From 717f68912301dd68ea74881f756d43c268501907 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Wed, 3 Jun 2026 10:52:20 +0200 Subject: [PATCH] [bitnami/airflow] Release 3.2.1-debian-12-r12 (#94298) Signed-off-by: Bitnami Bot --- bitnami/airflow/3/debian-12/Dockerfile | 4 ++-- .../rootfs/opt/bitnami/scripts/airflow-env.sh | 2 +- .../rootfs/opt/bitnami/scripts/libairflow.sh | 16 +++++++++------- bitnami/airflow/README.md | 2 +- 4 files changed, 13 insertions(+), 11 deletions(-) diff --git a/bitnami/airflow/3/debian-12/Dockerfile b/bitnami/airflow/3/debian-12/Dockerfile index 9d5bea38430a..6eed47b1b293 100644 --- a/bitnami/airflow/3/debian-12/Dockerfile +++ b/bitnami/airflow/3/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-06-03T03:53:20Z" \ + org.opencontainers.image.created="2026-06-03T08:09:21Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/airflow/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/airflow" \ @@ -60,7 +60,7 @@ RUN /opt/bitnami/scripts/airflow/postunpack.sh ENV AIRFLOW_HOME="/opt/bitnami/airflow" \ APP_VERSION="3.2.1" \ BITNAMI_APP_NAME="airflow" \ - IMAGE_REVISION="11" \ + IMAGE_REVISION="12" \ LANG="en_US.UTF-8" \ LANGUAGE="en_US:en" \ LD_LIBRARY_PATH="/opt/bitnami/airflow/venv/lib/python3.13/site-packages/numpy.libs:/opt/bitnami/mariadb/lib:/opt/bitnami/python/lib" \ diff --git a/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/airflow-env.sh b/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/airflow-env.sh index 07ba593189d4..ac723ca36aa8 100644 --- a/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/airflow-env.sh +++ b/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/airflow-env.sh @@ -177,7 +177,7 @@ export AIRFLOW_LDAP_USER_REGISTRATION_ROLE="${AIRFLOW_LDAP_USER_REGISTRATION_ROL export AIRFLOW_LDAP_ROLES_MAPPING="${AIRFLOW_LDAP_ROLES_MAPPING:-}" export AIRFLOW_LDAP_ROLES_SYNC_AT_LOGIN="${AIRFLOW_LDAP_ROLES_SYNC_AT_LOGIN:-True}" export AIRFLOW_LDAP_USE_TLS="${AIRFLOW_LDAP_USE_TLS:-False}" -export AIRFLOW_LDAP_ALLOW_SELF_SIGNED="${AIRFLOW_LDAP_ALLOW_SELF_SIGNED:-True}" +export AIRFLOW_LDAP_ALLOW_SELF_SIGNED="${AIRFLOW_LDAP_ALLOW_SELF_SIGNED:-False}" export AIRFLOW_LDAP_TLS_CA_CERTIFICATE="${AIRFLOW_LDAP_TLS_CA_CERTIFICATE:-}" # Custom environment variables may be defined below diff --git a/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/libairflow.sh b/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/libairflow.sh index 2366d2082c1c..0d1ad0271ffd 100644 --- a/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/libairflow.sh +++ b/bitnami/airflow/3/debian-12/rootfs/opt/bitnami/scripts/libairflow.sh @@ -84,9 +84,9 @@ airflow_validate() { # Check cryptography parameters if [[ -n "$AIRFLOW_RAW_FERNET_KEY" && -z "$AIRFLOW_FERNET_KEY" ]]; then - if validate_string "$AIRFLOW_RAW_FERNET_KEY" -min-length 32; then + if ! validate_string "$AIRFLOW_RAW_FERNET_KEY" -min-length 32; then print_validation_error "AIRFLOW_RAW_FERNET_KEY must have at least 32 characters" - elif validate_string "$AIRFLOW_RAW_FERNET_KEY" -max-length 