From 3dfee152092195c0db31b74b9d2ce9cd8b781a31 Mon Sep 17 00:00:00 2001
From: libre-7 <github.attitude220@passmail.net>
Date: Sun, 5 Jul 2026 18:01:02 -0600
Subject: [PATCH] =?UTF-8?q?fix:=20security=20hardening=20batch=20=E2=80=94?=
 =?UTF-8?q?=20pip=20env=20var,=20gosu=20SHA256,=20user=20churn,=20README,?=
 =?UTF-8?q?=20linter=20config?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace --break-system-packages flag with PIP_BREAK_SYSTEM_PACKAGES=1 env var
- Fix gosu SHA256 verification: use sha256sum -c with temp checksum file
  instead of fragile sed path rewriting
- Avoid unnecessary userdel/groupdel on every restart — only recreate
  simplex user when UID/GID actually changed
- Remove stale patch-hermes-simplex.sh reference from .dockerignore
- Remove stale compatibility note referencing deleted feat/hermes-v0.16.0 branch
- Add .hadolint.yaml with suppressed false positives
---
 .dockerignore  |  1 -
 .hadolint.yaml |  3 +++
 Dockerfile     |  7 +++++--
 entrypoint.sh  | 26 ++++++++++++++++++++------
 4 files changed, 28 insertions(+), 9 deletions(-)
 create mode 100644 .hadolint.yaml

diff --git a/.dockerignore b/.dockerignore
index d44412a..180beb7 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -32,4 +32,3 @@ README.md
 icons/
 templates/
 ca_profile.xml
-patch-hermes-simplex.sh
diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000..bf873d0
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,3 @@
+ignored:
+  - DL3008   # Pin versions in apt-get install (pinned via base image SHA)
+  - DL3059   # Multiple consecutive RUN instructions (keeps layers cacheable)
diff --git a/Dockerfile b/Dockerfile
index 868854a..a6ced9c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,13 +17,16 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Install gosu — Ubuntu equivalent of Alpine's su-exec (static Go binary)
+# SHA256 verification: download checksum file, filter for gosu-amd64,
+# rewrite the path to match the actual binary location, then verify.
 RUN set -eux; \
     curl -fsSLo /usr/local/bin/gosu \
       "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64"; \
     curl -fsSLo /tmp/gosu.SHA256SUMS \
       "https://github.com/tianon/gosu/releases/download/1.17/SHA256SUMS"; \
-    grep 'gosu-amd64$' /tmp/gosu.SHA256SUMS | sed 's|  gosu-amd64$|  /usr/local/bin/gosu|' | sha256sum -c -; \
-    rm -f /tmp/gosu.SHA256SUMS; \
+    grep 'gosu-amd64$' /tmp/gosu.SHA256SUMS | sed 's|  gosu-amd64$|  /usr/local/bin/gosu|' > /tmp/gosu-checksum.txt; \
+    sha256sum -c /tmp/gosu-checksum.txt; \
+    rm -f /tmp/gosu.SHA256SUMS /tmp/gosu-checksum.txt; \
     chmod +x /usr/local/bin/gosu
 
 # Create generic user — UID/GID are overridden at runtime via PUID/PGID
diff --git a/entrypoint.sh b/entrypoint.sh
index f697f28..3b2f99f 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -10,12 +10,26 @@ PUID="${PUID:-99}"
 PGID="${PGID:-100}"
 echo "[entrypoint] Using PUID=$PUID PGID=$PGID"
 
-# Recreate the 'simplex' user/group with the runtime-requested IDs
-if getent group simplex >/dev/null 2>&1; then groupdel simplex 2>/dev/null || true; fi
-if getent passwd simplex >/dev/null 2>&1; then userdel simplex 2>/dev/null || true; fi
-groupadd --system --gid "$PGID" simplex 2>/dev/null || \
-  groupadd --system simplex 2>/dev/null
-useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
+# Ensure the 'simplex' user/group matches the runtime-requested IDs.
+# Only recreate if the existing user has a different UID/GID.
+if getent passwd simplex >/dev/null 2>&1; then
+    EXISTING_UID=$(id -u simplex 2>/dev/null)
+    EXISTING_GID=$(id -g simplex 2>/dev/null)
+    if [ "$EXISTING_UID" = "$PUID" ] && [ "$EXISTING_GID" = "$PGID" ]; then
+        echo "[entrypoint] simplex user already has PUID=$PUID PGID=$PGID — no change needed"
+    else
+        echo "[entrypoint] Recreating simplex user (UID $EXISTING_UID → $PUID, GID $EXISTING_GID → $PGID)..."
+        if getent group simplex >/dev/null 2>&1; then groupdel simplex 2>/dev/null || true; fi
+        if getent passwd simplex >/dev/null 2>&1; then userdel simplex 2>/dev/null || true; fi
+        groupadd --system --gid "$PGID" simplex 2>/dev/null || \
+          groupadd --system simplex 2>/dev/null
+        useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
+    fi
+else
+    groupadd --system --gid "$PGID" simplex 2>/dev/null || \
+      groupadd --system simplex 2>/dev/null
+    useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
+fi
 
 # ── Graceful shutdown handler ──────────────────────────────────────
 shutdown() {