updated - debian-9, debian-10; redhat-8: to replace python MD5 check with GPG signature check; (#475)

Co-authored-by: Alisha Mayor <[email protected]>

Author: adityapinglesf

base/debian-10/Dockerfile

@@ -19,7 +19,7 @@ ARG SCLOUD_URL
 ENV SCLOUD_URL=${SCLOUD_URL} \
     DEBIAN_FRONTEND=noninteractive \
     PYTHON_VERSION=3.7.10 \
-    PYTHON_MD5=0b19e34a6dabc4bf15fdcdf9e77e9856
+    PYTHON_GPG_KEY_ID=0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
 
 COPY install.sh /install.sh
 RUN /install.sh && rm -rf /install.sh

base/debian-10/install.sh

@@ -38,7 +38,10 @@ apt-get install -y --no-install-recommends curl sudo libgssapi-krb5-2 busybox pr
 # Install Python and necessary packages
 PY_SHORT=${PYTHON_VERSION%.*}
 wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
-echo "$PYTHON_MD5  /tmp/python.tgz" | md5sum --check
+wget -O /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz.asc
+gpg --recv-keys $PYTHON_GPG_KEY_ID
+gpg --verify /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc /tmp/python.tgz
+rm /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc
 mkdir -p /tmp/pyinstall
 tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz
 rm /tmp/python.tgz

base/debian-9/Dockerfile

@@ -19,7 +19,7 @@ ARG SCLOUD_URL
 ENV SCLOUD_URL=${SCLOUD_URL} \
     DEBIAN_FRONTEND=noninteractive \
     PYTHON_VERSION=3.7.10 \
-    PYTHON_MD5=0b19e34a6dabc4bf15fdcdf9e77e9856
+    PYTHON_GPG_KEY_ID=0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
 
 COPY install.sh /install.sh
 RUN /install.sh && rm -rf /install.sh

base/debian-9/install.sh

@@ -37,7 +37,11 @@ apt-get install -y --no-install-recommends curl sudo libgssapi-krb5-2 busybox pr
 # Install Python and necessary packages
 PY_SHORT=${PYTHON_VERSION%.*}
 wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
-echo "$PYTHON_MD5  /tmp/python.tgz" | md5sum --check
+wget -O /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz.asc
+apt-get install dirmngr -y
+gpg --keyserver pool.sks-keyservers.net --recv-keys $PYTHON_GPG_KEY_ID
+gpg --verify /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc /tmp/python.tgz
+rm /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc
 mkdir -p /tmp/pyinstall
 tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz
 rm /tmp/python.tgz

base/redhat-8/Dockerfile

@@ -28,7 +28,7 @@ LABEL name="splunk" \
 ARG SCLOUD_URL
 ENV SCLOUD_URL=${SCLOUD_URL} \
     PYTHON_VERSION=3.7.10 \
-    PYTHON_MD5=0b19e34a6dabc4bf15fdcdf9e77e9856
+    PYTHON_GPG_KEY_ID=0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
 
 COPY install.sh /install.sh
 

base/redhat-8/install.sh

@@ -34,7 +34,10 @@ microdnf -y --nodocs update gnutls kernel-headers librepo libnghttp2 tzdata
 # Install Python and necessary packages
 PY_SHORT=${PYTHON_VERSION%.*}
 wget -O /tmp/python.tgz https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
-echo "$PYTHON_MD5  /tmp/python.tgz" | md5sum --check
+wget -O /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz.asc
+gpg --keyserver pool.sks-keyservers.net --recv-keys $PYTHON_GPG_KEY_ID
+gpg --verify /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc /tmp/python.tgz
+rm /tmp/Python-gpg-sig-${PYTHON_VERSION}.tgz.asc
 mkdir -p /tmp/pyinstall
 tar -xzC /tmp/pyinstall/ --strip-components=1 -f /tmp/python.tgz
 rm /tmp/python.tgz