Pin base image version

Set .gitlab-ci.yml to enable or configure SAST

See merge request erichardson/py-eagle-mqtt!1

.gitlab-ci.yml

@@ -1,36 +1,66 @@
-# This file is a template, and might need editing before it works on your project.
+# You can override the included template(s) by including variable overrides
-# Official docker image.
+# See https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
-image: docker:latest
+# Note that environment variables can be set in several places
-
+# See https://docs.gitlab.com/ee/ci/variables/#priority-of-environment-variables
-services:
-  - docker:18.09-dind
 
 stages:
-  - build
+- test
+- build
+- push_local
+- push_dockerhub
 
-variables:
+.docker_base:
-  DOCKER_HOST: tcp://localhost:2375
+  image: docker:18.09.7-dind
-  DOCKER_DRIVER: overlay2
+  services:
-  #IMAGE_TAG: erichardson/py-eagle-mqtt:$CI_COMMIT_TAG
+    - docker:18.09.7-dind
-  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
+  variables:
-
+    DOCKER_DRIVER: overlay
-before_script:
+    DOCKER_HOST: tcp://localhost:2375/
-  - docker version
+    IMAGE_TAG: "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
-  - docker info
+    FF_GITLAB_REGISTRY_HELPER_IMAGE: 1
-  - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
+  before_script:
+    - docker version
+    - docker info
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
 
 build:
-  only:
+  extends:
-    - tags
+    - .docker_base
   stage: build
   script:
-    - docker build -t $IMAGE_TAG -t $CI_COMMIT_TAG ./Docker/
+  - docker build --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA ./Docker/
-    - docker push $IMAGE_TAG $CI_COMMIT_TAG
+  - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
 
-#build:
+push local:
-#  stage: build
+  extends:
-#  script:
+    - .docker_base
-#    - docker build --pull -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG" .
+  stage: push_local
-#    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
+  variables:
-#  except:
+    GIT_STRATEGY: none
-#    - master
+  only:
+  - master
+  script:
+  - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+  - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:latest
+  - docker push $CI_REGISTRY_IMAGE:latest
+
+push dockerhub:
+  extends:
+    - .docker_base
+  stage: push_dockerhub
+  variables:
+    GIT_STRATEGY: none
+    CI_DOCKERHUB_IMAGE: index.docker.io/evanrich/py-eagle-mqtt
+    CI_DOCKERHUB_REGISTRY: docker.io
+  only:
+  - master
+  script:
+  - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+  - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_DOCKERHUB_IMAGE:latest
+  - docker login -u "$CI_DOCKERHUB_USER" -p "$CI_DOCKERHUB_PASSWORD" $CI_DOCKERHUB_REGISTRY
+  - docker push $CI_DOCKERHUB_IMAGE:latest
+  
+sast:
+  stage: test
+include:
+- template: Security/SAST.gitlab-ci.yml

.gitlab/sast-ruleset.toml

@@ -0,0 +1,6 @@
+[bandit]
+  [[bandit.ruleset]]
+    disable = true
+    [bandit.ruleset.identifier]
+      type = "bandit_test_id"
+      value = "B101"

Docker/Dockerfile

@@ -1,7 +1,7 @@
-FROM python:3.7.4-alpine3.10
+FROM python:3.9.3-alpine3.12
 
 LABEL maintainer="Evan Richardson (evanrich81[at]gmail.com)"
-LABEL version="1.5.1"
+LABEL version="1.6.6"
 
 WORKDIR /app
 COPY . /app

Docker/requirements.txt

@@ -1,4 +1,4 @@
-astral==1.10.1
+astral==2.2
-paho-mqtt==1.4.0
+paho-mqtt==1.5.1
-bottle==0.12.17
+bottle==0.12.19
-
+defusedxml==0.7.1

Docker/src/conf/broker.py

@@ -18,7 +18,7 @@ keepAlive = os.getenv('KEEPALIVE', 60)
 #
 #===========================================================================
 user = os.getenv('MQTT_USER', None)
-password = os.getenv('MQTT_PASS', None)
+password = os.getenv('MQTT_PASSWORD', None)
 
 #===========================================================================
 #
@@ -31,5 +31,3 @@ ca_certs = [
 
 certFile = None
 keyFile = None
-
-

Docker/src/python/tHome/eagle/get.py

@@ -6,7 +6,7 @@ from . import messages as msg
 #from .InstantDemand import InstantDemand
 #from .Reading import Reading
 #from .Total import Total
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 import socket
 
 #==========================================================================

Docker/src/python/tHome/eagle/parse.py

@@ -3,7 +3,7 @@
 # Parse XML messages into an object.
 #
 #===========================================================================
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 from . import messages
 
 #==========================================================================

README.md

@@ -4,6 +4,9 @@ Python3 based Docker for Eagle to MQTT reader
 I have only ported this into a dockerfile, All Original code (with one minor modification for XML root tag) is credit to [Ted Drain - TD22057](https://github.com/TD22057/T-Home).
 
 ## UPDATES:
+
+2020-04-03: I've moved the repo to my private Gitlab server, with a mirror set up to github.  I did this so that I could easily integrate a CI/CD pipeline to build this image, as well as run some Security tools against the image to improve it's code quality.   Please continue to open bug reports/issues/pull requests here in Github.  Also swapped to defusedxml python module due to security issues around xmltree.  Forgot to incrememnt the build number, but docker container  latest is up-to-date.
+   
 2019-07-24: Rebase to python 3.7.4-alpine3.10, update bottle to 0.12.17
 
 2019-04-12: Rebase to python 3.7.3-alpine3.9

k8s/deployment.yaml

@@ -1,4 +1,4 @@
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: py-eagle-mqtt