Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 6e5a163

Browse files
Improve OpenSSL 1.1.1 build hardening flags, ensure git curl extensions are built
1 parent 76807ba commit 6e5a163

File tree

5 files changed

+36
-18
lines changed

5 files changed

+36
-18
lines changed

‎Dockerfile.curl-7.79.1

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,14 @@ cd curl-* && \
1313
echo '#!/bin/sh\nexec $MUSL_TARGET-gcc -static "$@"' > /usr/local/bin/gcc && \
1414
chmod +x /usr/local/bin/gcc && \
1515
export CC="/usr/local/bin/gcc" && \
16-
export CPPFLAGS="-I/output/include -frandom-seed=pulse" && \
16+
export CFLAGS="-fPIC -frandom-seed=pulse" && \
17+
export CPPFLAGS="-I/output/include" && \
1718
export LDFLAGS="-L/output/lib" && \
1819
./configure \
1920
--disable-ldap \
20-
--disable-shared \
2121
--enable-ipv6 \
2222
--enable-static \
23+
--disable-shared \
2324
--enable-threaded-resolver \
2425
--host=$($MUSL_TARGET-gcc -dumpmachine) \
2526
--prefix=/output \

‎Dockerfile.git-2.33.0

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,26 @@
11
ARG MUSL_TARGET=x86_64-linux-musl
2-
FROM expat-2.4.1-${MUSL_TARGET} AS expat
32
FROM zlib-1.2.11-${MUSL_TARGET} AS zlib
3+
FROM expat-2.4.1-${MUSL_TARGET} AS expat
44
FROM openssl-1.1.1k-${MUSL_TARGET} AS openssl
55
FROM curl-7.79.1-${MUSL_TARGET} AS curl
66
FROM musl-cross-make-$MUSL_TARGET
77
ARG MUSL_TARGET
88

9-
COPY --from=expat /output /output
109
COPY --from=zlib /output /output
10+
COPY --from=expat /output /output
1111
COPY --from=openssl /output /output
12-
COPY --from=openssl /output /output
12+
COPY --from=curl /output /output
1313

1414
# Avoid generating translations by dummying out msgfmt, also makes dependency on gettext optional
1515
WORKDIR /build
1616
RUN download https://github.com/git/git/archive/refs/tags/v2.33.0.tar.gz source.tar.gz ac8bb4bd4f689ddacd1f17c13e519c78d0f38ffc7c41dc24a4dbeb576bc88e91 && tar xf source.tar.gz
17-
RUN export PATH=/build/cross/bin:$PATH && \
17+
RUN export PATH=/build/cross/bin:/output/bin:$PATH && \
1818
cd git-* && \
1919
export CC="$MUSL_TARGET-gcc" && \
20-
export CFLAGS="-static -I/output/include -frandom-seed=pulse" && \
20+
export CFLAGS="-static -frandom-seed=pulse" && \
21+
export CPPFLAGS="-I/output/include" && \
2122
export LDFLAGS="-L/output/lib" && \
23+
export LIBS="-lssl -lcrypto -lz" && \
2224
make configure && \
2325
./configure \
2426
--without-tcltk \
@@ -28,7 +30,7 @@ echo "#!/bin/sh\nexit 0" > /usr/local/bin/msgfmt && \
2830
chmod +x /usr/local/bin/msgfmt && \
2931
make -j$(nproc) && \
3032
make install && \
31-
rm /output/bin/git-cvsserver && \
32-
${MUSL_TARGET}-strip /output/bin/git-*
33+
cp /output/libexec/git-core/git-remote-http* /output/bin && \
34+
${MUSL_TARGET}-strip /output/bin/* || true
3335

3436
CMD bash

‎Dockerfile.openssl-1.1.1k

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,18 @@
11
ARG MUSL_TARGET=x86_64-linux-musl
2-
FROM zlib-1.2.11-${MUSL_TARGET} AS zlib
32
FROM musl-cross-make-${MUSL_TARGET}
43
ARG MUSL_TARGET
54

6-
COPY --from=zlib /output /output
7-
85
WORKDIR /build
96
RUN download https://www.openssl.org/source/openssl-1.1.1k.tar.gz source.tar.gz 892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5 && tar xf source.tar.gz
107
RUN export PATH=/build/cross/bin:$PATH && \
118
cd openssl-* && \
129
CC="gcc" \
13-
CFLAGS="-static -frandom-seed=pulse -I/output/include" \
10+
CFLAGS="-static -fPIC -frandom-seed=pulse -I/output/include" \
1411
LDFLAGS="-L/output/lib" \
1512
./Configure \
1613
--cross-compile-prefix=$MUSL_TARGET- \
1714
-static \
18-
no-shared no-engine zlib \
15+
no-shared no-engine no-idea no-mdc2 no-rc5 no-zlib no-ssl3 no-capieng \
1916
--prefix=/output \
2017
$(if echo "$MUSL_TARGET" | grep 64 >/dev/null; then echo linux-generic64; else echo linux-generic32; fi) && \
2118
make -j$(nproc) && \

‎Makefile

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ all: busybox-1.33.1 curl-7.79.1 git-2.33.0 loggedfs-0.9 nmap-7.90 openssl-1.1.1k
77

88
check:
99
@echo "These binaries are not built properly:"
10-
@echo $(shell file output/*/* | grep -E -v "statically linked, stripped$$")
10+
@echo "$(shell file output/*/* | grep -E -v "statically linked, stripped$$")"
1111

1212
## Dependencies
1313

@@ -55,7 +55,7 @@ openssl-0.9.8zh: zlib-1.2.11
5555
$(GRABBY_HANDS) /output/bin/openssl /grabby/$@
5656

5757
# Produces both libssl and the openssl command line tool.
58-
openssl-1.1.1k: zlib-1.2.11
58+
openssl-1.1.1k: musl-cross-make
5959
$(DOCKER_BUILD)
6060
$(GRABBY_HANDS) /output/bin/openssl /grabby/$@
6161

@@ -81,7 +81,9 @@ busybox-1.33.1: musl-cross-make
8181
$(DOCKER_BUILD)
8282
$(GRABBY_HANDS) /output/bin/busybox /grabby/$@
8383

84-
# Other git tools (e.g. git-shell) are built but not copied out at the moment. The 'git-versuin' binary will need to be renamed to just 'git' to work.
85-
git-2.33.0: expat-2.4.1 zlib-1.2.11 openssl-1.1.1k curl-7.79.1
84+
# Other git tools (e.g. git-shell) are built but not copied out at the moment. The 'git-version' binary will need to be renamed to just 'git' to work.
85+
git-2.33.0: expat-2.4.1 openssl-1.1.1k curl-7.79.1 zlib-1.2.11
8686
$(DOCKER_BUILD)
8787
$(GRABBY_HANDS) /output/bin/git /grabby/$@
88+
$(GRABBY_HANDS) /output/bin/git-remote-http /grabby/git-remote-http-2.33.0
89+
$(GRABBY_HANDS) /output/bin/git-remote-https /grabby/git-remote-https-2.33.0

‎git.build.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
image: alpine/edge
2+
packages:
3+
- docker
4+
sources:
5+
- https://git.sr.ht/~fincham/static-binary-zoo
6+
tasks:
7+
- build: |
8+
sudo service docker start
9+
sleep 3
10+
sudo chmod 666 /var/run/docker.sock
11+
cd static-binary-zoo || exit 1
12+
make git-2.33.0
13+
- bundle: |
14+
tar -C static-binary-zoo/output -z -c -v -f git-2.33.0.tar.gz *
15+
artifacts:
16+
- git-2.33.0.tar.gz

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /