kert 19537deb11 fix(zotero): reinstall yq as static binary so KasmVNC entrypoint isn't FATAL ...

The CVE-hardening pass purged yq (vulnerable Go stdlib in the base copy),
but kasmvnc-entrypoint.sh hard-depends on it to render kasmvnc.yaml. With
yq gone, the kasmvnc supervisor program went FATAL on every fresh
container, leaving a blank :21 desktop that container/nginx/Xvnc liveness
all miss.

Reinstall yq (mikefarah v4) as a current static binary after the purge —
a recent release carries the patched Go stdlib that motivated the removal.
yq is only needed at container runtime, so purge-then-reinstall ordering
is safe; `yq --version` validates the download at build time.

2026-07-08 09:28:45 -04:00

3.8 KiB

Raw Blame History

View Raw