Skip to content

Commit 2415501

Browse files
jkneubuhjkneubuh
committed
Switch base docker image from golang-alpine to ubuntu:20.04
Signed-off-by: Josh Kneubuhl <jkneubuh@us.ibm.com>
1 parent ea775ed commit 2415501

File tree

4 files changed

+107
-31
lines changed

4 files changed

+107
-31
lines changed

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ on:
99
tags: [ v1.* ]
1010

1111
env:
12-
GO_VER: 1.18.8
13-
ALPINE_VER: 3.17
14-
REGISTRY: docker.io # or ghcr.io
12+
GO_VER: 1.18.9
13+
UBUNTU_VER: 20.04
14+
DOCKER_REGISTRY: ${{ github.repository_owner == 'hyperledger' && 'docker.io' || 'ghcr.io' }}
1515
IMAGE_NAME: ${{ github.repository }}
1616

1717
permissions:
@@ -75,18 +75,18 @@ jobs:
7575
- name: Checkout
7676
uses: actions/checkout@v3
7777

78-
- name: Login to the ${{ env.REGISTRY }} Container Registry
78+
- name: Login to the ${{ env.DOCKER_REGISTRY }} Container Registry
7979
uses: docker/login-action@v2
8080
with:
81-
registry: ${{ env.REGISTRY }}
82-
username: ${{ contains(env.REGISTRY, 'docker.io') && secrets.DOCKERHUB_USERNAME || github.actor }}
83-
password: ${{ contains(env.REGISTRY, 'docker.io') && secrets.DOCKERHUB_TOKEN || secrets.GITHUB_TOKEN }}
81+
registry: ${{ env.DOCKER_REGISTRY }}
82+
username: ${{ env.DOCKER_REGISTRY == 'docker.io' && secrets.DOCKERHUB_USERNAME || github.actor }}
83+
password: ${{ env.DOCKER_REGISTRY == 'docker.io' && secrets.DOCKERHUB_TOKEN || secrets.GITHUB_TOKEN }}
8484

8585
- name: Docker meta
8686
id: meta
8787
uses: docker/metadata-action@v4
8888
with:
89-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
89+
images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
9090
tags: |
9191
type=semver,pattern={{version}}
9292
type=semver,pattern={{major}}.{{minor}}
@@ -109,10 +109,10 @@ jobs:
109109
push: ${{ github.event_name != 'pull_request' }}
110110
labels: ${{ steps.meta.outputs.labels }}
111111
build-args: |
112-
ALPINE_VER=${{ env.ALPINE_VER }}
112+
UBUNTU_VER=${{ env.UBUNTU_VER }}
113113
GO_VER=${{ env.GO_VER }}
114114
GO_TAGS=pkcs11
115-
GO_LDFLAGS=-X github.com/hyperledger/fabric-ca/lib/metadata.Version=${{ github.ref_name }} -linkmode external -extldflags '-lpthread -static'
115+
GO_LDFLAGS=-X github.com/hyperledger/fabric-ca/lib/metadata.Version=${{ github.ref_name }}
116116
117117
118118
create-release:

‎Makefile‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@
2929

3030
PROJECT_NAME = fabric-ca
3131

32-
GO_VER = 1.18.8
33-
ALPINE_VER ?= 3.17
32+
GO_VER = 1.18.9
33+
UBUNTU_VER ?= 20.04
3434
DEBIAN_VER ?= stretch
3535
BASE_VERSION ?= v1.5.6
3636

@@ -40,6 +40,7 @@ PLATFORM=$(shell go env GOOS)-$(shell go env GOARCH)
4040
# For compatibility with legacy install-fabric.sh conventions, strip the
4141
# leading semrev 'v' character when preparing dist and release artifacts.
4242
RELEASE_VERSION=$(shell echo $(BASE_VERSION) | sed -e 's/^v\(.*\)/\1/')
43+
PROJECT_VERSION=${RELEASE_VERSION}
4344

4445
PG_VER=11
4546

@@ -108,9 +109,9 @@ build/image/fabric-ca/$(DUMMY):
108109
--build-arg GO_VER=${GO_VER} \
109110
--build-arg GO_TAGS=pkcs11 \
110111
--build-arg GO_LDFLAGS="${DOCKER_GO_LDFLAGS}" \
111-
--build-arg ALPINE_VER=${ALPINE_VER} \
112+
--build-arg UBUNTU_VER=${UBUNTU_VER} \
112113
-t $(DOCKER_NS)/$(TARGET) .
113-
docker tag $(DOCKER_NS)/$(TARGET) $(DOCKER_NS)/$(TARGET):$(BASE_VERSION)
114+
docker tag $(DOCKER_NS)/$(TARGET) $(DOCKER_NS)/$(TARGET):$(PROJECT_VERSION)
114115
docker tag $(DOCKER_NS)/$(TARGET) $(DOCKER_NS)/$(TARGET):$(DOCKER_TAG)
115116
@touch $@
116117

