Add websphere-liberty ifix support and add PH06340 ifix

[naumanna]

Adding ifix support to the websphere-liberty Docker images, and adding the 19003 ifix for PH06340.

[tianon]

Diff:

diff --git a/websphere-liberty_18.0.0.4-kernel/helpers/build/configure.sh b/websphere-liberty_18.0.0.4-kernel/helpers/build/configure.sh
index f3a0283..45e8b18 100755
--- a/websphere-liberty_18.0.0.4-kernel/helpers/build/configure.sh
+++ b/websphere-liberty_18.0.0.4-kernel/helpers/build/configure.sh
@@ -75,4 +75,4 @@ fi
 
 
 # Install needed features
-installUtility install --acceptLicense defaultServer
\ No newline at end of file
+installUtility install --acceptLicense defaultServer || if [ $? -ne 22 ]; then exit $?; fi
\ No newline at end of file
diff --git a/websphere-liberty_kernel/Dockerfile b/websphere-liberty_kernel/Dockerfile
index 8a65f6f..274664c 100644
--- a/websphere-liberty_kernel/Dockerfile
+++ b/websphere-liberty_kernel/Dockerfile
@@ -51,6 +51,7 @@ RUN /opt/ibm/wlp/bin/server create \
     && rm -rf $WLP_OUTPUT_DIR/.classCache /output/workarea
 
 COPY helpers/ /opt/ibm/helpers/
+COPY fixes/ /opt/ibm/fixes/
 COPY licenses/ /licenses/
 
 # Create symlinks && set permissions for non-root user
@@ -71,6 +72,8 @@ RUN mkdir /logs \
     && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
+    && chown -R 1001:0 /opt/ibm/fixes \
+    && chmod -R g+rwx /opt/ibm/fixes \
     && chown -R 1001:0 /opt/ibm/wlp/usr \
     && chmod -R g+rw /opt/ibm/wlp/usr \
     && chown -R 1001:0 /opt/ibm/wlp/output \
diff --git a/websphere-liberty_kernel/Dockerfile.centos b/websphere-liberty_kernel/Dockerfile.centos
index d2c4061..ee7f327 100644
--- a/websphere-liberty_kernel/Dockerfile.centos
+++ b/websphere-liberty_kernel/Dockerfile.centos
@@ -53,6 +53,7 @@ RUN /opt/ibm/wlp/bin/server create \
     && rm -rf $WLP_OUTPUT_DIR/.classCache /output/workarea
 
 COPY helpers/ /opt/ibm/helpers/
+COPY fixes/ /opt/ibm/fixes/
 
 # Create symlinks && set permissions for non-root user
 RUN mkdir /logs \
@@ -72,6 +73,8 @@ RUN mkdir /logs \
     && chmod -R g+rw /config \
     && chown -R 1001:0 /opt/ibm/helpers \
     && chmod -R g+rwx /opt/ibm/helpers \
+    && chown -R 1001:0 /opt/ibm/fixes \
+    && chmod -R g+rwx /opt/ibm/fixes \
     && chown -R 1001:0 /opt/ibm/wlp/usr \
     && chmod -R g+rw /opt/ibm/wlp/usr \
     && chown -R 1001:0 /opt/ibm/wlp/output \
diff --git a/websphere-liberty_kernel/fixes/19003-wlp-archive-IFPH06340.jar b/websphere-liberty_kernel/fixes/19003-wlp-archive-IFPH06340.jar
new file mode 100644
index 0000000..ac9400a
Binary files /dev/null and b/websphere-liberty_kernel/fixes/19003-wlp-archive-IFPH06340.jar differ
diff --git a/websphere-liberty_kernel/helpers/build/configure.sh b/websphere-liberty_kernel/helpers/build/configure.sh
index f3a0283..286f627 100755
--- a/websphere-liberty_kernel/helpers/build/configure.sh
+++ b/websphere-liberty_kernel/helpers/build/configure.sh
@@ -73,6 +73,10 @@ if [ "$JMS_ENDPOINT" == "true" ]; then
   fi
 fi
 
