Repository navigation
Commit f145121
committed
Fix Atheris install in local dev helper Docker image
The Atheris package bundles a binary that supplies libFuzzer on some
host machines, but in some cases (such as ARM based mac hosts) Atheris
seems to require building libFuzzer at install time while pip builds the
wheel. In the latter case, clang and related dependencies must be
present and available for the build, which itself requires using a non
"slim" version of the Python base image and not passing the
`--no-install-recommends` flag to `apt-get install` as both prevent the
required related libraries from being automatically installed.
It is also worth noting that at the time of this commit, the default
version of LLVM & Clang installed when `clang` is installed from `apt`
is version 14, while the latest stable version is 17 and OSS-Fuzz uses
15. The decision to install the default version (14) available via the
debian repos was intentional because a) it appears to work fine for our
needs and Atheris version b) specifying a different version requires
more complexity depending on install method, but the goal of this
Dockerfile is simplicity and low maintenance.
If it becomes neccissary to upgrade Clang/LLVM in the future, one option
to consider besides installing from source is the apt repository
maintained by the LLVM project: https://apt.llvm.org/
See the discussion in this issue for additional context to this change:
#19041 parent fdce837 commit f145121
1 file changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,7 +1,7 @@ | |||
| 1 | 1 | # syntax=docker/dockerfile:1 | |
| 2 | 2 | ||
| 3 | 3 | # Use the same Python version as OSS-Fuzz to accidental incompatibilities in test code | |
| 4 | - FROM python:3.8-slim | ||
| 4 | + FROM python:3.8-bookworm | ||
| 5 | 5 | ||
| 6 | 6 | LABEL project="GitPython Fuzzing Local Dev Helper" | |
| 7 | 7 | ||
@@ -11,12 +11,12 @@ COPY . . | |||
| 11 | 11 | ||
| 12 | 12 | # Update package managers, install necessary packages, and cleanup unnecessary files in a single RUN to keep the image smaller. | |
| 13 | 13 | RUN apt-get update && \ | |
| 14 | - apt-get install --no-install-recommends -y git && \ | ||
| 14 | + apt-get install -y git clang && \ | ||
| 15 | 15 | python -m pip install --upgrade pip && \ | |
| 16 | 16 | python -m pip install atheris && \ | |
| 17 | 17 | python -m pip install -e . && \ | |
| 18 | 18 | apt-get clean && \ | |
| 19 | 19 | apt-get autoremove -y && \ | |
| 20 | - rm -rf /var/lib/apt/lists/* /root/.cache | ||
| 20 | + rm -rf /var/lib/apt/lists/* | ||
| 21 | 21 | ||
| 22 | 22 | CMD ["bash"] | |
0 commit comments