From 8de892f91676894b91f1a2369ffd57984c6723ad Mon Sep 17 00:00:00 2001
From: Xavier Fournet <461943+xfournet@users.noreply.github.com>
Date: Fri, 6 Nov 2026 21:35:10 +0100
Subject: [PATCH] fix(docker): remove ssl_client from the published images
 (#59)

ssl_client is the TLS helper of BusyBox wget (CVE-2025-60876, no fixed
version) and is only needed to download sources during the build.
Alpine installs it automatically next to busybox and libssl3, so
'apk del' keeps it: a '!ssl_client' world constraint removes it once
the last wget download is done and keeps it out of the images built
from these ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Dockerfile                      | 6 ++++++
 legacy/Dockerfile_python        | 1 +
 legacy/Dockerfile_python_nodejs | 1 +
 3 files changed, 8 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 3b5ebb4..11972f4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,6 +46,12 @@ RUN << EOT
     # pip's isolated build environment and cargo keep their own caches, which
     # apk del does not cover.
     rm -rf /root/.cache /root/.cargo
+
+    # ssl_client only serves BusyBox wget over HTTPS, needed above for the
+    # OpenSSL source. It is installed automatically next to busybox and libssl3,
+    # so 'apk del' keeps it: the world constraint removes it and keeps it out
+    # of the images built from this one.
+    apk add --no-cache '!ssl_client'
 EOT
 
 COPY openssl.cnf /etc/ssl/openssl.cnf
diff --git a/legacy/Dockerfile_python b/legacy/Dockerfile_python
index 03529f3..7afb21f 100644
--- a/legacy/Dockerfile_python
+++ b/legacy/Dockerfile_python
@@ -46,6 +46,7 @@ RUN set -ex \
     && make install \
     && cd .. \
     && apk del .build-deps \
+    && apk add --no-cache '!ssl_client' \
     && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
     && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \
diff --git a/legacy/Dockerfile_python_nodejs b/legacy/Dockerfile_python_nodejs
index cf28d7b..68ebd2d 100644
--- a/legacy/Dockerfile_python_nodejs
+++ b/legacy/Dockerfile_python_nodejs
@@ -46,6 +46,7 @@ RUN set -ex \
     && make install \
     && cd .. \
     && apk del .build-deps \
+    && apk add --no-cache '!ssl_client' \
     && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
     && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \