code-9c3ec0a5c7fc/scripts/Docker/Dockerfile0000644000000000000000000002400415165601534016771 0ustar 00000000000000# hadolint global ignore=DL3003 # build in root dir using: # # docker build -t roundup-app --rm -f scripts/Dockerfile . # # run using: # # docker run --rm -v /.../issue.tracker:/usr/src/app/tracker \ # -p 9017:8080 roundup-app:latest # arguments expected to be useful on command line. Lower case names. # Source of roundup code: # 'local' directory using setup.py, # 'pypi[...]' to install latest final or version specified release # from PyPI, E.G. pypi=2.4; pypi<2.3 etc. All pip version specifiers # are allowed. # 'pip_local' local directory using pip to install, or # 'pip_sdist' to install dist/newest_version-tarball ARG source=local # Internal settings that are for advanced users to override. # parameterize the sha256 sum to pin version of python:3-alpine # Must use the same version in both build stages. # Note this is the index digest for the image, not the manifest digest. # The index digest is shared across archetectures (amd64, arm64 etc.) # while the manifest digest is unique per platform/arch. ARG SHA256=faee120f7885a06fcc9677922331391fa690d911c020abb9e8025ff3d908e510 # Set to any non-empty value to enable shell debugging for troubleshooting ARG VERBOSE= # application directory ARG appdir=/usr/src/app # Python version as a.b Used as path component for # installation directory and COPY from install dir # in second build stage. ARG pythonversion=3.14 #FROM python:3-alpine via SHA256 sum FROM python@sha256:$SHA256 AS build # Inherit global values https://github.com/moby/moby/issues/37345 ARG appdir WORKDIR $appdir # Update to get security and other improvements; # Add packages needed to compile mysql, pgsql and other python modules. # Can't use apk to add python packages as it installs for base image # in /usr. # g++ installs cc1plus needed by pip install RUN apk --no-cache upgrade; \ apk --no-cache add \ file \ g++ \ gcc \ gpgme-dev \ libxapian \ linux-headers \ make \ musl-dev \ mysql-dev \ postgresql-dev \ swig \ xapian-core-dev ARG pythonversion # verify that pythonversion matches the one in the image. RUN image_python_version=$(python -c 'import sys; print("%s.%s"%sys.version_info[0:2])'); \ if [ "${pythonversion}" != "${image_python_version}" ]; then \ printf "\n\n*****\npythonversion does not match.\n" ; \ printf "Add:\n --build-arg=\"pythonversion=%s\"\nto docker build\n******\n\n" "${image_python_version}"; \ exit 1; \ fi # build xapian bindings: # file with sphinx build dependencies to remove after build # they are over 70MB of space. COPY scripts/Docker/sphinxdeps.txt . # suppress warning when running pip as root ENV PIP_ROOT_USER_ACTION=ignore # force embedded script to fail on any error "-e" # including in a pipeline (-o pipefail) (note pipefail # is not documented, but setting it isn;t an error and # works in testing) SHELL ["/bin/ash", "-eo", "pipefail", "-c"] ARG VERBOSE ARG pythonversion RUN [ -z "${VERBOSE}" ] || set -xv; \ CWD="$PWD" && \ upgrades="$(python3 -m pip --no-cache-dir --disable-pip-version-check \ list --outdated | awk 'NR > 2 {print $1}')"; \ if [ -n "$upgrades" ]; then \ echo "Pip updating $upgrades"; \ python -m pip --no-cache-dir --disable-pip-version-check \ install -U $upgrades < /dev/null; \ else \ echo "Nothing to pip update"; \ fi; \ ls -l "/usr/local/lib/python${pythonversion}/site-packages"; \ VER=$(apk list -I 'xapian-core-dev' | \ sed 's/^xapian-core-dev-\([0-9.]*\)-.*/\1/') && \ cd /tmp && \ wget -q "https://oligarchy.co.uk/xapian/$VER/xapian-bindings-$VER.tar.xz" && \ tar -Jxvf "xapian-bindings-$VER.tar.xz" && \ cd "xapian-bindings-$VER/" && \ pip --no-cache-dir install sphinx && \ sed -i -e '/PYTHON3_SO=/s/distutils\.