-pack-fr@1.51.2 && \
41+
code-server --install-extension [email protected].6 && \
42+
code-server --install-extension MS-CEINTL.vscode-language-pack-fr@1.56.2 && \
4143
fix-permissions $XDG_DATA_HOME
4244

4345
# Default environment
@@ -87,16 +89,15 @@ RUN julia -e 'using Pkg; Pkg.add("LanguageServer")' \
8789
&& \
8890
conda install -c conda-forge \
8991
'r-languageserver' \
90-
'python-language-server' \
92+
'python-lsp-server' \
9193
&& \
92-
npm install --save-dev \
94+
jlpm add --dev \
9395
'bash-language-server' \
9496
'dockerfile-language-server-nodejs' \
9597
'javascript-typescript-langserver' \
9698
'sql-language-server' \
9799
'unified-language-server' \
98-
'vscode-json-languageserver-bin' \
99-
'yaml-language-server' \
100+
'[email protected]' \
100101
&& \
101102
conda clean --all -f -y && \
102103
fix-permissions $CONDA_DIR && \

Diff for: ‎docker-bits/7_remove_vulnerabilities.Dockerfile

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Remove libpdfbox-java due to CVE-2019-0228. See https://github.com/StatCan/kubeflow-containers/issues/249#issuecomment-834808115 for details.
2+
# Issue opened https://github.com/jupyter/docker-stacks/issues/1299.
3+
# This line of code should be removed once a solution or better alternative is found.
4+
RUN apt-get update --yes \
5+
&& dpkg -r --force-depends libpdfbox-java \
6+
&& rm -rf /var/lib/apt/lists/*

Diff for: ‎output/docker-stacks-datascience-notebook/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM jupyter/datascience-notebook:r-4.0.3
1+
FROM jupyter/datascience-notebook:512afd49b925
22

33
###############################
44
### docker-bits/∞_CMD.Dockerfile

Diff for: ‎output/docker-stacks-datascience-notebook/languagepacks.json

+1
Large diffs are not rendered by default.

Diff for: ‎output/docker-stacks-datascience-notebook/start-custom.sh

+3-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ if [ -n "${KF_LANG}" ]; then
2727
export LANG="en_US.utf8"
2828
else
2929
export LANG="fr_CA.utf8"
30-
# User's browser lang is set to french, open jupyterlab in french (fr_FR)
30+
# User's browser lang is set to French, open jupyterlab and vs_code in French (fr_FR)
3131
if [ "${DEFAULT_JUPYTER_URL}" != "/rstudio" ]; then
3232
export LANG="fr_FR"
3333
lang_file="/home/${NB_USER}/.jupyter/lab/user-settings/@jupyterlab/translation-extension/plugin.jupyterlab-settings"
@@ -42,6 +42,8 @@ if [ -n "${KF_LANG}" ]; then
4242
echo ' "locale": "'${LANG}'"'
4343
echo '}'
4444
) >> $lang_file
45+
vscode_language="${XDG_DATA_HOME}/code-server/User/argv.json"
46+
echo "{\"locale\":\"fr\"}" >> $vscode_language
4547
fi
4648
fi
4749
fi

Diff for: ‎output/jupyterlab-cpu/Dockerfile

+30-12
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,16 @@
88
### docker-bits/0_cpu.Dockerfile
99
###############################
1010

11-
ARG BASE_VERSION=r-4.0.3
11+
# Docker-stacks version tags (eg: `r-4.0.3`) are LIVE images that are frequently updated. To avoid unexpected
12+
# image updates, pin to the docker-stacks git commit SHA tag.
13+
# It can be obtained by running `docker inspect repo/imagename:tag@digest` or from
14+
# https://github.com/jupyter/docker-stacks/wiki
15+
16+
ARG BASE_VERSION=512afd49b925
1217
FROM jupyter/datascience-notebook:$BASE_VERSION
1318

1419
USER root
20+
1521
ENV PATH="/home/jovyan/.local/bin/:${PATH}"
1622

1723
RUN apt-get update --yes \
@@ -117,7 +123,7 @@ RUN apt-get update && \
117123

118124
# installs vscode server, python & conda packages and jupyter lab extensions.
119125

