Merge pull request #203 from celo-org/jcortejoso/update-dockerfiles

Reduce CVEs: Update dockerfile and dependencies

.changeset/tender-tomatoes-protect.md

@@ -0,0 +1,11 @@
+---
+'@celo/phone-number-privacy-combiner': patch
+'@celo/phone-number-privacy-monitor': patch
+'@celo/phone-number-privacy-signer': patch
+'@celo/phone-number-privacy-common': patch
+'@celo/encrypted-backup': patch
+'@celo/identity': patch
+'@celo/odis-identifiers': patch
+---
+
+Update package dependencies to reduce CVEs

.github/workflows/odis-combiner-container.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-combiner'
       - 'apps/combiner/**'
+      - 'yarn.lock'
     branches:
       - main
     tags:
@@ -14,6 +15,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-combiner'
       - 'apps/combiner/**'
+      - 'yarn.lock'
   workflow_dispatch:
 
 jobs:

.github/workflows/odis-loadtest-container.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-loadtest'
       - 'apps/monitor/**'
+      - 'yarn.lock'
     branches:
       - main
     tags:
@@ -14,6 +15,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-loadtest'
       - 'apps/monitor/**'
+      - 'yarn.lock'
   workflow_dispatch:
 
 jobs:

.github/workflows/odis-signer-container.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-signer'
       - 'apps/signer/**'
+      - 'yarn.lock'
     branches:
       - main
     tags:
@@ -14,6 +15,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-signer'
       - 'apps/signer/**'
+      - 'yarn.lock'
   workflow_dispatch:
 
 jobs:

.vscode/settings.json

@@ -14,12 +14,12 @@
   "typescript.preferences.importModuleSpecifier": "non-relative",
   "typescript.updateImportsOnFileMove.enabled": "always",
   "editor.codeActionsOnSave": {
-    "source.organizeImports": false
+    "source.organizeImports": "never"
   },
   "[javascript]": {
     "editor.formatOnSave": true,
     "editor.codeActionsOnSave": {
-      "source.organizeImports": false
+      "source.organizeImports": "never"
     }
   },
   "[javascriptreact]": {
@@ -43,5 +43,10 @@
   "javascript.format.enable": false,
   "editor.tabSize": 2,
   "editor.detectIndentation": false,
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "typescript.tsdk": "node_modules/typescript/lib",
+  "[javascriptreact][typescript][typescriptreact]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit"
+    }
+  }
 }

dockerfiles/Dockerfile-combiner

@@ -13,9 +13,13 @@ COPY packages/identity packages/identity
 COPY packages/odis-identifiers packages/odis-identifiers
 
 ##### Main stage
-FROM node:18
+FROM node:18-alpine3.19
 LABEL org.opencontainers.image.authors="[email protected]"
 
+# Install dependencies and upgrade OS packages
+RUN apk add --no-cache python3 git bash && \
+    apk upgrade --no-cache
+
 WORKDIR /celo-phone-number-privacy/
 
 # Copy monorepo settings

dockerfiles/Dockerfile-loadtest

@@ -12,9 +12,13 @@ COPY packages/identity packages/identity
 COPY packages/odis-identifiers packages/odis-identifiers
 
 ##### Main stage
-FROM node:18
+FROM node:18-alpine3.19
 LABEL org.opencontainers.image.authors="[email protected]"
 
+# Upgrade OS packages
+RUN apk add --no-cache python3 git bash && \
+    apk upgrade --no-cache
+
 WORKDIR /celo-phone-number-privacy/
 
 # Copy monorepo settings

dockerfiles/Dockerfile-signer

@@ -12,9 +12,13 @@ COPY packages/identity packages/identity
 COPY packages/odis-identifiers packages/odis-identifiers
 
 ##### Main stage
-FROM node:18
+FROM node:18-alpine3.19
 LABEL org.opencontainers.image.authors="[email protected]"
 
+# Upgrade OS packages
+RUN apk add --no-cache python3 git bash && \
+    apk upgrade --no-cache
+
 WORKDIR /celo-phone-number-privacy/
 
 # Copy monorepo settings
@@ -28,6 +32,7 @@ ARG PACKAGE_SELECTOR=signer
 COPY --from=packages celo-phone-number-privacy/apps/${PACKAGE_SELECTOR} apps/${PACKAGE_SELECTOR}
 # COMMENT OUT THIS LINE TO USE PUBLISHED DEPENDENCIES
 COPY --from=packages celo-phone-number-privacy/packages packages
+
 # Install dependencies and build. need dev deps too so  we can build (tsc)
 RUN yarn install --network-timeout 100000  --inline-builds && yarn cache clean
 RUN yarn workspaces list

docs/kubernetes-deployment/combiner/values/values-staging.yaml

@@ -12,12 +12,12 @@ replicaCount: 1
 
 image:
   # -- Image repository
-  repository: us-west1-docker.pkg.dev/devopsre/social-connect/odis-combiner
+  repository: us-west1-docker.pkg.dev/devopsre/dev-images/odis-combiner
   # -- Image pullpolicy
   pullPolicy: Always
   # -- Image tag
   # Overrides the image tag whose default is the chart appVersion.
-  tag: "odis-combiner-3.3.2"
+  tag: latest
 
 # -- Image pull secrets
 imagePullSecrets: []

docs/kubernetes-deployment/signer/values/staging/values-signer0-staging.yaml

@@ -46,8 +46,8 @@ env:
 fullnameOverride: ""
 image:
   pullPolicy: Always
-  repository: us-west1-docker.pkg.dev/devopsre/social-connect/odis-signer
-  tag: "odis-signer-3.1.1"
+  repository: us-west1-docker.pkg.dev/devopsre/dev-images/odis-signer
+  tag: latest
 imagePullSecrets: []
 ingress:
   enabled: true

docs/kubernetes-deployment/signer/values/staging/values-signer1-staging.yaml

@@ -46,8 +46,8 @@ env:
 fullnameOverride: ""
 image:
   pullPolicy: Always
-  repository: us-west1-docker.pkg.dev/devopsre/social-connect/odis-signer
-  tag: "odis-signer-3.1.1"
+  repository: us-west1-docker.pkg.dev/devopsre/dev-images/odis-signer
+  tag: latest
 imagePullSecrets: []
 ingress:
   enabled: true

docs/kubernetes-deployment/signer/values/staging/values-signer2-staging.yaml

@@ -46,8 +46,8 @@ env:
 fullnameOverride: ""
 image:
   pullPolicy: Always
-  repository: us-west1-docker.pkg.dev/devopsre/social-connect/odis-signer
-  tag: "odis-signer-3.1.1"
+  repository: us-west1-docker.pkg.dev/devopsre/dev-images/odis-signer
+  tag: latest
 imagePullSecrets: []
 ingress:
   enabled: true

package.json

@@ -67,7 +67,16 @@
     "blind-threshold-bls": "npm:@celo/[email protected]",
     "ganache": "npm:@celo/[email protected]",
     "@types/bn.js": "4.11.6",
-    "bignumber.js": "9.0.0"
+    "bignumber.js": "9.0.0",
+    "crypto-js": "4.2.0",
+    "flat": "5.0.1",
+    "protobufjs": "7.2.4",
+    "@babel/traverse": "7.23.2",
+    "node-fetch": "2.6.7",
+    "get-func-name": "2.0.1",
+    "minimatch": "3.0.5",
+    "async": "2.6.4",
+    "browserify-sign": "4.2.2"
   },
   "packageManager": "[email protected]"
 }