Skip to content

[WIP] Python・依存ライブラリの更新とコンテナイメージのマルチステージ化 - #8

Draft
yacchin1205 wants to merge 207 commits into
RCOSDP:developfrom
yacchin1205:update/security-dependencies
Draft

yacchin1205 wants to merge 207 commits into
RCOSDP:developfrom
yacchin1205:update/security-dependencies

Conversation

@yacchin1205

Copy link
Copy Markdown

Ticket

TBD

Purpose

Python と依存ライブラリを更新する。

Changes

  • CenterForOpenScience/modular-file-renderer の変更を取り込み、依存ライブラリと関連処理を更新した。
  • 実行用イメージにビルド用パッケージを含めると脆弱性の過剰検出が生じるため、Dockerfile をマルチステージ化することでビルド用パッケージをイメージから除外した。(開発環境に関する問題については Side effects 参照)
  • 継続的にイメージ検査を行うため、Trivy スキャンを CI に追加した。

Side effects

RCOSDP/RDM-osf.io の開発環境で mfr_requirements を実行する場合は、Poetry と、必要に応じて build-essential 等の開発用パッケージを導入してください。また、依存ライブラリのコピー先・マウント先を Python 3.5 から Python 3.13 に合わせて更新してください。

QA Notes

TBD

Deployment Notes

TBD

felliott and others added 30 commits July 1, 2020 15:31
 * Add four new switches/envvars to manage keen logging:

   * `KEEN_ENABLE_LOGGING` will turn on/off *all* keen logging.

   * `KEEN_PRIVATE_LOG_VIEWS` will set logging for views to the
     private collection.

   * `KEEN_PRIVATE_LOG_ERRORS` will set logging for errors to the
     private collection.

   * `KEEN_PUBLIC_LOG_VIEWS` will set logging for views to the public
     collection.
* The python module `certifi` was pinned to a very old version to
   work around issues with Rackspace. Not only is it no longer
   relevant, it can no longer successfully validate modern TLS certs
 * conversion based off @aaxelb's work in @CenterForOpenScience/SHARE

 * update CI badge urls in README.md

 * add explicit upload to coveralls

   * replace python-coveralls with coveralls in dev-requirements.txt

 * remove old travis config files

 [ENG-3265]
 * Allow the parent window of the MFR iframe to pass its own url when
   starting the hypothes.is annotator. Parents using `postMessage`
   must now send an object with two keys: `type: 'startHypothesis'`
   and `parentUrl: <parent window url>`. Parents using pym must now
   call `.sendMessage('setParentUrl', <parent window url>)`. The
   included pym code has been updated to do this.

   MFR overrides the annotator to pass the parent window's url rather
   than its own, b/c the parent window url is more stable and
   descriptive. It was previously doing this by calling
   `document.referrer` from within the iframe. Due to privacy
   concerns, browsers have started allowing the iframe to only see the
   host and not the path of the parent url. Parent frames must now
   pass in their own url to get around this.
 * Upgrade Dockerfile image base to python v3.6.

 * Install gosu via apt-get. gosu v1.10 started being shipped with
   debian as of the `stretch` release.  Install from apt-get instead
   of `curl`-ing it from the github release page.

 * Pin pip version to 18.1 to avoid dep conflicts.

 * Based off the following WB commits:
   * CenterForOpenScience/waterbutler@d03a84c
   * CenterForOpenScience/waterbutler@b179eb8
 * Bump reportlab dep to v3.6.5 to unbreak `invoke install` on macOS.
 * add boa to supported extensions

 * bump pygments dep to 2.12 to support boa

 * add debugging logs to codepygments extension
felliott and others added 30 commits March 26, 2026 10:29
This reverts commit 682420c, reversing
changes made to 4da9b7d.
 * File urls of the form osf.io/<guid>/ used to redirect to a download
   url if <guid> pointed to a file. They no longer do. Now if MFR sees
   a url matching that pattern, it will add a /download/ path segment
   before the guid that *will* redirect.
…/hotfix/oci-cicd

[Hotfix][No Ticket] Enable OCI autodeployments
Hotfix to add build_spec.yaml for OCI CI/CD 26.1.1
…/revert-411-fix/ENG-11824

Revert "fix(cors): always send Cache-Control: no-store even without an Origin…"
Integrate COS 17de734 (MFR 26.2.0), adopting its Python 3.13 Dockerfile and Poetry dependency management. Remove obsolete Buster workarounds and requirements.txt, retain RCOSDP README links, PDF CMaps and iframe print permissions, and adapt the Docker CI runner to Poetry.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.