diff --git a/bitnami/ghost/6/debian-12/Dockerfile b/bitnami/ghost/6/debian-12/Dockerfile index 5cdb844aa866..fa1a2165543e 100644 --- a/bitnami/ghost/6/debian-12/Dockerfile +++ b/bitnami/ghost/6/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-25T17:50:51Z" \ + org.opencontainers.image.created="2026-06-01T13:56:38Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/ghost/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/ghost" \ @@ -31,18 +31,18 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ "nss-wrapper-1.1.16-0-linux-${OS_ARCH}-debian-12" \ "python-3.12.13-11-linux-${OS_ARCH}-debian-12" \ "node-22.22.3-0-linux-${OS_ARCH}-debian-12" \ - "mysql-client-12.2.2-0-linux-${OS_ARCH}-debian-12" \ + "mysql-client-12.3.2-0-linux-${OS_ARCH}-debian-12" \ "ghost-6.41.1-0-linux-${OS_ARCH}-debian-12" \ ) ; \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -53,7 +53,7 @@ RUN /opt/bitnami/scripts/ghost/postunpack.sh RUN /opt/bitnami/scripts/mysql-client/postunpack.sh ENV APP_VERSION="6.41.1" \ BITNAMI_APP_NAME="ghost" \ - IMAGE_REVISION="0" \ + IMAGE_REVISION="1" \ PATH="/opt/bitnami/common/bin:/opt/bitnami/python/bin:/opt/bitnami/node/bin:/opt/bitnami/mysql/bin:/opt/bitnami/ghost/bin:$PATH" EXPOSE 2368 3000 diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/ghost-6.41.1-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/ghost-6.41.1-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..227b3dfcd754 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/ghost-6.41.1-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +ec317ef4208a34142a6ae2830165c1060f0125cb974ec8f36efed1cdfce5b69f ghost-6.41.1-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/ghost-6.41.1-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/ghost-6.41.1-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..9d9012fdf176 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/ghost-6.41.1-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +bf90624d4ad50e4d7135e7c066ebc161e1309e983ab631684aa595a7ee815bd3 ghost-6.41.1-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/mysql-client-12.3.2-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/mysql-client-12.3.2-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..2c4b9a209395 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/mysql-client-12.3.2-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +5b884dec9384b513fa919005e7db53fc817949bcbc3e88c61e49d12af6753a08 mysql-client-12.3.2-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/mysql-client-12.3.2-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/mysql-client-12.3.2-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..dd83bcc13e29 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/mysql-client-12.3.2-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +c6cd215fe18568f3015248adc87362e42edc3a9d342ec31be0ddc6e1abbf7c25 mysql-client-12.3.2-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/node-22.22.3-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/node-22.22.3-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..a057ca82a47d --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/node-22.22.3-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +8418dd355a61720073361f5aa88610116b0b68d450d482ed329be293508a0165 node-22.22.3-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/node-22.22.3-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/node-22.22.3-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..af2ef67e8cb1 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/node-22.22.3-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +c1831f91a97dab2b38d086e3452bcbd4f0cb821a78ede71d166ca5c878cb4fa5 node-22.22.3-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..cf2734607b9e --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +af31040a9ef21924a1d4c6d3f0bd6a6be9ef701c9e726b9b3997b82394779b6e nss-wrapper-1.1.16-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..c4594d6aa7c5 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +9315fee0fbce2e445778f4cddd4b5a9ae657d40bcc4c9534430d8eaeecf7307c nss-wrapper-1.1.16-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/python-3.12.13-11-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/python-3.12.13-11-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..d8d64cc5e94a --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/python-3.12.13-11-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +a13e9f6ab18a719682fd94b0bdd131a771835c8cb707e2451c472a8b6927f3f7 python-3.12.13-11-linux-amd64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/python-3.12.13-11-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/python-3.12.13-11-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..694ac13e1718 --- /dev/null +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/checksums/python-3.12.13-11-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +f79c0e2b0c9179091f9b06c650c757680b91a9f655538e85968cce732f150ab6 python-3.12.13-11-linux-arm64-debian-12.tar.gz diff --git a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/ghost/6/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libghost.sh b/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libghost.sh index 721a77c8e70a..b345be784e06 100644 --- a/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libghost.sh +++ b/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libghost.sh @@ -249,7 +249,7 @@ ghost_initialize() { info "Ensuring Ghost directories exist" ensure_dir_exists "$GHOST_VOLUME_DIR" # Use ghost:root ownership for compatibility when running as a non-root user - am_i_root && configure_permissions_ownership "$GHOST_VOLUME_DIR" -d "775" -f "664" -u "$GHOST_DAEMON_USER" -g "root" + am_i_root && configure_permissions_ownership "$GHOST_VOLUME_DIR" -d "775" -f "664" -u "$GHOST_DAEMON_USER" -g "root" -n info "Trying to connect to the database server" ghost_wait_for_mysql_connection "$GHOST_DATABASE_HOST" "$GHOST_DATABASE_PORT_NUMBER" "$GHOST_DATABASE_NAME" "$GHOST_DATABASE_USER" "$GHOST_DATABASE_PASSWORD" # Configure database diff --git a/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh b/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh index c096f4d1e1c1..1a3ae0d0dc67 100644 --- a/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh +++ b/bitnami/ghost/6/debian-12/rootfs/opt/bitnami/scripts/libmysqlclient.sh @@ -263,7 +263,12 @@ mysql_execute_print_output() { fi args+=("-N" "-u" "$user") [[ -n "$db" ]] && args+=("$db") - [[ -n "$pass" ]] && args+=("-p$pass") + # Avoid passing credentials as arguments to mysql, to avoid leaking them given a local observer with /proc read access can read them + if [[ -n "$pass" ]]; then + local pass_file + pass_file="$(credential_to_temp_file "$pass")" + args+=("-p$(<"$pass_file")") + fi [[ "${#opts[@]}" -gt 0 ]] && args+=("${opts[@]}") [[ "${#extra_opts[@]}" -gt 0 ]] && args+=("${extra_opts[@]}") @@ -271,7 +276,6 @@ mysql_execute_print_output() { if [[ "${BITNAMI_DEBUG:-false}" = true ]]; then local mysql_cmd mysql_cmd="$(