remove wget/curl

[emilburzo]

The only consumers I could find that need curl/wget are:

• https://github.com/goauthentik/authentik/blob/main/lifecycle/container/Dockerfile
• https://github.com/goauthentik/authentik/blob/main/lifecycle/container/proxy.Dockerfile

Both depend on curl for rustup. I will adjust them in a follow-up bump PR.

[github-actions]

authentik FIPS Image build status - debian-fips (``)

Image built: ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips-debian
full=ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-178
### Debian version ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-178 \
	cat /etc/debian_version
13.6
### Test that base images has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-178 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.7
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.7
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active

[github-actions]

authentik FIPS Image build status - debian-fips-dev (``)

Image built: ghcr.io/goauthentik/fips-debian:trixie-slim-fips-dev-pr-178 for commit 42b32956ca586f3a1150fe38aaeebb55f523bb4b

Test output:

image=ghcr.io/goauthentik/fips-debian
full=ghcr.io/goauthentik/fips-debian:trixie-slim-fips-dev-pr-178
### Test that the dev image has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-dev-pr-178 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.6
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.6
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active
### Test that the dev image has build tooling ###
docker run --rm --entrypoint sh ghcr.io/goauthentik/fips-debian:trixie-slim-fips-dev-pr-178 -c \
	'command -v curl && command -v wget && dpkg -s libssl-dev >/dev/null && echo "build tooling present"'
/usr/bin/curl
/usr/bin/wget
build tooling present

[rissson]

FYI we use the debian-fips image in other places than the main image, like outposts, website, and infra stuff maybe?

[BeryJu]

I think outposts is the only other one, along side customer portal

[github-actions]

authentik FIPS Image build status - xmlsec1-fips (``)

Image built: ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips-xmlsec1
full=ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-178
### Test that base images has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-178 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.7
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.7
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active
### xmlsec1 version ###
docker run --rm ghcr.io/goauthentik/fips-xmlsec1:1.3.12-slim-trixie-fips-pr-178 \
	xmlsec1 --version
xmlsec1 1.3.12 (openssl)

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.14.7)

Image built: ghcr.io/goauthentik/fips-python:3.14.7-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.14.7-slim-trixie-fips-pr-178
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.14.7-slim-trixie-fips-pr-178 \
	python --version
Python 3.14.7
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.14.7-slim-trixie-fips-pr-178 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.7+ak-fips 9 Jun 2026

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.13.9)

Image built: ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-178
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-178 \
	python --version
Python 3.13.9
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-178 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.7+ak-fips 9 Jun 2026

[github-actions]

authentik FIPS Image build status - python-fips-freethreading (PYTHON_VERSION=3.13.9)

Image built: ghcr.io/goauthentik/fips:3.13.9t-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips
full=ghcr.io/goauthentik/fips:3.13.9t-slim-trixie-fips-pr-178
### Python version ###
docker run --rm ghcr.io/goauthentik/fips:3.13.9t-slim-trixie-fips-pr-178 \
	python --version
Python 3.13.9
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips:3.13.9t-slim-trixie-fips-pr-178 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.7+ak-fips 9 Jun 2026
### Python freethreading ###
docker run --rm ghcr.io/goauthentik/fips:3.13.9t-slim-trixie-fips-pr-178 \
	python -c "import sys; print('Freethreading status:', sys._is_gil_enabled())"
Freethreading status: True

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.15.0rc1)

Image built: ghcr.io/goauthentik/fips-python:3.15.0rc1-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.15.0rc1-slim-trixie-fips-pr-178
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.15.0rc1-slim-trixie-fips-pr-178 \
	python --version
Python 3.15.0rc1
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.15.0rc1-slim-trixie-fips-pr-178 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.7+ak-fips 9 Jun 2026

[github-actions]

authentik FIPS Image build status - python-fips-freethreading (PYTHON_VERSION=3.14.7)

Image built: ghcr.io/goauthentik/fips:3.14.7t-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips
full=ghcr.io/goauthentik/fips:3.14.7t-slim-trixie-fips-pr-178
### Python version ###
docker run --rm ghcr.io/goauthentik/fips:3.14.7t-slim-trixie-fips-pr-178 \
	python --version
Python 3.14.7
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips:3.14.7t-slim-trixie-fips-pr-178 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.7+ak-fips 9 Jun 2026
### Python freethreading ###
docker run --rm ghcr.io/goauthentik/fips:3.14.7t-slim-trixie-fips-pr-178 \
	python -c "import sys; print('Freethreading status:', sys._is_gil_enabled())"
Freethreading status: True

[github-actions]

authentik FIPS Image build status - python-fips-freethreading (PYTHON_VERSION=3.15.0rc1)

Image built: ghcr.io/goauthentik/fips:3.15.0rc1t-slim-trixie-fips-pr-178 for commit 5cb21e22d075eb51ae13634ee4e069c380a5447a

Test output:

image=ghcr.io/goauthentik/fips
full=ghcr.io/goauthentik/fips:3.15.0rc1t-slim-trixie-fips-pr-178
### Python version ###
docker run --rm ghcr.io/goauthentik/fips:3.15.0rc1t-slim-trixie-fips-pr-178 \
	python --version
Python 3.15.0rc1
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips:3.15.0rc1t-slim-trixie-fips-pr-178 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.7+ak-fips 9 Jun 2026
### Python freethreading ###
docker run --rm ghcr.io/goauthentik/fips:3.15.0rc1t-slim-trixie-fips-pr-178 \
	python -c "import sys; print('Freethreading status:', sys._is_gil_enabled())"
Freethreading status: True

[Copilot]

Pull request overview

This PR reduces the runtime package footprint of the debian-fips image by removing wget and curl from the final stage, keeping only ca-certificates installed there. This aligns with the stated goal of removing these network download utilities from the image surface area.

Changes:

• Remove wget and curl from the final-stage apt-get install in debian-fips/Dockerfile.
• Keep ca-certificates installed to preserve TLS trust store availability.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.