//g' \ -e '/PYTHON3_SO=/s/"SO"/"EXT_SUFFIX"/g' \ -e '/PYTHON3_CACHE_TAG=/s/imp;print(imp.get_tag())/sys;print(sys.implementation.cache_tag)/' \ -e '/PYTHON3_CACHE_OPT1_EXT=/s/imp\.get_tag()/sys.implementation.cache_tag/g' \ -e '/PYTHON3_CACHE_OPT1_EXT=/s/imp\b/importlib/g' \ configure && \ ./configure --prefix=/usr/local --with-python3 --disable-documentation && \ make && make install && \ pip uninstall --no-cache-dir -y sphinx && \ pip uninstall --no-cache-dir -y -r "$CWD/sphinxdeps.txt" && \ rm -rf /usr/local/share/doc/xapian-bindings # add requirements for pip here, e.g. Whoosh, gpg, zstd or other # modules not installed in the base library. # ignore warnings from pip to use virtualenv COPY scripts/Docker/requirements.txt . RUN pip install --no-cache-dir -r requirements.txt # copy the elements of the release directory to the docker image COPY setup.py install/ COPY doc install/doc/ COPY frontends install/frontends/ COPY locale install/locale/ COPY roundup install/roundup/ COPY share install/share/ # dist/* might not exist, so include README.txt so we don't get an error #COPY README.txt dist/* install/dist/ # verify source has one of four valid values then # install in python3 standard directories from: # * local copy using setup.py # * pypi using pip # * local files using pip # * pip using a pre-existing sdist built in original source tree: disabled # * copy from dist/* fails if dist directory is missing breaking the # Distfile. COPY used to ignore missing files if at least one # existing file was copied 8-(. # import from global/command line ARG source RUN [ -z "${VERBOSE}" ] || set -xv; \ case "$source" in \ "local") \ cd install && ./setup.py install;; \ "pypi"*) \ version_spec=$( printf "%s" "$source" | \ sed -ne 's/^pypi\([~=!<>].*\)/\1/p'); \ pip install --no-cache-dir "roundup${version_spec}"; \ cp -ril /usr/local/lib/"python${pythonversion}"/site-packages/usr/local/share/* \ /usr/local/share;; \ "pip_local") \ cd install && \ pip -V && \ pip install --no-cache-dir . ;; \ "pip_sdist") \ printf "\n\npip_sdist disabled\n\n" && exit 1 ; \ dist=$(find install/dist | sed -ne '/roundup-[0-9].*\.tar\.gz$/p' | tail -n 1); \ if [ -z "$dist" ] ; then \ printf "\n\nUnable to find a source distribution file in dist\n"; \ printf "Exiting\n\n"; \ exit 1; \ fi; \ printf "Building with distribution: %s\n" "$dist"; \ pip install --no-cache-dir "install/dist/$dist";; \ *) \ printf "\n\ninvalid value for source: %s\n" "$source"; \ printf "must be local, pypi, pip_local or pip_sdist\n\n"; \ exit 1;; \ esac # Allow user to add more modules during build ARG pip_mod RUN if [ -n "$pip_mod" ]; then pip install --no-cache-dir ${pip_mod}; fi # build a new smaller docker image for execution. Build image above # is 1G in size. # FROM python:3-alpine FROM python@sha256:$SHA256 # import from global ARG appdir WORKDIR $appdir # suppress warning when running pip as root ENV PIP_ROOT_USER_ACTION=ignore # upgrade to get any security updates; bundle with # rest of apk actions to reduce layers/wasted space # add libraries needed to run gpg/mysql/pgsql/brotli # clean out any caches to save space # upgrade pip packages to get security and other updates # bundle with apk updates SHELL ["/bin/ash", "-eo", "pipefail", "-c"] RUN apk --no-cache upgrade; \ apk --no-cache add \ brotli-libs \ dumb-init \ gpgme \ mariadb-connector-c \ libpq \ libstdc++ \ libxapian \ zstd-libs; \ upgrades="$(python3 -m pip --no-cache-dir --disable-pip-version-check \ list --outdated | awk 'NR > 2 {print $1}')"; \ if [ -n "$upgrades" ]; then \ echo "Pip