From bf015c923840c079ded40d2185333d5ce1edda73 Mon Sep 17 00:00:00 2001
From: Jonathan Perret <j-github@jonathanperret.net>
Date: Wed, 7 May 2025 12:21:00 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(docker)=20remove=20unused?=
 =?UTF-8?q?=20APT=20dependencies=20that=20trigger=20a=20CVE=20warning?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Specifically CVE-2023-45853 was flagged in our Docker image, but
it is in libfreetype6 which we don't use, and is only pulled in
because of a recommended depdency of `gcc` — which we don't need
in any case.
---
 Dockerfile | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index eed08b8..125974f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,17 +1,11 @@
 # ---- base image to inherit from ----
-FROM python:3.11-slim-bookworm as common
+FROM python:3.11.12-slim-bookworm AS common
 
 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
 RUN apt-get update && \
     apt-get -y upgrade && \
-    apt-get install -y \
-        pkg-config \
-        gcc \
-        xmlsec1 \
-        libxml2-dev \
-        libxmlsec1-dev \
-        libxmlsec1-openssl && \
+    apt-get install -qy --no-install-recommends xmlsec1 && \
     rm -rf /var/lib/apt/lists/*
 
 # We want the most up-to-date stable pip release
@@ -19,7 +13,7 @@ RUN pip install --upgrade pip
 
 ENV PYTHONUNBUFFERED=1
 
-# Give the "root" group the same permissions as the "root" user on /etc/passwd
+# Give the "root" group the same permissions AS the "root" user on /etc/passwd
 # to allow a user belonging to the root group to add new users; typically the
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
@@ -41,7 +35,7 @@ COPY docker/files/usr/local/etc/gunicorn/satosa.py /usr/local/etc/gunicorn/satos
 CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 
 # ---- Development image ----
-FROM common as development
+FROM common AS development
 
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
@@ -67,7 +61,7 @@ COPY ./src/satosa /app/
 USER ${DOCKER_USER}
 
 # ---- Production image (keep last so it is the default target) ----
-FROM common as production
+FROM common AS production
 
 # Copy oidc2fer application (see .dockerignore)
 COPY ./src/satosa /app/