‎images/fabric-ca/Dockerfile‎

Lines changed: 44 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,58 @@
33
#
44
# SPDX-License-Identifier: Apache-2.0
55
#
6-
ARG GO_VER
7-
ARG ALPINE_VER
86

9-
FROM golang:${GO_VER}-alpine as builder
7+
###############################################################################
8+
# Build image
9+
###############################################################################
10+
11+
ARG UBUNTU_VER
12+
FROM ubuntu:${UBUNTU_VER} as builder
13+
14+
ARG TARGETARCH
15+
ARG TARGETOS
16+
ARG GO_VER
1017
ARG GO_LDFLAGS
1118
ARG GO_TAGS
1219

13-
RUN apk add --no-cache \
14-
gcc \
15-
binutils-gold \
16-
git \
17-
musl-dev;
20+
RUN apt update && apt install -y \
21+
gcc \
22+
binutils-gold \
23+
git \
24+
curl \
25+
make
26+
27+
RUN curl -sL https://go.dev/dl/go${GO_VER}.${TARGETOS}-${TARGETARCH}.tar.gz | tar zxf - -C /usr/local
28+
ENV GOBIN="/usr/local/go/bin"
29+
ENV PATH="$GOBIN:$PATH"
1830

1931
ADD . /build/fabric-ca
2032
WORKDIR /build/fabric-ca
21-
RUN go install -tags "${GO_TAGS}" -ldflags "${GO_LDFLAGS}" \
22-
github.com/hyperledger/fabric-ca/cmd/fabric-ca-server \
23-
&& go install -tags "${GO_TAGS}" -ldflags "${GO_LDFLAGS}" \
24-
github.com/hyperledger/fabric-ca/cmd/fabric-ca-client
2533

34+
RUN go install \
35+
-tags "${GO_TAGS}" \
36+
-ldflags "${GO_LDFLAGS}" \
37+
github.com/hyperledger/fabric-ca/cmd/fabric-ca-server
38+
39+
RUN go install \
40+
-tags "${GO_TAGS}" \
41+
-ldflags "${GO_LDFLAGS}" \
42+
github.com/hyperledger/fabric-ca/cmd/fabric-ca-client
43+
44+
45+
###############################################################################
46+
# Runtime image
47+
###############################################################################
48+
49+
ARG UBUNTU_VER
50+
FROM ubuntu:${UBUNTU_VER}
51+
52+
RUN apt update
53+
RUN DEBIAN_FRONTEND=noninteractive apt install -y tzdata
2654

27-
FROM alpine:${ALPINE_VER}
28-
RUN apk add --no-cache \
29-
tzdata;
3055
ENV FABRIC_CA_HOME /etc/hyperledger/fabric-ca-server
31-
COPY --from=builder /go/bin /usr/local/bin
56+
COPY --from=builder /usr/local/go/bin /usr/local/bin
57+
3258
EXPOSE 7054
33-
CMD fabric-ca-server start -b admin:adminpw
59+
60+
CMD [ "fabric-ca-server", "start", "-b", "admin:adminpw" ]

‎release_notes/v1.5.6-beta3.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
v1.5.6-beta3 Release Notes - Jan 3, 2023
2+
===================================
3+
4+
v1.5.6-beta3 is a beta release, providing updates for the following issues in the Fabric CA:
5+
6+
- Builds native arm64 CA binaries for linux and darwin
7+
- Builds multi-platform CA docker images for arm64 and amd64 with `buildx`
8+
- Builds CA docker images FROM ubuntu:20.04 (avoid SIGSEGV errors encountered with dynamic builds on musl/alpine libc)
9+
- Adds debug information for a mysterious [idemix error message](https://github.com/hyperledger/fabric-ca/pull/339)
10+
- Bumps Go version to 1.18.9
11+
12+
Dependencies
13+
------------
14+
15+
Fabric CA v1.5.6 has been tested with the following dependencies:
16+
- Go 1.18.9
17+
- Ubuntu 20.04 (for Docker images)
18+
19+
20+
Changes, Known Issues, and Workarounds
21+
--------------------------------------
22+
23+
None.
24+
25+
Known Vulnerabilities
26+
---------------------
27+
- FABC-174 Commands can be manipulated to delete identities or affiliations
28+
29+
This vulnerability can be resolved in one of two ways:
30+
31+
1) Use HTTPS (TLS) so that the authorization header is not in clear text.
32+
33+
2) The token generation/authentication mechanism was improved to optionally prevent
34+
token reuse. As of v1.4 a more secure token can be used by setting environment variable:
35+
36+
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
37+
38+
However, it cannot be set to false until all clients have
39+
been updated to generate the more secure token and tolerate
40+
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false.
41+
The Fabric CA client has been updated in v1.4 to generate the more secure token.
42+
The Fabric SDKs will be updated by v2.0 timeframe to generate the more secure token,
43+
at which time the default for Fabric CA server will change to:
44+
FABRIC_CA_SERVER_COMPATIBILITY_MODE_V1_3=false
45+
46+
Resolved Vulnerabilities
47+
------------------------
48+
None.

0 commit comments

Comments
 (0)