updating $upgrades"; \ python -m pip --no-cache-dir --disable-pip-version-check \ install -U $upgrades < /dev/null; \ else \ echo "Nothing to pip update"; \ fi; \ test -s /usr/bin/dumb-init ARG source ARG pythonversion ARG pip_mod LABEL "org.opencontainers.image.vendor"="Roundup Issue Tracker Team" \ "org.opencontainers.image.title"="Roundup Issue Tracker" \ "org.opencontainers.image.description"="Roundup Issue Tracker with multi-backend support installed via $source with python version $pythonversion" \ "org.opencontainers.image.version"="2.5.0" \ "org.opencontainers.image.authors"="roundup-devel@lists.sourceforge.net" \ "org.opencontainers.image.licenses"="MIT AND ZPL-2.0 AND Python-2.0" \ "org.opencontainers.image.documentation"="https://www.roundup-tracker.org/docs/installation.html" \ "pip-modules"="$pip_mod" ARG pythonversion # pull over built assets COPY --from=build /usr/local/lib/python${pythonversion}/site-packages /usr/local/lib/python${pythonversion}/site-packages/ COPY --from=build /usr/local/bin/roundup* /usr/local/bin/ COPY --from=build /usr/local/share /usr/local/share/ COPY scripts/Docker/roundup_start scripts/Docker/roundup_healthcheck ./ # Do not run roundup as root. This creates roundup user and group. ARG roundup_uid RUN adduser -D -h ${appdir} -u ${roundup_uid:-1000} roundup # make roundup scripts execuable and mount a trackerdir on tracker location RUN chmod +x roundup_start roundup_healthcheck; \ mkdir tracker; chown ${roundup_uid:-1000}:${roundup_uid:-1000} tracker VOLUME $appdir/tracker # map port 8080 to your local port EXPOSE 8080/tcp HEALTHCHECK --start-period=1m \ CMD ./roundup_healthcheck # switch to using roundup user USER roundup # run the server, disable output buffering so we can see logs. ENV PYTHONUNBUFFERED=1 #ENTRYPOINT [ "roundup-server", "-n", "0.0.0.0" ] ENTRYPOINT [ "/usr/bin/dumb-init", "./roundup_start" ] # allow the invoker to override cmd with multiple trackers # in each subdirectory under $appdir/tracker. E.G. # docker run .... \ # issues=tracker/issues foo=tracker/foo # # note using "issue=$appdir/tracker" results in error: # # No valid configuration files found in directory /usr/src/app/$appdir/tracker # # so $appdir not expanded and $PWD prefixed onto the (relative path) # $appdir/tracker. Hence use relative path for spec. CMD [ "issues=tracker" ] code-9c3ec0a5c7fc/scripts/Docker/docker-compose.yml0000644000000000000000000000406215165601534020436 0ustar 00000000000000# docker-roundup # roundup issue tracker application with mariadb running as docker container # # docker-compose.yml # # Build components: # docker-compose -f scripts/Docker/docker-compose.yml build # # Install tracker template: # $ docker-compose -f scripts/Docker/docker-compose.yml run \ # --rm --entrypoint roundup-admin --no-deps roundup-app \ # -i tracker install # # Edit scripts/Docker/tracker/config.ini configure database settings # and any NO DEFAULT settings. # # Initialize the database, wait 1 minute so # # $ docker-compose -f scripts/Docker/docker-compose.yml run \ # --rm --entrypoint roundup-admin roundup-app \ # -i tracker # # wait 1 minute for mariadb to initialize # init tracker at roundup prompt # # roundup> init # roundup> exit # # may need ^\ to get roundup-admin to exit. # # run # docker-compose -f scripts/Docker/docker-compose.yml up # # tracker should be running at port 9017. # Note: mysql volume and tracker directories will be put in the # scripts/Docker subdir. # Paths for volumes are relative to docker-compose.yml location not # docker-compose cwd or build context directory. version: '3' services: mariadb: image: lscr.io/linuxserver/mariadb container_name: