diff mbox series

[layerindex-web] Dockerfile: install current setuptools and wheel

Message ID 20261026210812.96436-1-tim.orling@konsulko.com
State New
Headers show
Series [layerindex-web] Dockerfile: install current setuptools and wheel | expand

Commit Message

Tim Orling Oct. 26, 2026, 9:08 p.m. UTC 
Since the move to noble the image has Debian's setuptools 68.1.2 and
wheel 0.42.0, which Safety reports as vulnerable (CVE-2026-59890,
CVE-2026-24049 and others). pip can't upgrade them in place ("RECORD
file not found"), so install current releases with --ignore-installed;
they go to /usr/local, which takes precedence.

AI-Generated: Claude Opus 5.5
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/Dockerfile b/Dockerfile
index ee59e77..f4d19ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,6 +18,9 @@  ENV PYTHONUNBUFFERED=1 \
 
 # NOTE: we don't purge gcc below as we have some places in the OE metadata that look for it
 
+# Debian's setuptools and wheel can't be upgraded by pip in place, so install
+# current releases alongside them in /usr/local, which takes precedence
+
 COPY requirements.txt /
 RUN DEBIAN_FRONTEND=noninteractive apt-get update \
     && apt-get install -y locales \
@@ -49,6 +52,7 @@  RUN DEBIAN_FRONTEND=noninteractive apt-get update \
     && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
 	&& locale-gen en_US.UTF-8 \
 	&& update-locale \
+    && pip3 install --ignore-installed setuptools wheel \
     && pip3 install gunicorn \
     && pip3 install -r /requirements.txt \
     && apt-get purge -y autoconf g++ make python3-dev pkg-config libjpeg-dev \