Skip to content

add msquic to Debian Helix images #657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wfurt merged 1 commit into from
Aug 10, 2022
Merged

add msquic to Debian Helix images #657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion src/debian/10/helix/amd64/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ RUN apt-get update && \
procps \
python3-dev \
python3-pip \
software-properties-common \
sudo \
tzdata \
unzip \
Expand All @@ -41,6 +42,15 @@ RUN ln -sf /usr/bin/python3 /usr/bin/python && \
pip download --no-deps helix-scripts --index-url https://dnceng.pkgs.visualstudio.com/public/_packaging/helix-client-prod/pypi/simple && \
pip install ./helix_scripts-*-py3-none-any.whl

# Add MsQuic
COPY microsoft.asc /tmp
RUN apt-key add /tmp/microsoft.asc \
&& rm /tmp/microsoft.asc \
&& apt-add-repository https://packages.microsoft.com/debian/10/prod \
&& apt-get update \
&& apt-get install -y libmsquic \
&& rm -rf /var/lib/apt/lists/*
Comment on lines +46 to +52
Copy link
Member

@mthalman mthalman Aug 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of needing to store the key locally, wouldn't it be better to follow the pattern that is documented here.

Suggested change
COPY microsoft.asc /tmp
RUN apt-key add /tmp/microsoft.asc \
&& rm /tmp/microsoft.asc \
&& apt-add-repository https://packages.microsoft.com/debian/10/prod \
&& apt-get update \
&& apt-get install -y libmsquic \
&& rm -rf /var/lib/apt/lists/*
RUN curl https://packages.microsoft.com/config/debian/10/packages-microsoft-prod.deb -o packages-microsoft-prod.deb \
&& dpkg -i packages-microsoft-prod.deb \
&& rm packages-microsoft-prod.deb \
&& apt-get update \
&& apt-get install -y libmsquic \
&& rm -rf /var/lib/apt/lists/*

Copy link
Member Author

@wfurt wfurt Aug 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This problem with that is that it is vulnerable to chain attacks since there is no verification if the downloaded key is the correct one. To do that correctly, we would need to verify key fingerprint before using as trusted. That can be done but it takes extra steps. I can do that if you really want to avoid establishing trust via local key file @mthalman

My preference would be to make singe file for all containers but I did not figure out how to do that.
Since this is ASCII, we can possibly create it via echo/printf as well.

Copy link
Member

@mthalman mthalman Aug 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, this is fine. But if there's a vulnerable aspect to the official installation instructions to customers, we should probably get that addressed, yes?

Copy link
Member Author

@wfurt wfurt Aug 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there were also some errors for some distributions and we should perhaps update notes to include current/latest OS versions as well. I will take a look.


# Create helixbot user and give rights to sudo without password
# additionally, preinstall the virtualenv packages used for VSTS reporting to save time
RUN /usr/sbin/adduser --disabled-password --gecos '' --uid 1000 --shell /bin/bash --ingroup adm helixbot && \
Expand All @@ -49,4 +59,4 @@ RUN /usr/sbin/adduser --disabled-password --gecos '' --uid 1000 --shell /bin/bas

USER helixbot

RUN python -m virtualenv --no-site-packages /home/helixbot/.vsts-env
RUN python -m virtualenv --no-site-packages /home/helixbot/.vsts-env
19 changes: 19 additions & 0 deletions src/debian/10/helix/amd64/microsoft.asc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.7 (GNU/Linux)