mariadb restart: unless-stopped environment: - PUID=1000 - PGID=1000 - TZ=America/New_York - MYSQL_ROOT_PASSWORD=myPassword - MYSQL_DATABASE=roundup - MYSQL_USER=roundup_user - MYSQL_PASSWORD=roundup_pass # ports: # - 3306:3306 volumes: - ./dbData:/config roundup-app: container_name: roundup-app build: context: ../.. dockerfile: scripts/Docker/Dockerfile args: source: local_pip #source: local #source: pypi command: "issues=tracker" restart: unless-stopped environment: - TZ=America/New_York ports: - 9017:8080 links: - mariadb depends_on: - mariadb volumes: # will be placed in Docker subdir next to this file - ./tracker:/usr/src/app/tracker code-9c3ec0a5c7fc/scripts/Docker/requirements.txt0000644000000000000000000000105315165601534020262 0ustar 00000000000000# Get newest versions, but specify minimum versions to get versions # without known vulnerabilities as reported by: # https://tools.simonwillison.net/python-vulnerability-lookup # setuptools required for installation - missing from newer base images setuptools >= 78.1.1 # human timezones pytz # indexer Whoosh # xapian is also installed # extra database support psycopg2 mysqlclient redis >= 4.5.4 # encryption gpg # java web tokens PyJWT >= 2.12.0 # extra HTTP compression methods Brotli >= 1.2.0 zstd >= 1.5.4 # jinja2 template engine Jinja2 >= 3.1.6 code-9c3ec0a5c7fc/scripts/Docker/roundup_healthcheck0000755000000000000000000000055315165601534020747 0ustar 00000000000000#! /bin/sh # change this if you are not using localhost=127.0.0.1 # if there are multiple trackers, d=demo t=tracker ... # returns last one for testing that server is up. Does not test # each tracker. tracker=$(ps -ef | sed -ne '/roundup-server/s/^.*\s\(\w*\)=.*$/\1/p') wget -q -O /dev/null --proxy off --no-verbose http://$localhost:8080/"${tracker:-demo}"/ code-9c3ec0a5c7fc/scripts/Docker/roundup_start0000755000000000000000000001642615165601534017647 0ustar 00000000000000#! /bin/sh # When container starts verify that the trackers are configured. # If they are, start the server otherwise run roundup-admin # for installation and initialization. # "$@" should be one of the recognized keywords or arguments for # roundup-server including one or more tracker tracker=directory pairs. # exit on errors; POSIX (e.g. dash as on ubuntu) doesn't support # pipefail. So setting it will fail. Allow that to happen then # set exit on error so the script will still run. set -o pipefail # not supported by POSIX shell, but then neither is pipefail. trap "echo 'Exiting on pipefail'" ERR set -e if [ -n "$SHELL_DEBUG" ]; then set -xv fi trap exit INT do_exit=0 if test -t 0 -a -t 1; then # see if stdin/out are associated with a tty might_be_interactive="true" else might_be_interactive="false" fi printf "Starting Roundup with arguments: $@" for tracker_spec in "$@"; do # IFS== set a=b doesn't just assign $1 and $2 in busybox ash # it also clobbers '$@'. 'printf mumble | read' starts read in a # subshell so vars are not available in parent. IFS="=" read -r tracker directory <<- EOE $tracker_spec EOE # ^ is a tab for use with <<- if [ -z "$directory" ]; then # $tracker_spec was not in the form of a=b, check to see # if it's a request to start in demo/shell mode: case "$tracker" in demo) # if grep does not find 2.2.0 it exits non-zero and # because of "-eo pipefail" the script exits. So || true # so pipeline exits true. version=$(roundup-admin -v | grep '2\.2\.0' || true) if [ -n "$version" ]; then printf "\nRoundup version: %s does not support docker demo mode\n" "$version" printf "Try building with a version newer than 2.2.0.\n" printf "For example:\n" printf " docker build --build-arg=\"source=pypi~=2.3.0a1\" ...