fix(docker): remove ssl_client from the published images (#59)

Dockerfile

@@ -46,6 +46,12 @@ RUN << EOT
     # pip's isolated build environment and cargo keep their own caches, which
     # apk del does not cover.
     rm -rf /root/.cache /root/.cargo
+
+    # ssl_client only serves BusyBox wget over HTTPS, needed above for the
+    # OpenSSL source. It is installed automatically next to busybox and libssl3,
+    # so 'apk del' keeps it: the world constraint removes it and keeps it out
+    # of the images built from this one.
+    apk add --no-cache '!ssl_client'
 EOT
 
 COPY openssl.cnf /etc/ssl/openssl.cnf

legacy/Dockerfile_python

@@ -3,8 +3,8 @@
 ARG OPENSSL_VERSION=3.6.4
 ARG PYTHON_VERSION=3.12.14
 
 ENV PATH /usr/local/bin:$PATH
 ENV LANG C.UTF-8
 
 # Install OpenSSL FIPS
 RUN set -ex \
@@ -46,6 +46,7 @@
     && make install \
     && cd .. \
     && apk del .build-deps \
+    && apk add --no-cache '!ssl_client' \
     && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
     && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \

legacy/Dockerfile_python_nodejs

@@ -3,8 +3,8 @@
 ARG OPENSSL_VERSION=3.6.4
 ARG PYTHON_VERSION=3.12.14
 
 ENV PATH /usr/local/bin:$PATH
 ENV LANG C.UTF-8
 
 # Install OpenSSL FIPS
 RUN set -ex \
@@ -46,6 +46,7 @@
     && make install \
     && cd .. \
     && apk del .build-deps \
+    && apk add --no-cache '!ssl_client' \
     && ln -sf /usr/local/bin/idle3 /usr/local/bin/idle \
     && ln -sf /usr/local/bin/pydoc3 /usr/local/bin/pydoc \
     && ln -sf /usr/local/bin/python3 /usr/local/bin/python \