-
 # Install needed features
-installUtility install --acceptLicense defaultServer
\ No newline at end of file
+installUtility install --acceptLicense defaultServer || if [ $? -ne 22 ]; then exit $?; fi
+
+# Apply interim fixes found in /opt/ibm/fixes
+# Fixes recommended by IBM, such as to resolve security vulnerabilities, are also included in /opt/ibm/fixes
+# Note: This step should be done once needed features are enabled and installed using installUtility.
+find /opt/ibm/fixes -type f -name "*.jar"  -print0 | sort -z | xargs -0 -n 1 -r -I {} java -jar {} --installLocation $WLP_INSTALL_DIR

[yosifkit]

Build test of #5771; 968c0cb; amd64 (websphere-liberty):

$ bashbrew build websphere-liberty:beta
Using bashbrew/cache:cc524da64e72a232b4999587cf9f75b077885a262104435d2482c6a28b3868c3 (websphere-liberty:beta)
Tagging websphere-liberty:beta

$ test/run.sh websphere-liberty:beta
testing websphere-liberty:beta
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-kernel
Using bashbrew/cache:5366745004a8c7f6688587bee13274a876c5d3f161cb76eeb4012a238cba8432 (websphere-liberty:19.0.0.3-kernel)
Tagging websphere-liberty:19.0.0.3-kernel
Tagging websphere-liberty:kernel

$ test/run.sh websphere-liberty:19.0.0.3-kernel
testing websphere-liberty:19.0.0.3-kernel
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-javaee8
Using bashbrew/cache:8e63f57bf61e3cbebfc2f11bfbf08d054571debab1c6abc679fa9cbe743264c2 (websphere-liberty:19.0.0.3-javaee8)
Tagging websphere-liberty:19.0.0.3-javaee8
Tagging websphere-liberty:javaee8
Tagging websphere-liberty:latest

$ test/run.sh websphere-liberty:19.0.0.3-javaee8
testing websphere-liberty:19.0.0.3-javaee8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-webProfile8
Using bashbrew/cache:d06aaf697c0e04605abf60c562f63624e285b3ec394415b85cfdac113056a627 (websphere-liberty:19.0.0.3-webProfile8)
Tagging websphere-liberty:19.0.0.3-webProfile8
Tagging websphere-liberty:webProfile8

$ test/run.sh websphere-liberty:19.0.0.3-webProfile8
testing websphere-liberty:19.0.0.3-webProfile8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-microProfile1
Using bashbrew/cache:ab4220c9e0650e63f9332323d0e0a236180db1af2efe26f30ae7bf877cae3917 (websphere-liberty:19.0.0.3-microProfile1)
Tagging websphere-liberty:19.0.0.3-microProfile1
Tagging websphere-liberty:microProfile1

$ test/run.sh websphere-liberty:19.0.0.3-microProfile1
testing websphere-liberty:19.0.0.3-microProfile1
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-microProfile2
Using bashbrew/cache:08b1a39c392dfc008acee161337797fdbfce879aa4ffde23cd3b07ceac3e6694 (websphere-liberty:19.0.0.3-microProfile2)
Tagging websphere-liberty:19.0.0.3-microProfile2
Tagging websphere-liberty:microProfile2

$ test/run.sh websphere-liberty:19.0.0.3-microProfile2
testing websphere-liberty:19.0.0.3-microProfile2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-springBoot2
Using bashbrew/cache:06e88f98bbccbacf64e0791e408b9121c117d7c74d6691a618d8ebdbe8b949f5 (websphere-liberty:19.0.0.3-springBoot2)
Tagging websphere-liberty:19.0.0.3-springBoot2
Tagging websphere-liberty:springBoot2

$ test/run.sh websphere-liberty:19.0.0.3-springBoot2
testing websphere-liberty:19.0.0.3-springBoot2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-springBoot1
Using bashbrew/cache:6fa5cb29a14e62457830ef38123acc4f056ecb87db88503c06be3efb402b064a (websphere-liberty:19.0.0.3-springBoot1)
Tagging websphere-liberty:19.0.0.3-springBoot1
Tagging websphere-liberty:springBoot1

$ test/run.sh websphere-liberty:19.0.0.3-springBoot1
testing websphere-liberty:19.0.0.3-springBoot1
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-webProfile7
Using bashbrew/cache:5705561a8f107523ce733070b7126beb0ee242892d95d8adbe5d5f04042dfefc (websphere-liberty:19.0.0.3-webProfile7)
Tagging websphere-liberty:19.0.0.3-webProfile7
Tagging websphere-liberty:webProfile7