\n" exit 3 fi if [ -z "$PORT_8080" ]; then PORT_8080=8917 printf " If docker reports a bind error, you can set the\n" printf " Docker environment variable PORT_8080 to\n" printf " fix it.\n\n" printf " Add -e PORT_8080=port_number to the docker run\n" printf " command. The port_number must match the first\n" printf " value to -p which must be an unused port\n" printf " on your server.\n\n" fi template=classic backend=sqlite shift demoArgs=$# for arg in "$@"; do # all keywords are unique, so iterate over all and # assign as appropriate case "$arg" in classic|devel|jinja2|minimal|responsive) template="$arg";; anydbm|sqlite) backend="$arg";; postgres|mysql) printf "demo mode only supports sqlite or anydbm backends, not %s. Exiting." "$1" exit 1;; nuke) nuke="$arg";; *) printf "Unknown argument %s.\n" "$1" printf "Usage: demo [template] [db]\n" printf " template: one of " printf "classic devel jinja2 minimal responsive\n" printf " db: one of: sqlite anydbm\n" printf "default: classic sqlite\n" printf "Exiting\n" exit 1 esac shift done # run demo make sure to set bind address -B to 0.0.0.0 # otherwise we can never make it out of the docker container. # use -p to force port to match the exported docker port. if [ -f tracker/demo/config.ini ] && [ -z "$nuke" ]; then if [ "$demoArgs" -ne 0 ]; then printf "Error: backend and template arguments to demo " printf "are invalid if a tracker\nis configured and " printf "'nuke' is not specified.\nExiting.\n" exit 1 fi printf "Restarting existing tracker.\n" # Restart an existing demo tracker. exec roundup-demo \ -B 0.0.0.0 \ -p 8080 \ tracker/demo else # Create new or nuke/create existing tracker. # Set parameters required to create tracker. # Inherit the url port spec from the environment # variable PORT_8080 using default value or value # specified on the docker run command line. printf "Creating new tracker.\n" exec roundup-demo \ -B 0.0.0.0 \ -p 8080 \ -b "$backend" \ --urlport "$PORT_8080" \ -t "$template" \ tracker/demo \ $nuke fi ;; shell) if [ "$might_be_interactive" = "false" ]; then printf \ "Error: must use -it on docker command line to invoke shell\n" exit 3 fi exec /bin/sh;; admin) shift exec roundup-admin "$@";; help) sed -e 's/^\t\t//' < /dev/null 2>&1 then if [ -e "$directory/config.ini" ]; then printf "Please edit %s/config.ini and set the required parameters.\n" "$directory" printf "The web setting appears to be missing.\n" exit 3 fi printf "Installing %s tracker in %s\n" "$tracker" "$directory" roundup-admin -i "$directory" install do_exit=1 fi # we have a valid config.ini so init database if not done # if we get errors, the db directory should be missing # and we print an error. if [ $do_exit = 0 ] && ! [ -e "$directory/db" ]; then printf "Initializing tracker %s\n" "$tracker" if ! roundup-admin -i "$directory" init; then # something went wrong. # verify it looks like a tracker directory # then remove the database directory test -e "$directory/TEMPLATE-INFO.txt" && \ rm -rf "$directory/db" fi do_exit=1 fi done # for "$@" # if any config.ini needs editing don't start up. if [ $do_exit = 0 ]; then # make roundup-server process pid 1 with exec exec roundup-server -n 0.0.0.0 "$@" fi exit 0 code-9c3ec0a5c7fc/scripts/Docker/sphinxdeps.txt0000644000000000000000000000047615165601534017734 0ustar 00000000000000Babel Jinja2 MarkupSafe Pygments alabaster certifi charset-normalizer docutils idna imagesize packaging pyparsing requests six snowballstemmer sphinxcontrib-applehelp sphinxcontrib-devhelp sphinxcontrib-htmlhelp sphinxcontrib-jsmath sphinxcontrib-qthelp sphinxcontrib-serializinghtml sphinxcontrib-websupport urllib3