120-
# Using JupyterLab 3.0 inherited docker-stacks base image. A few extensions we used to install do not yet support
126+
# Using JupyterLab 3.0 inherited docker-stacks base image. A few extensions we used to install do not yet support
121127
# this version of Jupyterlab and/or are not OL-compliant so they have been removed until new compatible versions are available:
122128
# jupyterlab-kale
123129
# jupyterlab-variableinspector
@@ -128,8 +134,8 @@ RUN apt-get update && \
128134
# TODO: use official package jupyterlab-language-pack-fr-FR when released by Jupyterlab instead of the StatCan/jupyterlab-language-pack-fr_FR repo.
129135

130136
# Install vscode
131-
ARG VSCODE_VERSION=3.8.0
132-
ARG VSCODE_SHA=ee10f45b570050939cafd162fbdc52feaa03f2da89d7cdb8c42bea0a0358a32a
137+
ARG VSCODE_VERSION=3.10.0
138+
ARG VSCODE_SHA=ce4e252a47682319e27d836bb443d6246938db4be2c3bfbc80793a5939e35604
133139
ARG VSCODE_URL=https://github.com/cdr/code-server/releases/download/v${VSCODE_VERSION}/code-server_${VSCODE_VERSION}_amd64.deb
134140

135141
USER root
@@ -146,15 +152,17 @@ RUN wget -q "${VSCODE_URL}" -O ./vscode.deb \
146152
ENV XDG_DATA_HOME=/etc/share
147153
ENV SERVICE_URL=https://extensions.coder.com/api
148154
COPY vscode-overrides.json $XDG_DATA_HOME/code-server/User/settings.json
149-
ARG SHA256py=a4191fefc0e027fbafcd87134ac89a8b1afef4fd8b9dc35f14d6ee7bdf186348
155+
ARG SHA256py=d32d8737858661451705faa9f176f8a1a03485b2d9984de40d45cc0403a3bcf4
156+
# Languagepacks.json needs to exist for code-server to recognize the languagepack
157+
COPY languagepacks.json $XDG_DATA_HOME/code-server/
150158

151-
RUN VS_PYTHON_VERSION="2020.5.86806" && \
159+
RUN VS_PYTHON_VERSION="2021.5.829140558" && \
152160
wget --quiet --no-check-certificate https://github.com/microsoft/vscode-python/releases/download/$VS_PYTHON_VERSION/ms-python-release.vsix && \
153161
echo "${SHA256py} ms-python-release.vsix" | sha256sum -c - && \
154162
code-server --install-extension ms-python-release.vsix && \
155163
rm ms-python-release.vsix && \
156-
code-server --install-extension [email protected].2 && \
157-
code-server --install-extension MS-CEINTL.vscode-language-pack-fr@1.51.2 && \
164+
code-server --install-extension [email protected].6 && \
165+
code-server --install-extension MS-CEINTL.vscode-language-pack-fr@1.56.2 && \
158166
fix-permissions $XDG_DATA_HOME
159167

160168
# Default environment
@@ -204,16 +212,15 @@ RUN julia -e 'using Pkg; Pkg.add("LanguageServer")' \
204212
&& \
205213
conda install -c conda-forge \
206214
'r-languageserver' \
207-
'python-language-server' \
215+
'python-lsp-server' \
208216
&& \
209-
npm install --save-dev \
217+
jlpm add --dev \
210218
'bash-language-server' \
211219
'dockerfile-language-server-nodejs' \
212220
'javascript-typescript-langserver' \
213221
'sql-language-server' \
214222
'unified-language-server' \
215-
'vscode-json-languageserver-bin' \
216-
'yaml-language-server' \
223+
'[email protected]' \
217224
&& \
218225
conda clean --all -f -y && \
219226
fix-permissions $CONDA_DIR && \
@@ -225,6 +232,17 @@ COPY jupyterlab-overrides.json /opt/conda/share/jupyter/lab/settings/overrides.j
225232
ENV DEFAULT_JUPYTER_URL=/lab
226233
ENV GIT_EXAMPLE_NOTEBOOKS=https://github.com/statcan/jupyter-notebooks
227234

235+
###############################
236+
### docker-bits/7_remove_vulnerabilities.Dockerfile
237+
###############################
238+
239+
# Remove libpdfbox-java due to CVE-2019-0228. See https://github.com/StatCan/kubeflow-containers/issues/249#issuecomment-834808115 for details.
240+
# Issue opened https://github.com/jupyter/docker-stacks/issues/1299.
241+
# This line of code should be removed once a solution or better alternative is found.
242+
RUN apt-get update --yes \
243+
&& dpkg -r --force-depends libpdfbox-java \
244+
&& rm -rf /var/lib/apt/lists/*
245+
228246
###############################
229247
### docker-bits/∞_CMD.Dockerfile
230248
###############################

Diff for: ‎output/jupyterlab-cpu/languagepacks.json

+1
Large diffs are not rendered by default.

