Skip to content

fix(security): build the OSS Scanner image on the official Swift image #3696

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
datlechin merged 1 commit into from
Oct 20, 2026
Merged

fix(security): build the OSS Scanner image on the official Swift image #3696

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 4 additions & 23 deletions .oss-scanner/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,17 @@
# The scanner builds it online, then scans offline, so every dependency a test needs is fetched here.
# The Mac and iOS apps need Xcode and are scanned as source; this builds the Linux app and the
# TableProCore targets that compile on Linux.
FROM ubuntu:26.04
# The official Swift image is Ubuntu 26.04 with the toolchain installed, the base the Linux app needs.
FROM swift:6.4.1-resolute

ENV DEBIAN_FRONTEND=noninteractive

# The first group mirrors the Linux fast job in .github/workflows/build-linux.yml, the second the
# official swift:6.4-resolute image.
# Mirrors the Linux fast job in .github/workflows/build-linux.yml.
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates curl git gnupg2 libarchive-tools \
ca-certificates curl git \
build-essential pkgconf meson ninja-build gettext desktop-file-utils appstream libglib2.0-bin \
libxml2-utils libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libsqlite3-dev libkrb5-dev \
clang libclang-dev adwaita-icon-theme locales gnome-keyring openssh-client xvfb xauth dbus-daemon \
binutils binutils-gold libc6-dev libcurl4-openssl-dev libedit2 libgcc-15-dev libpython3-dev \
libstdc++-15-dev libxml2-dev libncurses-dev libz3-dev tzdata unzip zlib1g-dev \
&& rm -rf /var/lib/apt/lists/* \
&& localedef -i en_US -f UTF-8 en_US.UTF-8

Expand All @@ -24,23 +22,6 @@ ENV RUSTUP_HOME=/opt/rustup \
RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
| sh -s -- -y --no-modify-path --profile minimal --default-toolchain 1.98 --component rustfmt,clippy

ARG SWIFT_VERSION=6.4.1
RUN set -e; \
case "$(dpkg --print-architecture)" in \
amd64) suffix='' ;; \
arm64) suffix='-aarch64' ;; \
*) echo "unsupported architecture" >&2; exit 1 ;; \
esac; \
url="https://download.swift.org/swift-${SWIFT_VERSION}-release/ubuntu2604${suffix}/swift-${SWIFT_VERSION}-RELEASE/swift-${SWIFT_VERSION}-RELEASE-ubuntu26.04${suffix}.tar.gz"; \
curl -fsSL "$url" -o /tmp/swift.tar.gz "$url.sig" -o /tmp/swift.tar.gz.sig; \
export GNUPGHOME="$(mktemp -d)"; \
curl -fsSL https://www.swift.org/keys/all-keys.asc | gpg --batch --quiet --import; \
gpg --batch --verify /tmp/swift.tar.gz.sig /tmp/swift.tar.gz; \
bsdtar -xzf /tmp/swift.tar.gz -C / --strip-components=1; \
chmod -R o+r /usr/lib/swift; \
rm -rf "$GNUPGHOME" /tmp/swift.tar.gz /tmp/swift.tar.gz.sig; \
swift --version

COPY . /src
WORKDIR /src

Expand Down
Loading