@sw-tsdk/connector 3.23.0-alpha.24827b5 → 3.23.0-alpha.5b3d9ec

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,23 +1,16 @@
1
1
  # syntax=docker/dockerfile:1.2
2
- ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.10-latest
3
-
4
2
  ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.10-latest
5
3
 
6
4
  ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.10-latest
7
5
  ARG RUNTIME_IMAGE=runtime-image
8
6
 
9
- # Stage 1: reference-onlypull the published compile-fips base to copy pre-installed swimlane libs
10
- FROM ${COMPILE_BASE} AS compile-base-libs
11
- LABEL stage=compile-base-libs
12
- # Stage 2: builder — dev image has shell, apk, and pip for all build-time operations.
7
+ # Stage 1: builderdev image has shell, apk, and pip for all build-time operations.
13
8
  # The final FIPS image is distroless (no shell), so ALL RUN commands must happen here.
14
9
  FROM ${PYTHON_DEV_IMAGE} AS builder
15
10
  USER root
16
11
 
17
12
  # Carry over pre-installed swimlane SDK packages from the compile-fips base
18
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.10-latest /usr/local/lib /usr/local/lib
19
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.10-latest /usr/local/bin /usr/local/bin
20
-
13
+ COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.10-latest /usr/lib/python3.10/site-packages /usr/lib/python3.10/site-packages
21
14
 
22
15
  # Run compile-time OS package installs and custom scripts
23
16
  COPY compile.* /scripts/
@@ -25,10 +18,17 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
25
18
  RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
26
19
 
27
20
  # Run runner-time OS package installs and custom scripts here too,
28
- # since the final runner FIPS image has no shell
21
+ # since the final runner FIPS image has no shell.
22
+ # OS packages are installed into an isolated root (/runner-os-pkgs) so they can
23
+ # be selectively copied to the distroless runtime stage without leaking dev toolchain.
29
24
  COPY runner.* /scripts/
30
- RUN if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache $(cat /scripts/runner.txt); fi
31
- RUN if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && /scripts/runner.sh; fi
25
+ RUN mkdir -p /runner-os-pkgs && \
26
+ if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi
27
+ # RUNNER_FS is a staging directory that mirrors the runtime filesystem.
28
+ # runner.sh should write any runtime files (certs, configs, apk packages) under
29
+ # $RUNNER_FS so they are copied to the distroless runtime image correctly.
30
+ RUN mkdir -p /runner-fs && \
31
+ if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
32
32
 
33
33
  RUN rm -rf /scripts
34
34
 
@@ -39,19 +39,30 @@ RUN pip install --target /connector-deps -r requirements.txt
39
39
 
40
40
  # Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
41
41
  FROM ${RUNNER_IMAGE_NAME} AS runtime-image
42
- USER root
43
42
  ARG ASSET_KEYS
44
43
  ENV ASSET_KEYS=$ASSET_KEYS
45
44
 
45
+ # Copy runner OS packages installed in the isolated root during the builder stage.
46
+ COPY --from=builder /runner-os-pkgs /
47
+
48
+ # Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
49
+ COPY --from=builder /runner-fs /
50
+
51
+ # Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
52
+ # from the builder stage so they are available at runtime.
53
+ COPY --from=builder /usr/lib/python3.10/site-packages /usr/lib/python3.10/site-packages/
54
+
46
55
  # Copy only the connector-specific packages into site-packages.
47
56
  # The runner's own FIPS Python installation remains intact.
48
- COPY --from=builder /connector-deps /usr/local/lib/python3.10/site-packages/
57
+ COPY --from=builder /connector-deps /usr/lib/python3.10/site-packages/
49
58
 
50
59
  COPY connector /app
51
60
  WORKDIR /app
61
+ USER nonroot
52
62
  ENTRYPOINT ["python", "run.py"]
53
63
 
54
64
  FROM ${RUNTIME_IMAGE} AS connector-image
65
+ COPY --from=builder /bin/busybox /bin/sh
55
66
  {{#each labels}}
56
67
  LABEL {{{@key}}}="{{{this}}}"
57
68
  {{/each}}
@@ -1,22 +1,16 @@
1
1
  # syntax=docker/dockerfile:1.2
2
- ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.11-latest
3
-
4
2
  ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.11-latest
5
3
 
6
4
  ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.11-latest
7
5
  ARG RUNTIME_IMAGE=runtime-image
8
6
 
