shreemaan-abhishek opened a new pull request, #636:
URL: https://github.com/apache/apisix-docker/pull/636
The images build brotli from source (`install-brotli.sh`), pinned to a fixed
upstream tag. That means the library never receives the distribution's security
updates, and because a source build leaves no package-manager entry, it is also
invisible to image scanners such as grype and trivy.
This switches all three image families to the distribution packages, which
are maintained and do show up in an SBOM:
- `utils/install-brotli.sh` (debian, ubuntu): `brotli` + `libbrotli1`
- `debian-dev/install-brotli.sh`: same
- `redhat/install-brotli.sh`: `brotli` + `libbrotli`
`brotli-ffi` calls `ffi.load("brotlienc")`, which resolves the unversioned
soname. Distributions ship those symlinks only in the `-dev`/`-devel` package,
so the scripts create them against the packaged `.so.1` rather than pulling
build headers into the runtime image. Linking to `.so.1` (not the fully
versioned file) keeps the symlink valid across package upgrades.
Package versions currently selected: debian 12 `1.0.9-2+deb12u1`, ubuntu
24.04 `1.1.0-2ubuntu0.1`, UBI9 `1.0.9-10.el9_8.1`.
Side effects worth noting: the images no longer carry `/usr/local/brotli`,
its headers and pkgconfig files, or `/etc/ld.so.conf.d/brotli.conf`, and the
build no longer needs `cmake`/`unzip`/`sudo`, so the build is smaller and
faster. The `brotli` CLI remains available on `PATH`.
Verified locally by building the debian image and confirming
`require("brotli")` succeeds under both `luajit` and `resty`, that the three
unversioned symlinks resolve, that the packages appear in `dpkg -l`, and that a
300KB compress/decompress round trip through the shipped libraries matches. I
also ran the install snippet standalone on `ubuntu:24.04` and `ubi9/ubi:9.6` to
confirm the soname lookup works there. The full plugin behaviour is left to CI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
