Build libpng 1.6.56 package

New versions of the chronically RCE-vulnerable libpng reach Alpine 3.22 too slowly, so build it ourselves for now. (I’m still working on various other changes to reduce the impact of codec vulnerabilities.)

Author: charmander

.dockerignore

@@ -12,6 +12,8 @@
 !deno.json
 !deno.lock
 
+!libpng/APKBUILD
+
 !imagemagick-policy.xml
 !setup.cfg
 !setup.py

Dockerfile

@@ -46,6 +46,26 @@ RUN --mount=type=bind,from=mozjpeg-src,source=/mozjpeg-build/mozjpeg-4.1.5,targe
     && cmake --build . --parallel --target install
 
 
+FROM docker.io/library/alpine:3.22 AS libpng-package
+RUN --network=none adduser -S build -h /libpng-build
+RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
+    ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
+    abuild \
+    musl-dev gcc make \
+    gawk autoconf automake libtool \
+    zlib-dev
+USER build
+WORKDIR /libpng-build/libpng
+ADD --checksum=sha256:f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18 --chown=build --link https://sourceforge.net/projects/libpng/files/libpng16/1.6.56/libpng-1.6.56.tar.xz/download ./libpng-1.6.56.tar.xz
+ADD --checksum=sha256:017c06f75ffed25f6cda9b5369ec6da0ac35a6616adf7abe4222516a0237f37a --chown=build --link https://sourceforge.net/projects/libpng-apng/files/libpng16/1.6.55/libpng-1.6.55-apng.patch.gz/download ./libpng-1.6.55-apng.patch.gz
+# TODO: craft deterministic dummy-abuild.key and copy it in alongside APKBUILD
+RUN --network=none openssl genrsa -out dummy-abuild.key 512
+COPY --chown=build --link ./libpng/APKBUILD ./
+RUN --network=none \
+    PACKAGER_PRIVKEY=/libpng-build/libpng/dummy-abuild.key \
+    abuild -P /libpng-build/packages -c verify unpack prepare build rootpkg clean
+
+
 FROM docker.io/library/alpine:3.22 AS imagemagick6-src
 RUN --network=none adduser -S build -h /imagemagick6-build
 USER build
@@ -58,12 +78,18 @@ FROM docker.io/library/alpine:3.22 AS imagemagick6-build
 RUN --network=none adduser -S build -h /imagemagick6-build
 RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
     ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
+    zlib-dev
+RUN --network=none \
+    --mount=type=bind,from=libpng-package,source=/libpng-build/packages/libpng-build/x86_64,target=/run/libpng-packages,ro \
+    apk add --no-network --allow-untrusted \
+    /run/libpng-packages/libpng-1.6.56-r0.apk \
+    /run/libpng-packages/libpng-dev-1.6.56-r0.apk
+RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
+    apk add \
     musl-dev gcc make \
     lcms2-dev \
-    libpng-dev \
     libxml2-dev \
-    libwebp-dev \
-    zlib-dev
+    libwebp-dev
 USER build
 COPY --from=mozjpeg --chown=root:root --link /mozjpeg-build/package-root/include/ /usr/include/
 COPY --from=mozjpeg --chown=root:root --link /mozjpeg-build/package-root/lib64/ /usr/lib/
@@ -157,7 +183,14 @@ FROM docker.io/library/python:3.10-alpine3.22 AS package
 # libpq: psycopg2
 RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
     ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
-    libgcc libgomp lcms2 libpng libxml2 libwebpdemux libwebpmux \
+    zlib
+RUN --network=none \
+    --mount=type=bind,from=libpng-package,source=/libpng-build/packages/libpng-build/x86_64,target=/run/libpng-packages,ro \
+    apk add --no-network --allow-untrusted \
+    /run/libpng-packages/libpng-1.6.56-r0.apk
+RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
+    apk add \
+    libgcc libgomp lcms2 libxml2 libwebpdemux libwebpmux \
     libmemcached-libs \
     libpq
 RUN adduser -S weasyl -h /weasyl -u 1000

libpng-APKBUILD

@@ -0,0 +1,47 @@
+# Contributor: Carlo Landmeter <clandmeter@alpinelinux.org>
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=libpng
+pkgver=1.6.56
+_apng_version=1.6.55
+pkgrel=0
+pkgdesc="Portable Network Graphics library"
+url="http://www.libpng.org"
+arch="all"
+license="Libpng"
+makedepends_build="gawk autoconf automake libtool"
+makedepends_host="zlib-dev"
+subpackages="$pkgname-doc $pkgname-static $pkgname-dev $pkgname-utils"
+source="libpng-$pkgver.tar.xz
+	libpng-$_apng_version-apng.patch.gz
+	"
+
+build() {
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var
+	make
+}
+
+check() {
+	make check
+}
+
+package() {
+	make DESTDIR="$pkgdir" install
+	rm -f "$pkgdir"/usr/lib/*.la
+}
+
+utils() {
+	pkgdesc="$pkgdesc (pngfix utils)"
+
+	amove usr/bin
+}
+
+sha512sums="
+e405c46d7c9cf8c6c9fb6cf35b7e8498bb863bb24a918f4a6b1aca9f1e61d8b9feb46cb67a5478b6d87da74b2baf1d1f25c43889866408fc23c0ac498094081f  libpng-1.6.56.tar.xz
+2f85d3b7c6341245a56029f2dd8de6fd59f2950f9030ecb3f8b7c07ba753f3deb8345077aa167f3efe0628089818608e7e780415530a8ca51fa77fc256daaa74  libpng-1.6.55-apng.patch.gz
+"