SYS-576 wip

images/python-builder/Dockerfile

@@ -43,10 +43,10 @@ RUN addgroup -g $DOCKER_GID docker && \
       musl==$MUSL_VERSION musl-dev==$MUSL_VERSION openssh-client \
       python3==$PYTHON_VERSION python3-dev py3-authlib py3-boto3 py3-botocore \
       py3-cachetools py3-cffi py3-cryptography==$PYCRYPTOGRAPHY_VERSION \
-      py3-pycryptodomex py3-flask py3-flask-babel py3-greenlet \
-      py3-itsdangerous py3-passlib \
+      py3-pycryptodomex py3-greenlet \
+      py3-itsdangerous py3-jinja2 py3-ldap3 py3-passlib \
       py3-pillow=$PYPILLOW_VERSION py3-pip py3-requests py3-virtualenv \
-      helm=$HELM_VERSION sqlite tar tzdata wget && \
+      py3-werkzeug helm=$HELM_VERSION sqlite tar tzdata wget && \
     cp /usr/share/zoneinfo/$TZ /etc/localtime && \
     echo $TZ >/etc/timezone && \
     mkdir -p /usr/lib/docker/cli-plugins && \

images/python-builder/Pipfile

@@ -12,16 +12,22 @@ botocore = "==1.29.132"
 cachetools = "==5.3.0"
 cffi = "==1.15.1"
 cryptography = "==40.0.2"
-Flask = "==2.2.3"
-Flask-Babel = "==3.1.0"
+## too old, has a CVE
+Flask = "<2.3.0"
+## can't get this version to work, localeselector problem
+# Flask-Babel = "==3.1.0"
+Flask-Babel = "<3.0.0"
 greenlet = "==2.0.2"
 itsdangerous = "==2.1.2"
+jinja2 = "==3.1.2"
+ldap3 = "==2.9.1"
 packaging = "==23.1"
 passlib = "1.7.4"
 Pillow = "==9.5.0"
 pycryptodomex = "==3.17"
 python-dateutil = "==2.8.2"
 requests = "==2.31.0"
+werkzeug = "==2.2.3"
 
 alembic = "*"
 arrow = "*"
@@ -36,7 +42,6 @@ flake8 = "*"
 Flask-Cors = "*"
 funcsigs = "*"
 jsonschema = "*"
-ldap3 = "*"
 mock = "*"
 PyJWT = "*"
 PyMySQL = "*"

images/python-wsgi/Dockerfile

@@ -22,11 +22,11 @@ RUN apk add --virtual .fetch-deps gcc git jpeg-dev linux-headers make \
       musl-dev libwebp-dev openssl-dev pcre-dev python3-dev zlib-dev && \
     apk add --update --no-cache geos jpeg libjpeg-turbo libwebp \
       proj py3-authlib py3-boto3 py3-botocore py3-cachetools \
-      py3-cffi py3-cryptography==$PYCRYPTOGRAPHY_VERSION py3-pip \
-      py3-pycryptodomex py3-flask py3-flask-babel py3-greenlet py3-itsdangerous \
+      py3-cffi py3-cryptography==$PYCRYPTOGRAPHY_VERSION py3-ldap3 py3-pip \
+      py3-pycryptodomex py3-greenlet py3-itsdangerous py3-jinja2 \
       py3-passlib py3-pillow=$PYPILLOW_VERSION py3-requests py3-setuptools \
-      py3-virtualenv python3==$PYTHON_VERSION uwsgi==$UWSGI_VERSION \
-      uwsgi-python3 zlib && \
+      py3-virtualenv py3-werkzeug python3==$PYTHON_VERSION \
+      uwsgi==$UWSGI_VERSION uwsgi-python3 zlib && \
     pip install --upgrade pipenv pip==$PIP_VERSION && \
     cd /usr/src && pipenv install --system --deploy && pip freeze && \
     apk del .fetch-deps && rm -r /var/cache/apk/* /root/.cache

images/python-wsgi/Pipfile

@@ -1,6 +1,6 @@
 # To generate Pipfile.lock:
 #  docker run --rm -it -v `pwd`:/build alpine:3.18 sh
-#  apk add python3-dev gcc musl-dev libffi-dev py3-pip py3-flask
+#  apk add python3-dev gcc musl-dev libffi-dev py3-pip # py3-flask
 #  pip install pipenv==2023.7.23 && cd /build && pipenv lock
 
 [packages]
@@ -12,17 +12,24 @@ botocore = "==1.29.132"
 cachetools = "==5.3.0"
 cffi = "==1.15.1"
 cryptography = "==40.0.2"
-Flask = "==2.2.3"
-Flask-Babel = "==3.1.0"
+## too old, has a CVE
+# Flask = "==2.2.3"
+Flask = "<2.3.0"
+## can't get this version to work, localeselector problem
+# Flask-Babel = "==3.1.0"
+Flask-Babel = "<3.0.0"
 greenlet = "==2.0.2"
 itsdangerous = "==2.1.2"
+jinja2 = "==3.1.2"
+ldap3 = "==2.9.1"
 packaging = "==23.1"
 passlib = "1.7.4"
 Pillow = "==9.5.0"
 pycryptodomex = "==3.17"
 python-dateutil = "==2.8.2"
 requests = "==2.31.0"
 uwsgi = "==2.0.21"
+werkzeug = "==2.2.3"
 
 alembic = "*"
 b2sdk = "*"
@@ -33,7 +40,6 @@ docopt = "*"
 dollar-ref = "*"
 Flask-Cors = "*"
 flower = "*"
-ldap3 = "*"
 PyJWT = "*"
 PyMySQL = "*"
 pyotp = "*"