From 37adba86e2e41e837916482b3915a9e9b138abf9 Mon Sep 17 00:00:00 2001
From: Ngo Quoc Dat <datlechin@gmail.com>
Date: Tue, 20 Oct 2026 16:08:09 +0700
Subject: [PATCH] fix(security): build the OSS Scanner image on the official
 Swift image

---
 .oss-scanner/Dockerfile | 27 ++++-----------------------
 1 file changed, 4 insertions(+), 23 deletions(-)

diff --git a/.oss-scanner/Dockerfile b/.oss-scanner/Dockerfile
index c6b7802bb6..fe9b4b4eae 100644
--- a/.oss-scanner/Dockerfile
+++ b/.oss-scanner/Dockerfile
@@ -2,19 +2,17 @@
 # The scanner builds it online, then scans offline, so every dependency a test needs is fetched here.
 # The Mac and iOS apps need Xcode and are scanned as source; this builds the Linux app and the
 # TableProCore targets that compile on Linux.
-FROM ubuntu:26.04
+# The official Swift image is Ubuntu 26.04 with the toolchain installed, the base the Linux app needs.
+FROM swift:6.4.1-resolute
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# The first group mirrors the Linux fast job in .github/workflows/build-linux.yml, the second the
-# official swift:6.4-resolute image.
+# Mirrors the Linux fast job in .github/workflows/build-linux.yml.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates curl git gnupg2 libarchive-tools \
+      ca-certificates curl git \
       build-essential pkgconf meson ninja-build gettext desktop-file-utils appstream libglib2.0-bin \
       libxml2-utils libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libsqlite3-dev libkrb5-dev \
       clang libclang-dev adwaita-icon-theme locales gnome-keyring openssh-client xvfb xauth dbus-daemon \
-      binutils binutils-gold libc6-dev libcurl4-openssl-dev libedit2 libgcc-15-dev libpython3-dev \
-      libstdc++-15-dev libxml2-dev libncurses-dev libz3-dev tzdata unzip zlib1g-dev \
     && rm -rf /var/lib/apt/lists/* \
     && localedef -i en_US -f UTF-8 en_US.UTF-8
 
@@ -24,23 +22,6 @@ ENV RUSTUP_HOME=/opt/rustup \
 RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
       | sh -s -- -y --no-modify-path --profile minimal --default-toolchain 1.98 --component rustfmt,clippy
 
-ARG SWIFT_VERSION=6.4.1
-RUN set -e; \
-    case "$(dpkg --print-architecture)" in \
-      amd64) suffix='' ;; \
-      arm64) suffix='-aarch64' ;; \
-      *) echo "unsupported architecture" >&2; exit 1 ;; \
-    esac; \
-    url="https://download.swift.org/swift-${SWIFT_VERSION}-release/ubuntu2604${suffix}/swift-${SWIFT_VERSION}-RELEASE/swift-${SWIFT_VERSION}-RELEASE-ubuntu26.04${suffix}.tar.gz"; \
-    curl -fsSL "$url" -o /tmp/swift.tar.gz "$url.sig" -o /tmp/swift.tar.gz.sig; \
-    export GNUPGHOME="$(mktemp -d)"; \
-    curl -fsSL https://www.swift.org/keys/all-keys.asc | gpg --batch --quiet --import; \
-    gpg --batch --verify /tmp/swift.tar.gz.sig /tmp/swift.tar.gz; \
-    bsdtar -xzf /tmp/swift.tar.gz -C / --strip-components=1; \
-    chmod -R o+r /usr/lib/swift; \
-    rm -rf "$GNUPGHOME" /tmp/swift.tar.gz /tmp/swift.tar.gz.sig; \
-    swift --version
-
 COPY . /src
 WORKDIR /src