Merge pull request #641 from glenrobson/cantaloup-5.0.6

Cantaloup 5.0.6
cantaloupe-project · Jan 24, 2024 · 38a136f · 38a136f
2 parents 3f856f4 + f95a1a3
commit 38a136f
Show file tree

Hide file tree

Showing 20 changed files with 171 additions and 98 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -9,6 +9,8 @@
   fixes an HTTP 415 error that would occur when trying to do that.
 * Fixed a crop-offset bug that could occur when using PdfBoxProcessor to
   generate JPEGs with libjpeg-turbo active.
+* Updating libraries to fix security issues. Full details in [#634](https://github.com/cantaloupe-project/cantaloupe/issues/634)  
+* Update of Jena to 4.8 requires RDF to have a populated rdf:about field. May impact some XMP header processing.
 
 ## 5.0.5
 

diff --git a/CREDITS.md b/CREDITS.md
@@ -0,0 +1,9 @@
+# Credits
+
+The success of this project is down to the great work done by the developers at the University of Illinois and particularly Alex Dolski who has been the main developer on the project. In 2023 the IIIF consortium offered to help release a security patch as so many IIIF community members are using this great software. 
+
+- Cantaloupe 5.0.6
+ * [Glen Robson](https://github.com/glenrobson/) with support from the [IIIF Consortium](https://iiif.io/community/consortium/)
+
+- Cantaloupe v1 - v6
+ * [Alex Dolski](https://github.com/adolski), University of Illinois
diff --git a/docker/Linux-GraalVM20/Dockerfile b/docker/Linux-GraalVM20/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:lunar
 
 ENV JAVA_HOME=/opt/graalvm-ce-java11-20.3.0
 ENV GRAALVM_HOME=/opt/graalvm-ce-java11-20.3.0
@@ -20,6 +20,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
                 zlib1g-dev \
                 libwebp-dev \
                 libimage-exiftool-perl \
+                libgrokj2k1 \
+                grokj2k-tools \ 
+                adduser \
     && rm -rf /var/lib/apt/lists/*
 
 # Install TurboJpegProcessor dependencies
@@ -30,10 +33,10 @@ COPY docker/Linux-JDK11/image_files/libjpeg-turbo/lib64 /opt/libjpeg-turbo/lib
 COPY dist/deps/Linux-x86-64/lib/* /usr/lib/
 
 # Install GrokProcessor dependencies
-RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
-    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
-    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
-    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
+#RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
+#    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
+#    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
+#    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
 
 # Install GraalVM
 RUN wget -q https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-20.3.0/graalvm-ce-java11-linux-amd64-20.3.0.tar.gz \

diff --git a/docker/Linux-JDK11/Dockerfile b/docker/Linux-JDK11/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:lunar
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -18,6 +18,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
                 zlib1g-dev \
                 libwebp-dev \
                 libimage-exiftool-perl \
+                libgrokj2k1 \
+                grokj2k-tools \ 
+                adduser \
     && rm -rf /var/lib/apt/lists/*
 
 # Install TurboJpegProcessor dependencies
@@ -28,16 +31,16 @@ COPY docker/Linux-JDK11/image_files/libjpeg-turbo/lib64 /opt/libjpeg-turbo/lib
 COPY dist/deps/Linux-x86-64/lib/* /usr/lib/
 
 # Install GrokProcessor dependencies
-RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
-    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
-    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
-    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
+#RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
+#    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
+#    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
+#    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb
 
 # A non-root user is needed for some FilesystemSourceTest tests to work.
 ARG user=cantaloupe
 ARG home=/home/$user
 RUN adduser --home $home $user
-RUN chown -R $user $home
+RUN chown -R $user $home 
 USER $user
 WORKDIR $home
 

diff --git a/docker/Linux-JDK18/Dockerfile b/docker/Linux-JDK18/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:lunar
 
 ENV JAVA_HOME=/opt/jdk
 ENV PATH=$PATH:/opt/jdk/bin:/opt/maven/bin
@@ -23,6 +23,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     zlib1g-dev \
     libwebp-dev \
     libimage-exiftool-perl \
+    libgrokj2k1 \
+    grokj2k-tools \ 
+    adduser \
     && rm -rf /var/lib/apt/lists/*
 
 # Install TurboJpegProcessor dependencies
@@ -34,19 +37,19 @@ COPY dist/deps/Linux-x86-64/lib/* /usr/lib/
 
 # Install various other dependencies that aren't in apt
 # Install GrokProcessor dependencies
-RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
-    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
-    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
-    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb \
+#RUN wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/libgrokj2k1_7.6.5-1_amd64.deb \
+#    && wget -q https://github.com/GrokImageCompression/grok/releases/download/v7.6.5/grokj2k-tools_7.6.5-1_amd64.deb \
+#    && dpkg -i ./libgrokj2k1_7.6.5-1_amd64.deb \
+#    && dpkg -i --ignore-depends=libjpeg62-turbo ./grokj2k-tools_7.6.5-1_amd64.deb \
     # Install OpenJDK
-    && wget -q https://download.java.net/java/GA/jdk18/43f95e8614114aeaa8e8a5fcf20a682d/36/GPL/openjdk-18_linux-x64_bin.tar.gz \
+RUN wget -q https://download.java.net/java/GA/jdk18/43f95e8614114aeaa8e8a5fcf20a682d/36/GPL/openjdk-18_linux-x64_bin.tar.gz \
     && tar xfz openjdk-18_linux-x64_bin.tar.gz \
     && mv jdk-18 /opt/jdk \
     # Install a newer Maven than the one in apt
-    && wget -q https://dlcdn.apache.org/maven/maven-3/3.8.5/binaries/apache-maven-3.8.5-bin.tar.gz \
-    && tar xfz apache-maven-3.8.5-bin.tar.gz \
-    && mv apache-maven-3.8.5 /opt/maven \
-    && rm apache-maven-3.8.5-bin.tar.gz
+    && wget -q https://dlcdn.apache.org/maven/maven-3/3.8.8/binaries/apache-maven-3.8.8-bin.tar.gz \
+    && tar xfz apache-maven-3.8.8-bin.tar.gz \
+    && mv apache-maven-3.8.8 /opt/maven \
+    && rm apache-maven-3.8.8-bin.tar.gz
 
 # A non-root user is needed for some FilesystemSourceTest tests to work.
 ARG user=cantaloupe

diff --git a/docker/Windows-JDK11/Dockerfile-minio b/docker/Windows-JDK11/Dockerfile-minio
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/windows/servercore:ltsc2019
+FROM mcr.microsoft.com/windows/servercore:ltsc2022
 
 ENV MINIO_ACCESS_KEY=MinioUser
 ENV MINIO_SECRET_KEY=OpenSesame

diff --git a/docker/Windows-JDK18/Dockerfile b/docker/Windows-JDK18/Dockerfile
@@ -10,8 +10,9 @@ RUN powershell -Command \
 
 # Install various dependencies
 # TODO: openjpeg
-RUN choco install -y adoptopenjdk18 maven ffmpeg
-
+RUN choco install -y maven ffmpeg
+RUN choco install -y openjdk --version=18.0.2
+
 # Install TurboJpegProcessor dependencies TODO: libjpeg-turbo
 #RUN mkdir -p /opt/libjpeg-turbo/lib
 #COPY docker/Windows10-JDK11/image_files/libjpeg-turbo/lib64 c:\windows\system32