hadolint 1.16.3 → 1.17.0

raw patch · 4 files changed

+70/−4 lines, 4 files

Files

• README.md +2/−0
• hadolint.cabal +3/−3
• src/Hadolint/Rules.hs +34/−0
• test/Spec.hs +31/−1

@@ -184,6 +184,8 @@ | [DL3024](https://github.com/hadolint/hadolint/wiki/DL3024)   | `FROM` aliases (stage names) must be unique                                                                                                         | | [DL3025](https://github.com/hadolint/hadolint/wiki/DL3025)   | Use arguments JSON notation for CMD and ENTRYPOINT arguments                                                                                        | | [DL3026](https://github.com/hadolint/hadolint/wiki/DL3026)   | Use only an allowed registry in the FROM image                                                                                                      |+| [DL3027](https://github.com/hadolint/hadolint/wiki/DL3027)   | Do not use `apt` as it is meant to be a end-user tool, use `apt-get` or `apt-cache` instead                                                         |+| [DL3028](https://github.com/hadolint/hadolint/wiki/DL3028)   | Pin versions in gem install. Instead of `gem install <gem>` use `gem install <gem>:<version>`                                                       | | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000)   | MAINTAINER is deprecated.                                                                                                                           | | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001)   | Either use Wget or Curl but not both.                                                                                                               | | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003)   | Multiple `CMD` instructions found.                                                                                                                  |

@@ -1,13 +1,13 @@ cabal-version: 1.12 --- This file has been generated from package.yaml by hpack version 0.31.1.+-- This file has been generated from package.yaml by hpack version 0.31.2. -- -- see: https://github.com/sol/hpack ----- hash: 3c30762ee08b64a04b23f367726e5419091b765813f6e17bfff3ff8095ec57ca+-- hash: ad3384cc7d2f156af93ef1a394947b12be4d8ca81081af3f44fe90c9c2e0bf94  name:           hadolint-version:        1.16.3+version:        1.17.0 synopsis:       Dockerfile Linter JavaScript API description:    A smarter Dockerfile linter that helps you build best practice Docker images. category:       Development

@@ -202,6 +202,8 @@     , useShell     , useJsonArgs     , usePipefail+    , noApt+    , gemVersionPinned     ]  optionalRules :: RulesConfig -> [Rule]@@ -757,6 +759,16 @@     check (Entrypoint (ArgumentsText _)) = False     check _ = True +noApt :: Rule+noApt = instructionRule code severity message check+  where+    code = "DL3027"+    severity = WarningC+    message =+        "Do not use apt as it is meant to be a end-user tool, use apt-get or apt-cache instead"+    check (Run args) = argumentsRule (not . usingProgram "apt") args+    check _ = True+ usePipefail :: Rule usePipefail = instructionRuleState code severity message check False   where@@ -800,3 +812,25 @@     isAllowed Image {registryName = Nothing, imageName} =         imageName == "scratch" ||         Set.member "docker.io" allowed || Set.member "hub.docker.com" allowed++gemVersionPinned :: Rule+gemVersionPinned = instructionRule code severity message check+  where+    code = "DL3028"+    severity = WarningC+    message =+        "Pin versions in gem install. Instead of `gem install <gem>` use `gem \+        \install <gem>:<version>`"+    check (Run args) = argumentsRule (all versionFixed . gems) args+    check _ = True+    versionFixed package = ":" `isInfixOf` package++gems :: Shell.ParsedShell -> [String]+gems args =+    [ arg+    | cmd <- Shell.findCommands args+    , Shell.cmdHasArgs "gem" ["install", "i"] cmd+    , arg <- Shell.getArgsNoFlags cmd+    , arg /= "install"+    , arg /= "i"+    ]

@@ -152,8 +152,38 @@                 ruleCatchesNot invalidCmd "RUN apt-get install ssh"                 onBuildRuleCatchesNot invalidCmd "RUN apt-get install ssh"         --+        describe "gem" $+          describe "version pinning" $ do+            describe "i" $ do+              it "unpinned" $ do+                ruleCatches gemVersionPinned "RUN gem i bundler"+                onBuildRuleCatches gemVersionPinned "RUN gem i bundler"+              it "pinned" $ do+                ruleCatchesNot gemVersionPinned "RUN gem i bundler:1"+                onBuildRuleCatchesNot gemVersionPinned "RUN gem i bundler:1"+              it "multi" $ do+                ruleCatches gemVersionPinned "RUN gem i bunlder:1 nokogiri"+                onBuildRuleCatches gemVersionPinned "RUN gem i bunlder:1 nokogiri"+                ruleCatchesNot gemVersionPinned "RUN gem i bunlder:1 nokogirii:1"+                onBuildRuleCatchesNot gemVersionPinned "RUN gem i bunlder:1 nokogiri:1"+            describe "install" $ do+              it "unpinned" $ do+                ruleCatches gemVersionPinned "RUN gem install bundler"+                onBuildRuleCatches gemVersionPinned "RUN gem install bundler"+              it "pinned" $ do+                ruleCatchesNot gemVersionPinned "RUN gem install bundler:1"+                onBuildRuleCatchesNot gemVersionPinned "RUN gem install bundler:1"+        --         describe "apt-get rules" $ do-            it "apt upgrade" $ do+            it "apt" $+                let dockerFile =+                        [ "FROM ubuntu"+                        , "RUN apt install python"+                        ]+                in do+                  ruleCatches noApt $ Text.unlines dockerFile+                  onBuildRuleCatches noApt $ Text.unlines dockerFile+            it "apt-get upgrade" $ do                 ruleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade"                 onBuildRuleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade"             it "apt-get version pinning" $ do