$ test/run.sh websphere-liberty:19.0.0.3-webProfile7
testing websphere-liberty:19.0.0.3-webProfile7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:19.0.0.3-javaee7
Using bashbrew/cache:be0fbf30d061da7ce7d56d81f5642e84f6bc06f14f3d3a32b4ecc0e0d4d78991 (websphere-liberty:19.0.0.3-javaee7)
Tagging websphere-liberty:19.0.0.3-javaee7
Tagging websphere-liberty:javaee7

$ test/run.sh websphere-liberty:19.0.0.3-javaee7
testing websphere-liberty:19.0.0.3-javaee7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-kernel
Using bashbrew/cache:64dde7ddbf7f4ebf71eef30980dae9df5313566d5ea3731a143f52b69332a9f6 (websphere-liberty:18.0.0.4-kernel)
Tagging websphere-liberty:18.0.0.4-kernel

$ test/run.sh websphere-liberty:18.0.0.4-kernel
testing websphere-liberty:18.0.0.4-kernel
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-javaee8
Using bashbrew/cache:0bb30e2d075f74bc74c4f763088549edbbc26623fb3130fc6ce41e7ff67bbabe (websphere-liberty:18.0.0.4-javaee8)
Tagging websphere-liberty:18.0.0.4-javaee8

$ test/run.sh websphere-liberty:18.0.0.4-javaee8
testing websphere-liberty:18.0.0.4-javaee8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-webProfile8
Using bashbrew/cache:1a943295f682d142fa82fecbde45341a594aa03adf9534f1f32119546883962d (websphere-liberty:18.0.0.4-webProfile8)
Tagging websphere-liberty:18.0.0.4-webProfile8

$ test/run.sh websphere-liberty:18.0.0.4-webProfile8
testing websphere-liberty:18.0.0.4-webProfile8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-microProfile1
Using bashbrew/cache:64433d001c538cd9794da5bf60c30653207039cc67a34d588dbb7780f52b9379 (websphere-liberty:18.0.0.4-microProfile1)
Tagging websphere-liberty:18.0.0.4-microProfile1

$ test/run.sh websphere-liberty:18.0.0.4-microProfile1
testing websphere-liberty:18.0.0.4-microProfile1
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-microProfile2
Using bashbrew/cache:db6f7c2d4ff0e2e74cd02ff9f61758bb4e2e2a43cae5cbc78ce2299706a45f98 (websphere-liberty:18.0.0.4-microProfile2)
Tagging websphere-liberty:18.0.0.4-microProfile2

$ test/run.sh websphere-liberty:18.0.0.4-microProfile2
testing websphere-liberty:18.0.0.4-microProfile2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-springBoot2
Using bashbrew/cache:6cd24fbd4ac07d09062f6999cb9b7afb9bce143e923df91f0cc4f3d368d7089e (websphere-liberty:18.0.0.4-springBoot2)
Tagging websphere-liberty:18.0.0.4-springBoot2

$ test/run.sh websphere-liberty:18.0.0.4-springBoot2
testing websphere-liberty:18.0.0.4-springBoot2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-springBoot1
Using bashbrew/cache:ae62fdfa6f5eb90c7379b74693dbc0779236fe41830491d1d456bfdaf03782e7 (websphere-liberty:18.0.0.4-springBoot1)
Tagging websphere-liberty:18.0.0.4-springBoot1

$ test/run.sh websphere-liberty:18.0.0.4-springBoot1
testing websphere-liberty:18.0.0.4-springBoot1
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-webProfile7
Using bashbrew/cache:d9997ddc99c8b39b79eb1dfabf6c7d44b6b88e4eebdf0858117b4a57fdfec02b (websphere-liberty:18.0.0.4-webProfile7)
Tagging websphere-liberty:18.0.0.4-webProfile7

$ test/run.sh websphere-liberty:18.0.0.4-webProfile7
testing websphere-liberty:18.0.0.4-webProfile7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.4-javaee7
Using bashbrew/cache:e524b791c5a913d836ba3cb1117150dadefb445e30ca1b3136cbf9266758a225 (websphere-liberty:18.0.0.4-javaee7)
Tagging websphere-liberty:18.0.0.4-javaee7

$ test/run.sh websphere-liberty:18.0.0.4-javaee7
testing websphere-liberty:18.0.0.4-javaee7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-kernel
Using bashbrew/cache:caed8ed979c3795d3d7bf362c0b9146eb3c8bf0a808b7e1dc9a104d155fe8876 (websphere-liberty:18.0.0.3-kernel)
Tagging websphere-liberty:18.0.0.3-kernel

