potiuk commented on code in PR #53770:
URL: https://github.com/apache/airflow/pull/53770#discussion_r2308836255
##########
Dockerfile:
##########
@@ -201,18 +229,88 @@ function install_debian_runtime_dependencies() {
apt-get install -y --no-install-recommends ${RUNTIME_APT_DEPS}
${ADDITIONAL_RUNTIME_APT_DEPS}
apt-get autoremove -yqq --purge
apt-get clean
+ link_python
+ rm -rf /var/lib/apt/lists/* /var/log/*
+}
+
+function install_python() {
+ wget -O python.tar.xz
"https://www.python.org/ftp/python/${AIRFLOW_PYTHON_VERSION%%[a-z]*}/Python-${AIRFLOW_PYTHON_VERSION}.tar.xz";
+ wget -O python.tar.xz.asc
"https://www.python.org/ftp/python/${AIRFLOW_PYTHON_VERSION%%[a-z]*}/Python-${AIRFLOW_PYTHON_VERSION}.tar.xz.asc";;
+ declare -A keys=(
+ # gpg: key B26995E310250568: public key "\xc5\x81ukasz Langa (GPG
langa.pl) <[email protected]>" imported
+ # https://peps.python.org/pep-0596/#release-manager-and-crew
+ [3.9]="E3FF2839C048B25C084DEBE9B26995E310250568"
+ # gpg: key 64E628F8D684696D: public key "Pablo Galindo Salgado
<[email protected]>" imported
+ # https://peps.python.org/pep-0619/#release-manager-and-crew
+ [3.10]="A035C8C19219BA821ECEA86B64E628F8D684696D"
+ # gpg: key 64E628F8D684696D: public key "Pablo Galindo Salgado
<[email protected]>" imported
+ # https://peps.python.org/pep-0664/#release-manager-and-crew
+ [3.11]="A035C8C19219BA821ECEA86B64E628F8D684696D"
+ # gpg: key A821E680E5FA6305: public key "Thomas Wouters
<[email protected]>" imported
+ # https://peps.python.org/pep-0693/#release-manager-and-crew
+ [3.12]="7169605F62C751356D054A26A821E680E5FA6305"
+ # gpg: key A821E680E5FA6305: public key "Thomas Wouters
<[email protected]>" imported
+ # https://peps.python.org/pep-0719/#release-manager-and-crew
+ [3.13]="7169605F62C751356D054A26A821E680E5FA6305"
Review Comment:
No - the security of this is based EXACTLY because we do not fetch it from
somwewhere - those are hard-coded public keys that we know are good. If we
fetch them from somewhere we need to trust that this "somewhere" gave us the
right keys.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
