Skip to content

fix: security hardening batch — pip env var, gosu SHA256, user churn, README, linter config #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
libre-7 merged 1 commit into from
Aug 24, 2026
Merged

fix: security hardening batch — pip env var, gosu SHA256, user churn, README, linter config #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,4 +32,3 @@ README.md
icons/
templates/
ca_profile.xml
patch-hermes-simplex.sh
3 changes: 3 additions & 0 deletions .hadolint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
ignored:
- DL3008 # Pin versions in apt-get install (pinned via base image SHA)
- DL3059 # Multiple consecutive RUN instructions (keeps layers cacheable)
7 changes: 5 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,16 @@
rm -rf /var/lib/apt/lists/*

# Install gosu — Ubuntu equivalent of Alpine's su-exec (static Go binary)
# SHA256 verification: download checksum file, filter for gosu-amd64,
# rewrite the path to match the actual binary location, then verify.
RUN set -eux; \

Check failure on line 22 in Dockerfile

View workflow job for this annotation

GitHub Actions / lint 

DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
curl -fsSLo /usr/local/bin/gosu \
"https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64"; \
curl -fsSLo /tmp/gosu.SHA256SUMS \
"https://github.com/tianon/gosu/releases/download/1.17/SHA256SUMS"; \
grep 'gosu-amd64$' /tmp/gosu.SHA256SUMS | sed 's| gosu-amd64$| /usr/local/bin/gosu|' | sha256sum -c -; \
rm -f /tmp/gosu.SHA256SUMS; \
grep 'gosu-amd64$' /tmp/gosu.SHA256SUMS | sed 's| gosu-amd64$| /usr/local/bin/gosu|' > /tmp/gosu-checksum.txt; \
sha256sum -c /tmp/gosu-checksum.txt; \
rm -f /tmp/gosu.SHA256SUMS /tmp/gosu-checksum.txt; \
chmod +x /usr/local/bin/gosu

# Create generic user — UID/GID are overridden at runtime via PUID/PGID
Expand All @@ -36,7 +39,7 @@
# Install simplex-chat CLI binary (static Haskell binary, ~72MB, x86_64 only)
# NOTE: Only linux/amd64 is supported — no ARM binary is published upstream.
# SHA256 from: https://github.com/simplex-chat/simplex-chat/releases/tag/v6.5.1
RUN set -eux; \

Check failure on line 42 in Dockerfile

View workflow job for this annotation

GitHub Actions / lint 

DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
curl -fsSL -o /usr/local/bin/simplex-chat \
"https://github.com/simplex-chat/simplex-chat/releases/download/v6.5.1/simplex-chat-ubuntu-24_04-x86_64"; \
echo "b1ca4f75a5d8498c66c4bf16db9d8726f685a1644c3617218a0c055cc9dd2f76 /usr/local/bin/simplex-chat" | sha256sum -c -; \
Expand Down Expand Up @@ -67,5 +70,5 @@
# sending a valid API command. Any response (including error) confirms
# the process is live and accepting connections.
# Falls back to TCP port check if Python websockets is unavailable.
HEALTHCHECK --start-period=10s --interval=30s --timeout=10s --retries=3 \

Check failure on line 73 in Dockerfile

View workflow job for this annotation

GitHub Actions / lint 

DL3025 warning: Use arguments JSON notation for CMD and ENTRYPOINT arguments
CMD python3 /healthcheck.py
26 changes: 20 additions & 6 deletions entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,26 @@ PUID="${PUID:-99}"
PGID="${PGID:-100}"
echo "[entrypoint] Using PUID=$PUID PGID=$PGID"

# Recreate the 'simplex' user/group with the runtime-requested IDs
if getent group simplex >/dev/null 2>&1; then groupdel simplex 2>/dev/null || true; fi
if getent passwd simplex >/dev/null 2>&1; then userdel simplex 2>/dev/null || true; fi
groupadd --system --gid "$PGID" simplex 2>/dev/null || \
groupadd --system simplex 2>/dev/null
useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
# Ensure the 'simplex' user/group matches the runtime-requested IDs.
# Only recreate if the existing user has a different UID/GID.
if getent passwd simplex >/dev/null 2>&1; then
EXISTING_UID=$(id -u simplex 2>/dev/null)
EXISTING_GID=$(id -g simplex 2>/dev/null)
if [ "$EXISTING_UID" = "$PUID" ] && [ "$EXISTING_GID" = "$PGID" ]; then
echo "[entrypoint] simplex user already has PUID=$PUID PGID=$PGID — no change needed"
else
echo "[entrypoint] Recreating simplex user (UID $EXISTING_UID → $PUID, GID $EXISTING_GID → $PGID)..."
if getent group simplex >/dev/null 2>&1; then groupdel simplex 2>/dev/null || true; fi
if getent passwd simplex >/dev/null 2>&1; then userdel simplex 2>/dev/null || true; fi
groupadd --system --gid "$PGID" simplex 2>/dev/null || \
groupadd --system simplex 2>/dev/null
useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
fi
else
groupadd --system --gid "$PGID" simplex 2>/dev/null || \
groupadd --system simplex 2>/dev/null
useradd --system --no-log-init -g simplex -u "$PUID" --create-home simplex
fi

# ── Graceful shutdown handler ──────────────────────────────────────
shutdown() {
Expand Down