$ test/run.sh websphere-liberty:18.0.0.3-kernel
testing websphere-liberty:18.0.0.3-kernel
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-javaee8
Using bashbrew/cache:436e151c02bb9c2ed982c62f4460832a8e428895f216e0e4e3558fc92c40378c (websphere-liberty:18.0.0.3-javaee8)
Tagging websphere-liberty:18.0.0.3-javaee8

$ test/run.sh websphere-liberty:18.0.0.3-javaee8
testing websphere-liberty:18.0.0.3-javaee8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-webProfile8
Using bashbrew/cache:285471e613e2a37b5b77db96b6845483ed06289acbd45f5939becb5c898d812b (websphere-liberty:18.0.0.3-webProfile8)
Tagging websphere-liberty:18.0.0.3-webProfile8

$ test/run.sh websphere-liberty:18.0.0.3-webProfile8
testing websphere-liberty:18.0.0.3-webProfile8
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-microProfile1
Using bashbrew/cache:1fa37df97bfc3b39248e10830f76e452c5348eb480f3af97128ef26bad2a4f3b (websphere-liberty:18.0.0.3-microProfile1)
Tagging websphere-liberty:18.0.0.3-microProfile1

$ test/run.sh websphere-liberty:18.0.0.3-microProfile1
testing websphere-liberty:18.0.0.3-microProfile1
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-microProfile2
Using bashbrew/cache:e6f4f3a03843a8c8dcf967bda849867f74cb4c3b184d475fbf505d5948bd5c16 (websphere-liberty:18.0.0.3-microProfile2)
Tagging websphere-liberty:18.0.0.3-microProfile2

$ test/run.sh websphere-liberty:18.0.0.3-microProfile2
testing websphere-liberty:18.0.0.3-microProfile2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-springBoot2
Using bashbrew/cache:b1bd785da33b0c04b6a5ce685273587ddbd39383656fd7f05fda6f60bdb90991 (websphere-liberty:18.0.0.3-springBoot2)
Tagging websphere-liberty:18.0.0.3-springBoot2

$ test/run.sh websphere-liberty:18.0.0.3-springBoot2
testing websphere-liberty:18.0.0.3-springBoot2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-springBoot1
Using bashbrew/cache:3f3c97cdbd4dc24dbf6a9091092861d07ff8215dfead113f0c371aad29b4e405 (websphere-liberty:18.0.0.3-springBoot1)
Tagging websphere-liberty:18.0.0.3-springBoot1

$ test/run.sh websphere-liberty:18.0.0.3-springBoot1
testing websphere-liberty:18.0.0.3-springBoot1
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-webProfile7
Using bashbrew/cache:ec3f51ec2932b56b9edc579b8107ffd652fcbf70198ca73205ffda8f0f754ca1 (websphere-liberty:18.0.0.3-webProfile7)
Tagging websphere-liberty:18.0.0.3-webProfile7

$ test/run.sh websphere-liberty:18.0.0.3-webProfile7
testing websphere-liberty:18.0.0.3-webProfile7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed


$ bashbrew build websphere-liberty:18.0.0.3-javaee7
Using bashbrew/cache:21c337d3262afb57ccdb2c38f865d6276e5d60e90080fd7bf5d3e489b0b0699c (websphere-liberty:18.0.0.3-javaee7)
Tagging websphere-liberty:18.0.0.3-javaee7

$ test/run.sh websphere-liberty:18.0.0.3-javaee7
testing websphere-liberty:18.0.0.3-javaee7
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...passed
	'override-cmd' [4/4]...passed

[yosifkit]

While it seems to only be duplicating a few small files, I have the same recommendation here as in the open-liberty image:

There are quite a few recursive chown and chmod. Unless you are extremely careful to only do directories created in the same layer, this causes duplication across layers. chown and chmod are not smart on their own and will happy "change" files that don't require changes (thus causing docker to commit it in the new layer).

I'd recommend adding --chown to the COPY lines. Then I'd recommend either combining layers or moving to a more robust chown/chmod solution [within the Dockerfile] via find (like docker-library/rabbitmq#281) to ensure that only new things with the wrong user/permissions are touched.

- #5587 (comment)