9
- # Stage 1: reference-onlypull the published compile-fips base to copy pre-installed swimlane libs
10
- FROM ${COMPILE_BASE} AS compile-base-libs
11
- LABEL stage=compile-base-libs
12
- # Stage 2: builder — dev image has shell, apk, and pip for all build-time operations.
7
+ # Stage 1: builderdev image has shell, apk, and pip for all build-time operations.
13
8
  # The final FIPS image is distroless (no shell), so ALL RUN commands must happen here.
14
9
  FROM ${PYTHON_DEV_IMAGE} AS builder
15
10
  USER root
16
11
 
17
12
  # Carry over pre-installed swimlane SDK packages from the compile-fips base
18
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.11-latest /usr/local/lib /usr/local/lib
19
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.11-latest /usr/local/bin /usr/local/bin
13
+ COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.11-latest /usr/lib/python3.11/site-packages /usr/lib/python3.11/site-packages
20
14
 
21
15
  # Run compile-time OS package installs and custom scripts
22
16
  COPY compile.* /scripts/
@@ -24,10 +18,23 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
24
18
  RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
25
19
 
26
20
  # Run runner-time OS package installs and custom scripts here too,
27
- # since the final runner FIPS image has no shell
21
+ # since the final runner FIPS image has no shell.
22
+ # OS packages are installed into an isolated root (/runner-os-pkgs) so they can
23
+ # be selectively copied to the distroless runtime stage without leaking dev toolchain.
28
24
  COPY runner.* /scripts/
29
- RUN if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache $(cat /scripts/runner.txt); fi
30
- RUN if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && /scripts/runner.sh; fi
25
+ RUN mkdir -p /runner-os-pkgs/etc/apk/keys && \
26
+ cp /etc/apk/repositories /runner-os-pkgs/etc/apk/repositories && \
27
+ cp /etc/apk/keys/* /runner-os-pkgs/etc/apk/keys/ && \
28
+ if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi && \
29
+ rm -rf /runner-os-pkgs/etc/passwd \
30
+ /runner-os-pkgs/etc/group \
31
+ /runner-os-pkgs/etc/shadow \
32
+ /runner-os-pkgs/etc/apk
33
+ # RUNNER_FS is a staging directory that mirrors the runtime filesystem.
34
+ # runner.sh should write any runtime files (certs, configs, apk packages) under
35
+ # $RUNNER_FS so they are copied to the distroless runtime image correctly.
36
+ RUN mkdir -p /runner-fs && \
37
+ if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
31
38
 
32
39
  RUN rm -rf /scripts
33
40
 
@@ -38,19 +45,30 @@ RUN pip install --target /connector-deps -r requirements.txt
38
45
 
39
46
  # Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
40
47
  FROM ${RUNNER_IMAGE_NAME} AS runtime-image
41
- USER root
42
48
  ARG ASSET_KEYS
43
49
  ENV ASSET_KEYS=$ASSET_KEYS
44
50
 
51
+ # Copy runner OS packages installed in the isolated root during the builder stage.
52
+ COPY --from=builder /runner-os-pkgs /
53
+
54
+ # Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
55
+ COPY --from=builder /runner-fs /
56
+
57
+ # Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
58
+ # from the builder stage so they are available at runtime.
59
+ COPY --from=builder /usr/lib/python3.11/site-packages /usr/lib/python3.11/site-packages/
60
+
45
61
  # Copy only the connector-specific packages into site-packages.
46
62
  # The runner's own FIPS Python installation remains intact.
47
- COPY --from=builder /connector-deps /usr/local/lib/python3.11/site-packages/
63
+ COPY --from=builder /connector-deps /usr/lib/python3.11/site-packages/
48
64
 
49
65
  COPY connector /app
50
66
  WORKDIR /app
67
+ USER nonroot
51
68
  ENTRYPOINT ["python", "run.py"]
52
69
 
53
70
  FROM ${RUNTIME_IMAGE} AS connector-image
71
+ COPY --from=builder /bin/busybox /bin/sh
54
72
  {{#each labels}}
55
73
  LABEL {{{@key}}}="{{{this}}}"
56
74
  {{/each}}
@@ -1,23 +1,16 @@
1
1
  # syntax=docker/dockerfile:1.2
2
- ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.12-latest
3
-
4
2
  ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.12-latest
5
3
 
6
4
  ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.12-latest
7
5
  ARG RUNTIME_IMAGE=runtime-image
8
6
 
9
- # Stage 1: reference-onlypull the published compile-fips base to copy pre-installed swimlane libs
10
- FROM ${COMPILE_BASE} AS compile-base-libs
11
- LABEL stage=compile-base-libs
12
- # Stage 2: builder — dev image has shell, apk, and pip for all build-time operations.
7
+ # Stage 1: builderdev image has shell, apk, and pip for all build-time operations.
13
8
  # The final FIPS image is distroless (no shell), so ALL RUN commands must happen here.
14
9
  FROM ${PYTHON_DEV_IMAGE} AS builder
15
10
  USER root
16
11
 
