From c89b9b7ada973cfeea740ac441ccf5ae0db70598 Mon Sep 17 00:00:00 2001
From: Jonathan Perret <jonathan.perret@beta.gouv.fr>
Date: Mon, 24 Nov 2025 17:29:44 +0100
Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F(setuptools)=20remove=20setup?=
 =?UTF-8?q?tools=20from=20production=20Docker=20image?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To fix a CVE reported by Cyberwatch. These tools are not required at
runtime so there's no need to keep them around.
---
 CHANGELOG.md | 3 +++
 Dockerfile   | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6997d4c..ca83862 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+- remove setuptools, wheel and pip from production Docker image
+
 ## [1.0.10] - 2025-11-21
 - rename helmfile.yaml for compatibility with helmfile 1.x
 
diff --git a/Dockerfile b/Dockerfile
index 125974f..dba7d2f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -68,7 +68,8 @@ COPY ./src/satosa /app/
 
 WORKDIR /app
 
-RUN pip install .
+# Uninstall pip, setuptools and wheel after installation to reduce attack surface
+RUN pip install . && pip uninstall -y setuptools wheel pip
 
 # Switch to unprivileged user
 USER ${DOCKER_USER}