Diff for: ‎output/jupyterlab-cpu/start-custom.sh

+3-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ if [ -n "${KF_LANG}" ]; then
2727
export LANG="en_US.utf8"
2828
else
2929
export LANG="fr_CA.utf8"
30-
# User's browser lang is set to french, open jupyterlab in french (fr_FR)
30+
# User's browser lang is set to French, open jupyterlab and vs_code in French (fr_FR)
3131
if [ "${DEFAULT_JUPYTER_URL}" != "/rstudio" ]; then
3232
export LANG="fr_FR"
3333
lang_file="/home/${NB_USER}/.jupyter/lab/user-settings/@jupyterlab/translation-extension/plugin.jupyterlab-settings"
@@ -42,6 +42,8 @@ if [ -n "${KF_LANG}" ]; then
4242
echo ' "locale": "'${LANG}'"'
4343
echo '}'
4444
) >> $lang_file
45+
vscode_language="${XDG_DATA_HOME}/code-server/User/argv.json"
46+
echo "{\"locale\":\"fr\"}" >> $vscode_language
4547
fi
4648
fi
4749
fi

Diff for: ‎output/jupyterlab-pytorch/Dockerfile

+30-12
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,16 @@
88
### docker-bits/0_cpu.Dockerfile
99
###############################
1010

11-
ARG BASE_VERSION=r-4.0.3
11+
# Docker-stacks version tags (eg: `r-4.0.3`) are LIVE images that are frequently updated. To avoid unexpected
12+
# image updates, pin to the docker-stacks git commit SHA tag.
13+
# It can be obtained by running `docker inspect repo/imagename:tag@digest` or from
14+
# https://github.com/jupyter/docker-stacks/wiki
15+
16+
ARG BASE_VERSION=512afd49b925
1217
FROM jupyter/datascience-notebook:$BASE_VERSION
1318

1419
USER root
20+
1521
ENV PATH="/home/jovyan/.local/bin/:${PATH}"
1622

1723
RUN apt-get update --yes \
@@ -214,7 +220,7 @@ RUN apt-get update && \
214220

215221
# installs vscode server, python & conda packages and jupyter lab extensions.
216222

217-
# Using JupyterLab 3.0 inherited docker-stacks base image. A few extensions we used to install do not yet support
223+
# Using JupyterLab 3.0 inherited docker-stacks base image. A few extensions we used to install do not yet support
218224
# this version of Jupyterlab and/or are not OL-compliant so they have been removed until new compatible versions are available:
219225
# jupyterlab-kale
220226
# jupyterlab-variableinspector
@@ -225,8 +231,8 @@ RUN apt-get update && \
225231
# TODO: use official package jupyterlab-language-pack-fr-FR when released by Jupyterlab instead of the StatCan/jupyterlab-language-pack-fr_FR repo.
226232

227233
# Install vscode
228-
ARG VSCODE_VERSION=3.8.0
229-
ARG VSCODE_SHA=ee10f45b570050939cafd162fbdc52feaa03f2da89d7cdb8c42bea0a0358a32a
234+
ARG VSCODE_VERSION=3.10.0
235+
ARG VSCODE_SHA=ce4e252a47682319e27d836bb443d6246938db4be2c3bfbc80793a5939e35604
230236
ARG VSCODE_URL=https://github.com/cdr/code-server/releases/download/v${VSCODE_VERSION}/code-server_${VSCODE_VERSION}_amd64.deb
231237

232238
USER root
@@ -243,15 +249,17 @@ RUN wget -q "${VSCODE_URL}" -O ./vscode.deb \
243249
ENV XDG_DATA_HOME=/etc/share
244250
ENV SERVICE_URL=https://extensions.coder.com/api
245251
COPY vscode-overrides.json $XDG_DATA_HOME/code-server/User/settings.json
246-
ARG SHA256py=a4191fefc0e027fbafcd87134ac89a8b1afef4fd8b9dc35f14d6ee7bdf186348
252+
ARG SHA256py=d32d8737858661451705faa9f176f8a1a03485b2d9984de40d45cc0403a3bcf4
253+
# Languagepacks.json needs to exist for code-server to recognize the languagepack
254+
COPY languagepacks.json $XDG_DATA_HOME/code-server/
247255

