mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2025-08-26 14:19:24 +00:00
f5f011f1e0
## Description of Changes - **What was changed** - Added `.github/scripts/requirements_dev.in` and an autogenerated, hash-locked `.github/scripts/requirements_dev.txt` to control Python dev dependencies via `pip-compile`. - **Why the change was made** - To remediate a GitHub code scanning alert by removing vulnerable transitive ranges and ensuring reproducible installs with vetted versions and hashes. - **Any challenges encountered** - Reconciling version constraints among image/PDF tooling (e.g., Pillow, pdf2image, OpenCV, WeasyPrint) while keeping wheels available across CI platforms. - Ensuring the generated lockfile remains maintainable and can be refreshed with `pip-compile` when needed. Closes #https://github.com/Stirling-Tools/Stirling-PDF/security/code-scanning/302 --- ## Checklist ### General - [x] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [x] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.
61 lines
1.9 KiB
Docker
61 lines
1.9 KiB
Docker
# dockerfile.dev
|
||
|
||
# Basisimage: Gradle mit JDK 17 (Debian-basiert)
|
||
FROM gradle:8.14-jdk17
|
||
|
||
# Als Root-Benutzer arbeiten, um benötigte Pakete zu installieren
|
||
USER root
|
||
|
||
# Set GRADLE_HOME und füge Gradle zum PATH hinzu
|
||
ENV GRADLE_HOME=/opt/gradle
|
||
ENV PATH="$GRADLE_HOME/bin:$PATH"
|
||
|
||
# Update und Installation zusätzlicher Pakete (Debian/Ubuntu-basiert)
|
||
RUN apt-get update && apt-get install -y \
|
||
sudo \
|
||
libreoffice \
|
||
poppler-utils \
|
||
qpdf \
|
||
# settings.yml | tessdataDir: /usr/share/tesseract-ocr/5/tessdata
|
||
tesseract-ocr \
|
||
tesseract-ocr-eng \
|
||
fonts-terminus fonts-dejavu fonts-font-awesome fonts-noto fonts-noto-core fonts-noto-cjk fonts-noto-extra fonts-liberation fonts-linuxlibertine fonts-urw-base35 \
|
||
python3-uno \
|
||
python3-venv \
|
||
# ss -tln
|
||
iproute2 \
|
||
&& apt-get clean && rm -rf /var/lib/apt/lists/*
|
||
|
||
# Setze die Environment Variable für setuptools
|
||
ENV SETUPTOOLS_USE_DISTUTILS=local \
|
||
STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
|
||
TMPDIR=/tmp/stirling-pdf \
|
||
TEMP=/tmp/stirling-pdf \
|
||
TMP=/tmp/stirling-pdf
|
||
|
||
# Installation der benötigten Python-Pakete
|
||
COPY .github/scripts/requirements_dev.txt /tmp/requirements_dev.txt
|
||
RUN python3 -m venv --system-site-packages /opt/venv \
|
||
&& . /opt/venv/bin/activate \
|
||
&& pip install --no-cache-dir --require-hashes -r /tmp/requirements_dev.txt
|
||
|
||
# Füge den venv-Pfad zur globalen PATH-Variable hinzu, damit die Tools verfügbar sind
|
||
ENV PATH="/opt/venv/bin:$PATH"
|
||
|
||
COPY . /workspace
|
||
|
||
RUN mkdir -p /tmp/stirling-pdf \
|
||
&& fc-cache -f -v \
|
||
&& adduser --disabled-password --gecos '' devuser \
|
||
&& chown -R devuser:devuser /home/devuser /workspace /tmp/stirling-pdf
|
||
RUN echo "devuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/devuser \
|
||
&& chmod 0440 /etc/sudoers.d/devuser
|
||
|
||
# Setze das Arbeitsverzeichnis (wird später per Bind-Mount überschrieben)
|
||
WORKDIR /workspace
|
||
|
||
RUN chmod +x /workspace/.devcontainer/git-init.sh /workspace/.devcontainer/init-setup.sh
|
||
|
||
# Wechsel zum Nicht‑Root Benutzer
|
||
USER devuser
|