17
12
  # Carry over pre-installed swimlane SDK packages from the compile-fips base
18
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.12-latest /usr/local/lib /usr/local/lib
19
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.12-latest /usr/local/bin /usr/local/bin
20
-
13
+ COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.12-latest /usr/lib/python3.12/site-packages /usr/lib/python3.12/site-packages
21
14
 
22
15
  # Run compile-time OS package installs and custom scripts
23
16
  COPY compile.* /scripts/
@@ -25,10 +18,17 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
25
18
  RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
26
19
 
27
20
  # Run runner-time OS package installs and custom scripts here too,
28
- # since the final runner FIPS image has no shell
21
+ # since the final runner FIPS image has no shell.
22
+ # OS packages are installed into an isolated root (/runner-os-pkgs) so they can
23
+ # be selectively copied to the distroless runtime stage without leaking dev toolchain.
29
24
  COPY runner.* /scripts/
30
- RUN if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache $(cat /scripts/runner.txt); fi
31
- RUN if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && /scripts/runner.sh; fi
25
+ RUN mkdir -p /runner-os-pkgs && \
26
+ if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi
27
+ # RUNNER_FS is a staging directory that mirrors the runtime filesystem.
28
+ # runner.sh should write any runtime files (certs, configs, apk packages) under
29
+ # $RUNNER_FS so they are copied to the distroless runtime image correctly.
30
+ RUN mkdir -p /runner-fs && \
31
+ if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
32
32
 
33
33
  RUN rm -rf /scripts
34
34
 
@@ -39,19 +39,30 @@ RUN pip install --target /connector-deps -r requirements.txt
39
39
 
40
40
  # Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
41
41
  FROM ${RUNNER_IMAGE_NAME} AS runtime-image
42
- USER root
43
42
  ARG ASSET_KEYS
44
43
  ENV ASSET_KEYS=$ASSET_KEYS
45
44
 
45
+ # Copy runner OS packages installed in the isolated root during the builder stage.
46
+ COPY --from=builder /runner-os-pkgs /
47
+
48
+ # Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
49
+ COPY --from=builder /runner-fs /
50
+
51
+ # Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
52
+ # from the builder stage so they are available at runtime.
53
+ COPY --from=builder /usr/lib/python3.12/site-packages /usr/lib/python3.12/site-packages/
54
+
46
55
  # Copy only the connector-specific packages into site-packages.
47
56
  # The runner's own FIPS Python installation remains intact.
48
- COPY --from=builder /connector-deps /usr/local/lib/python3.12/site-packages/
57
+ COPY --from=builder /connector-deps /usr/lib/python3.12/site-packages/
49
58
 
50
59
  COPY connector /app
51
60
  WORKDIR /app
61
+ USER nonroot
52
62
  ENTRYPOINT ["python", "run.py"]
53
63
 
54
64
  FROM ${RUNTIME_IMAGE} AS connector-image
65
+ COPY --from=builder /bin/busybox /bin/sh
55
66
  {{#each labels}}
56
67
  LABEL {{{@key}}}="{{{this}}}"
57
68
  {{/each}}
@@ -1,24 +1,16 @@
1
1
  # syntax=docker/dockerfile:1.2
2
- ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.9-latest
3
-
4
2
  ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.9-latest
5
3
 
6
4
  ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.9-latest
7
5
  ARG RUNTIME_IMAGE=runtime-image
8
6
 
9
- # Stage 1: reference-onlypull the published compile-fips base to copy pre-installed swimlane libs
10
- FROM ${COMPILE_BASE} AS compile-base-libs
11
- LABEL stage=compile-base-libs
12
- # Stage 2: builder — dev image has shell, apk, and pip for all build-time operations.
7
+ # Stage 1: builderdev image has shell, apk, and pip for all build-time operations.
13
8
  # The final FIPS image is distroless (no shell), so ALL RUN commands must happen here.
14
9
  FROM ${PYTHON_DEV_IMAGE} AS builder
15
10
  USER root
16
11
 
17
12
  # Carry over pre-installed swimlane SDK packages from the compile-fips base
18
-
19
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.9-latest /usr/local/lib /usr/local/lib
20
- COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.9-latest /usr/local/bin /usr/local/bin
21
-
13
+ COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.9-latest /usr/lib/python3.9/site-packages /usr/lib/python3.9/site-packages
22
14
 
