homelab/stack
1
0
Fork 0
Code Issues 275 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

fix(zotero): reinstall yq as static binary so KasmVNC entrypoint isn't FATAL

Browse Source 
The CVE-hardening pass purged yq (vulnerable Go stdlib in the base copy),
but kasmvnc-entrypoint.sh hard-depends on it to render kasmvnc.yaml. With
yq gone, the kasmvnc supervisor program went FATAL on every fresh
container, leaving a blank :21 desktop that container/nginx/Xvnc liveness
all miss.

Reinstall yq (mikefarah v4) as a current static binary after the purge —
a recent release carries the patched Go stdlib that motivated the removal.
yq is only needed at container runtime, so purge-then-reinstall ordering
is safe; `yq --version` validates the download at build time.
This commit is contained in:
kert
2026-07-08 09:28:45 -04:00
parent 3c835e950a
commit 19537deb11
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
infra/images/zotero.Dockerfile
View File

@@ -6,7 +6,10 @@ USER root
# Security patches: upgrade all OS packages + remove vulnerable binaries # Security patches: upgrade all OS packages + remove vulnerable binaries
# we don't need in a Zotero-only container. # we don't need in a Zotero-only container.
# ipp-usb — IPP-over-USB printer daemon (Go stdlib CVEs) # ipp-usb — IPP-over-USB printer daemon (Go stdlib CVEs)
# yq — YAML processor (Go stdlib CVEs) # yq — vulnerable base copy removed here, then REPLACED below with a
# current static binary. kasmvnc-entrypoint.sh requires yq to
# render kasmvnc.yaml; purging it outright left the kasmvnc
# supervisor program FATAL on every fresh container (blank :21).
# firefox — base image browser; Zotero ships its own (expat CVEs) # firefox — base image browser; Zotero ships its own (expat CVEs)
RUN apt-get update \ RUN apt-get update \
&& apt-get upgrade -y \ && apt-get upgrade -y \
@@ -23,6 +26,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
zotero \ zotero \
&& rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/apt/lists/*
# Reinstall yq as a current static binary (replaces the vulnerable base copy
# purged above). KasmVNC's entrypoint hard-depends on it (mikefarah v4 syntax);
# a recent release carries the patched Go stdlib that motivated the removal.
ARG YQ_VERSION=4.53.3
RUN arch="$(dpkg --print-architecture)" \
&& curl -fsSL "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${arch}" -o /usr/bin/yq \
&& chmod +x /usr/bin/yq \
&& yq --version
# Patch Python packages with known CVEs from base image # Patch Python packages with known CVEs from base image
RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1" RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1"