248-
RUN VS_PYTHON_VERSION="2020.5.86806" && \
256+
RUN VS_PYTHON_VERSION="2021.5.829140558" && \
249257
wget --quiet --no-check-certificate https://github.com/microsoft/vscode-python/releases/download/$VS_PYTHON_VERSION/ms-python-release.vsix && \
250258
echo "${SHA256py} ms-python-release.vsix" | sha256sum -c - && \
251259
code-server --install-extension ms-python-release.vsix && \
252260
rm ms-python-release.vsix && \
253-
code-server --install-extension [email protected].2 && \
254-
code-server --install-extension MS-CEINTL.vscode-language-pack-fr@1.51.2 && \
261+
code-server --install-extension [email protected].6 && \
262+
code-server --install-extension MS-CEINTL.vscode-language-pack-fr@1.56.2 && \
255263
fix-permissions $XDG_DATA_HOME
256264

257265
# Default environment
@@ -301,16 +309,15 @@ RUN julia -e 'using Pkg; Pkg.add("LanguageServer")' \
301309
&& \
302310
conda install -c conda-forge \
303311
'r-languageserver' \
304-
'python-language-server' \
312+
'python-lsp-server' \
305313
&& \
306-
npm install --save-dev \
314+
jlpm add --dev \
307315
'bash-language-server' \
308316
'dockerfile-language-server-nodejs' \
309317
'javascript-typescript-langserver' \
310318
'sql-language-server' \
311319
'unified-language-server' \
312-
'vscode-json-languageserver-bin' \
313-
'yaml-language-server' \
320+
'[email protected]' \
314321
&& \
315322
conda clean --all -f -y && \
316323
fix-permissions $CONDA_DIR && \
@@ -322,6 +329,17 @@ COPY jupyterlab-overrides.json /opt/conda/share/jupyter/lab/settings/overrides.j
322329
ENV DEFAULT_JUPYTER_URL=/lab
323330
ENV GIT_EXAMPLE_NOTEBOOKS=https://github.com/statcan/jupyter-notebooks
324331

332+
###############################
333+
### docker-bits/7_remove_vulnerabilities.Dockerfile
334+
###############################
335+
336+
# Remove libpdfbox-java due to CVE-2019-0228. See https://github.com/StatCan/kubeflow-containers/issues/249#issuecomment-834808115 for details.
337+
# Issue opened https://github.com/jupyter/docker-stacks/issues/1299.
338+
# This line of code should be removed once a solution or better alternative is found.
339+
RUN apt-get update --yes \
340+
&& dpkg -r --force-depends libpdfbox-java \
341+
&& rm -rf /var/lib/apt/lists/*
342+
325343
###############################
326344
### docker-bits/∞_CMD.Dockerfile
327345
###############################

Diff for: ‎output/jupyterlab-pytorch/languagepacks.json

+1
Large diffs are not rendered by default.

Diff for: ‎output/jupyterlab-pytorch/start-custom.sh

+3-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ if [ -n "${KF_LANG}" ]; then
2727
export LANG="en_US.utf8"
2828
else
2929
export LANG="fr_CA.utf8"
30-
# User's browser lang is set to french, open jupyterlab in french (fr_FR)
30+
# User's browser lang is set to French, open jupyterlab and vs_code in French (fr_FR)
3131
if [ "${DEFAULT_JUPYTER_URL}" != "/rstudio" ]; then
3232
export LANG="fr_FR"
3333
lang_file="/home/${NB_USER}/.jupyter/lab/user-settings/@jupyterlab/translation-extension/plugin.jupyterlab-settings"
@@ -42,6 +42,8 @@ if [ -n "${KF_LANG}" ]; then
4242
echo ' "locale": "'${LANG}'"'
4343
echo '}'
4444
) >> $lang_file
45+
vscode_language="${XDG_DATA_HOME}/code-server/User/argv.json"
46+
echo "{\"locale\":\"fr\"}" >> $vscode_language
4547
fi
4648
fi
4749
fi

0 commit comments

Comments
 (0)