23
15
  # Run compile-time OS package installs and custom scripts
24
16
  COPY compile.* /scripts/
@@ -26,10 +18,23 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
26
18
  RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
27
19
 
28
20
  # Run runner-time OS package installs and custom scripts here too,
29
- # since the final runner FIPS image has no shell
21
+ # since the final runner FIPS image has no shell.
22
+ # OS packages are installed into an isolated root (/runner-os-pkgs) so they can
23
+ # be selectively copied to the distroless runtime stage without leaking dev toolchain.
30
24
  COPY runner.* /scripts/
31
- RUN if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache $(cat /scripts/runner.txt); fi
32
- RUN if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && /scripts/runner.sh; fi
25
+ RUN mkdir -p /runner-os-pkgs/etc/apk/keys && \
26
+ cp /etc/apk/repositories /runner-os-pkgs/etc/apk/repositories && \
27
+ cp /etc/apk/keys/* /runner-os-pkgs/etc/apk/keys/ && \
28
+ if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi && \
29
+ rm -rf /runner-os-pkgs/etc/passwd \
30
+ /runner-os-pkgs/etc/group \
31
+ /runner-os-pkgs/etc/shadow \
32
+ /runner-os-pkgs/etc/apk
33
+ # RUNNER_FS is a staging directory that mirrors the runtime filesystem.
34
+ # runner.sh should write any runtime files (certs, configs, apk packages) under
35
+ # $RUNNER_FS so they are copied to the distroless runtime image correctly.
36
+ RUN mkdir -p /runner-fs && \
37
+ if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
33
38
 
34
39
  RUN rm -rf /scripts
35
40
 
@@ -40,19 +45,30 @@ RUN pip install --target /connector-deps -r requirements.txt
40
45
 
41
46
  # Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
42
47
  FROM ${RUNNER_IMAGE_NAME} AS runtime-image
43
- USER root
44
48
  ARG ASSET_KEYS
45
49
  ENV ASSET_KEYS=$ASSET_KEYS
46
50
 
51
+ # Copy runner OS packages installed in the isolated root during the builder stage.
52
+ COPY --from=builder /runner-os-pkgs /
53
+
54
+ # Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
55
+ COPY --from=builder /runner-fs /
56
+
57
+ # Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
58
+ # from the builder stage so they are available at runtime.
59
+ COPY --from=builder /usr/lib/python3.9/site-packages /usr/lib/python3.9/site-packages/
60
+
47
61
  # Copy only the connector-specific packages into site-packages.
48
62
  # The runner's own FIPS Python installation remains intact.
49
- COPY --from=builder /connector-deps /usr/local/lib/python3.9/site-packages/
63
+ COPY --from=builder /connector-deps /usr/lib/python3.9/site-packages/
50
64
 
51
65
  COPY connector /app
52
66
  WORKDIR /app
67
+ USER nonroot
53
68
  ENTRYPOINT ["python", "run.py"]
54
69
 
55
70
  FROM ${RUNTIME_IMAGE} AS connector-image
71
+ COPY --from=builder /bin/busybox /bin/sh
56
72
  {{#each labels}}
57
73
  LABEL {{{@key}}}="{{{this}}}"
58
74
  {{/each}}
package/package.json CHANGED
@@ -9,9 +9,9 @@
9
9
  "@oclif/core": "2.8.5",
10
10
  "@oclif/plugin-help": "5.2.9",
11
11
  "@oclif/plugin-plugins": "3.1.2",
12
- "@sw-tsdk/common": "3.23.0-alpha.24827b5",
13
- "@sw-tsdk/core": "3.23.0-alpha.24827b5",
14
- "@sw-tsdk/docker": "3.23.0-alpha.24827b5",
12
+ "@sw-tsdk/common": "3.23.0-alpha.5b3d9ec",
13
+ "@sw-tsdk/core": "3.23.0-alpha.5b3d9ec",
14
+ "@sw-tsdk/docker": "3.23.0-alpha.5b3d9ec",
15
15
  "@swimlane/connector-interfaces": "1.11.0",
16
16
  "@swimlane/cosign": "1.4.1",
17
17
  "archiver": "5.3.1",
@@ -66,6 +66,6 @@
66
66
  "test": "jest --passWithNoTests"
67
67
  },
68
68
  "types": "lib/index.d.ts",
69
- "version": "3.23.0-alpha.24827b5",
70
- "gitHead": "24827b5a6055cf3592906d105357ae5589c04efc"
69
+ "version": "3.23.0-alpha.5b3d9ec",
70
+ "gitHead": "5b3d9ec2021ddce7964b0cd920030fee2876557a"
71
71
  }