32; then + elif ! validate_string "$AIRFLOW_RAW_FERNET_KEY" -max-length 32; then warn "AIRFLOW_RAW_FERNET_KEY has more than 32 characters, the rest will be ignored" fi AIRFLOW_FERNET_KEY="$(echo -n "${AIRFLOW_RAW_FERNET_KEY:0:32}" | base64)" @@ -96,7 +96,7 @@ airflow_validate() { if is_empty_value "$AIRFLOW_WEBSERVER_SECRET_KEY"; then AIRFLOW_WEBSERVER_SECRET_KEY="$(airflow_generate_secret_key)" fi - if validate_string "$AIRFLOW_WEBSERVER_SECRET_KEY" -max-length 32; then + if ! validate_string "$AIRFLOW_WEBSERVER_SECRET_KEY" -max-length 32; then warn "AIRFLOW_WEBSERVER_SECRET_KEY has more than 32 characters, the rest will be ignored" fi AIRFLOW_WEBSERVER_SECRET_KEY="$(echo -n "${AIRFLOW_WEBSERVER_SECRET_KEY:0:32}" | base64)" @@ -105,7 +105,7 @@ airflow_validate() { if is_empty_value "$AIRFLOW_APISERVER_SECRET_KEY"; then AIRFLOW_APISERVER_SECRET_KEY="$(airflow_generate_secret_key)" fi - if validate_string "$AIRFLOW_APISERVER_SECRET_KEY" -max-length 32; then + if ! validate_string "$AIRFLOW_APISERVER_SECRET_KEY" -max-length 32; then warn "AIRFLOW_APISERVER_SECRET_KEY has more than 32 characters, the rest will be ignored" fi AIRFLOW_APISERVER_SECRET_KEY="$(echo -n "${AIRFLOW_APISERVER_SECRET_KEY:0:32}" | base64)" @@ -146,9 +146,11 @@ airflow_validate() { check_yes_no_value "$var" done if is_boolean_yes "$AIRFLOW_LDAP_USE_TLS"; then - for var in "AIRFLOW_LDAP_ALLOW_SELF_SIGNED" "AIRFLOW_LDAP_TLS_CA_CERTIFICATE"; do - check_empty_value "$var" - done + if is_boolean_yes "$AIRFLOW_LDAP_ALLOW_SELF_SIGNED"; then + warn "AIRFLOW_LDAP_ALLOW_SELF_SIGNED is True: the LDAP TLS certificate will not be validated. A network attacker can present a self-signed certificate and intercept LDAP bind credentials and user passwords. Set AIRFLOW_LDAP_ALLOW_SELF_SIGNED=False and configure AIRFLOW_LDAP_TLS_CACERTFILE to enforce certificate-chain verification." + elif is_empty_value "$AIRFLOW_LDAP_TLS_CACERTFILE"; then + warn "AIRFLOW_LDAP_USE_TLS is enabled but AIRFLOW_LDAP_TLS_CACERTFILE is not set. The system CA bundle will be used. If your LDAP server uses an internal or private CA, set AIRFLOW_LDAP_TLS_CACERTFILE to the PEM file for that CA to prevent certificate-validation failures." + fi fi fi diff --git a/bitnami/airflow/README.md b/bitnami/airflow/README.md index e734d7e42c99..28ef022ce1c1 100644 --- a/bitnami/airflow/README.md +++ b/bitnami/airflow/README.md @@ -124,7 +124,7 @@ The following tables list the main variables you can set. | `AIRFLOW_LDAP_ROLES_MAPPING` | Mapping from LDAP DN to a list of Airflow roles. | `nil` | | `AIRFLOW_LDAP_ROLES_SYNC_AT_LOGIN` | Replace ALL the user roles each login, or only on registration. | `True` | | `AIRFLOW_LDAP_USE_TLS` | Use LDAP SSL. | `False` | -| `AIRFLOW_LDAP_ALLOW_SELF_SIGNED` | Allow self signed certificates in LDAP ssl. | `True` | +| `AIRFLOW_LDAP_ALLOW_SELF_SIGNED` | Allow self signed certificates in LDAP ssl. | `False` | | `AIRFLOW_LDAP_TLS_CA_CERTIFICATE` | File that store the CA for LDAP ssl. | `nil` | #### Read-only environment variables