mQENBFYxWIwBCADAKoZhZlJxGNGWzqV+1OG1xiQeoowKhssGAKvd+buXCGISZJwT
LXZqIcIiLP7pqdcZWtE9bSc7yBY2MalDp9Liu0KekywQ6VVX1T72NPf5Ev6x6DLV
7aVWsCzUAF+eb7DC9fPuFLEdxmOEYoPjzrQ7cCnSV4JQxAqhU4T6OjbvRazGl3ag
OeizPXmRljMtUUttHQZnRhtlzkmwIrUivbfFPD+fEoHJ1+uIdfOzZX8/oKHKLe2j
H632kvsNzJFlROVvGLYAk2WRcLu+RjjggixhwiB+Mu/A8Tf4V6b+YppS44q8EvVr
M+QvY7LNSOffSO6Slsy9oisGTdfE39nC7pVRABEBAAG0N01pY3Jvc29mdCAoUmVs
ZWFzZSBzaWduaW5nKSA8Z3Bnc2VjdXJpdHlAbWljcm9zb2Z0LmNvbT6JATUEEwEC
AB8FAlYxWIwCGwMGCwkIBwMCBBUCCAMDFgIBAh4BAheAAAoJEOs+lK2+EinPGpsH
/32vKy29Hg51H9dfFJMx0/a/F+5vKeCeVqimvyTM04C+XENNuSbYZ3eRPHGHFLqe
MNGxsfb7C7ZxEeW7J/vSzRgHxm7ZvESisUYRFq2sgkJ+HFERNrqfci45bdhmrUsy
7SWw9ybxdFOkuQoyKD3tBmiGfONQMlBaOMWdAsic965rvJsd5zYaZZFI1UwTkFXV
KJt3bp3Ngn1vEYXwijGTa+FXz6GLHueJwF0I7ug34DgUkAFvAs8Hacr2DRYxL5RJ
XdNgj4Jd2/g6T9InmWT0hASljur+dJnzNiNCkbn9KbX7J/qK1IbR8y560yRmFsU+
NdCFTW7wY0Fb1fWJ+/KTsC4=
=J6gs
-----END PGP PUBLIC KEY BLOCK-----
12 changes: 11 additions & 1 deletion src/debian/11/helix/amd64/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ RUN apt-get update && \
locales-all \
python3-dev \
python3-pip \
software-properties-common \
sudo \
tzdata \
unzip \
Expand All @@ -40,6 +41,15 @@ RUN ln -sf /usr/bin/python3 /usr/bin/python && \
pip download --no-deps helix-scripts --index-url https://dnceng.pkgs.visualstudio.com/public/_packaging/helix-client-prod/pypi/simple && \
pip install ./helix_scripts-*-py3-none-any.whl

# Add MsQuic
COPY microsoft.asc /tmp
RUN apt-key add /tmp/microsoft.asc \
&& rm /tmp/microsoft.asc \
&& apt-add-repository https://packages.microsoft.com/debian/11/prod \
&& apt-get update \
&& apt-get install -y libmsquic \
&& rm -rf /var/lib/apt/lists/*

# Create helixbot user and give rights to sudo without password
# additionally, preinstall the virtualenv packages used for VSTS reporting to save time
RUN /usr/sbin/adduser --disabled-password --gecos '' --uid 1000 --shell /bin/bash --ingroup adm helixbot && \
Expand All @@ -48,4 +58,4 @@ RUN /usr/sbin/adduser --disabled-password --gecos '' --uid 1000 --shell /bin/bas

USER helixbot

RUN python -m virtualenv --no-site-packages /home/helixbot/.vsts-env
RUN python -m virtualenv --no-site-packages /home/helixbot/.vsts-env
19 changes: 19 additions & 0 deletions src/debian/11/helix/amd64/microsoft.asc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.7 (GNU/Linux)

mQENBFYxWIwBCADAKoZhZlJxGNGWzqV+1OG1xiQeoowKhssGAKvd+buXCGISZJwT
LXZqIcIiLP7pqdcZWtE9bSc7yBY2MalDp9Liu0KekywQ6VVX1T72NPf5Ev6x6DLV
7aVWsCzUAF+eb7DC9fPuFLEdxmOEYoPjzrQ7cCnSV4JQxAqhU4T6OjbvRazGl3ag
OeizPXmRljMtUUttHQZnRhtlzkmwIrUivbfFPD+fEoHJ1+uIdfOzZX8/oKHKLe2j
H632kvsNzJFlROVvGLYAk2WRcLu+RjjggixhwiB+Mu/A8Tf4V6b+YppS44q8EvVr
M+QvY7LNSOffSO6Slsy9oisGTdfE39nC7pVRABEBAAG0N01pY3Jvc29mdCAoUmVs
ZWFzZSBzaWduaW5nKSA8Z3Bnc2VjdXJpdHlAbWljcm9zb2Z0LmNvbT6JATUEEwEC
AB8FAlYxWIwCGwMGCwkIBwMCBBUCCAMDFgIBAh4BAheAAAoJEOs+lK2+EinPGpsH
/32vKy29Hg51H9dfFJMx0/a/F+5vKeCeVqimvyTM04C+XENNuSbYZ3eRPHGHFLqe
MNGxsfb7C7ZxEeW7J/vSzRgHxm7ZvESisUYRFq2sgkJ+HFERNrqfci45bdhmrUsy
7SWw9ybxdFOkuQoyKD3tBmiGfONQMlBaOMWdAsic965rvJsd5zYaZZFI1UwTkFXV
KJt3bp3Ngn1vEYXwijGTa+FXz6GLHueJwF0I7ug34DgUkAFvAs8Hacr2DRYxL5RJ
XdNgj4Jd2/g6T9InmWT0hASljur+dJnzNiNCkbn9KbX7J/qK1IbR8y560yRmFsU+
NdCFTW7wY0Fb1fWJ+/KTsC4=
=J6gs
-----END PGP PUBLIC KEY BLOCK-----