Merge pull request #1313 from zabbix/6.0_sbom

6.0 SBOM

.github/workflows/images_build.yml

@@ -511,6 +511,8 @@ jobs:
           file: ${{ format('{0}/{1}/{2}/Dockerfile', env.DOCKERFILES_DIRECTORY, env.BASE_BUILD_NAME, matrix.os) }}
           platforms: ${{ steps.platform.outputs.list }}
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             org.opencontainers.image.revision=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
@@ -761,6 +763,8 @@ jobs:
           file: ${{ format('{0}/{1}/{2}/Dockerfile', env.DOCKERFILES_DIRECTORY, matrix.build, matrix.os) }}
           platforms: ${{ steps.platform.outputs.list }}
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           build-args: BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
           labels: |
@@ -1218,6 +1222,8 @@ jobs:
           file: ${{ format('{0}/{1}/{2}/Dockerfile', env.DOCKERFILES_DIRECTORY, matrix.build, matrix.os) }}
           platforms: ${{ steps.platform.outputs.list }}
           push: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
+          provenance: mode=max
+          sbom: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
           tags: ${{ steps.meta.outputs.tags }}
           build-args: BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
           labels: |

Dockerfiles/agent/centos/Dockerfile

@@ -36,7 +36,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     REPOLIST="baseos,appstream,epel" && \
     INSTALL_PKGS="bash \
             tini \
-            tzdata \
             iputils \
             pcre2 \
             libcurl-minimal \
@@ -51,6 +50,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/agent/rhel/Dockerfile

@@ -54,7 +54,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     set -eux && \
     INSTALL_PKGS="bash \
             tini \
-            tzdata \
             iputils \
             shadow-utils \
             pcre2 \
@@ -72,7 +71,17 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --best \
             --setopt=tsflags=nodocs \
         ${INSTALL_PKGS} && \
+    microdnf -y update \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
+            --best \
+            --setopt=tsflags=nodocs \
+        tzdata && \
     microdnf -y reinstall \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
             --enablerepo "ubi-8-baseos-rpms" \
             --setopt=install_weak_deps=0 \
             --setopt=keepcache=0 \

Dockerfiles/agent2/alpine/Dockerfile

@@ -37,9 +37,9 @@ COPY --from=builder ["/tmp/mongodb_plugin/zabbix-agent2-plugin-mongodb", "/usr/s
 COPY --from=builder ["/tmp/postgresql_plugin/zabbix-agent2-plugin-postgresql", "/usr/sbin/zabbix-agent2-plugin/zabbix-agent2-plugin-postgresql"]
 
 RUN set -eux && \
-    INSTALL_PKGS="tini \
+    INSTALL_PKGS="bash \
+            tini \
             tzdata \
-            bash \
             pcre2 \
             coreutils \
             smartmontools \

Dockerfiles/agent2/centos/Dockerfile

@@ -41,7 +41,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     REPOLIST="baseos,appstream,epel" && \
     INSTALL_PKGS="bash \
             tini \
-            tzdata \
             iputils \
             pcre2 \
             libcurl-minimal \
@@ -56,6 +55,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
         --setopt=install_weak_deps=False \
         --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/agent2/rhel/Dockerfile

@@ -59,7 +59,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     set -eux && \
     INSTALL_PKGS="bash \
             tini \
-            tzdata \
             iputils \
             shadow-utils \
             pcre2 \
@@ -78,7 +77,17 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --best \
             --setopt=tsflags=nodocs \
         ${INSTALL_PKGS} && \
+    microdnf -y update \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
+            --best \
+            --setopt=tsflags=nodocs \
+        tzdata && \
     microdnf -y reinstall \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
             --enablerepo "ubi-8-baseos-rpms" \
             --setopt=install_weak_deps=0 \
             --setopt=keepcache=0 \

Dockerfiles/proxy-mysql/alpine/Dockerfile

@@ -37,6 +37,7 @@ COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/database/mysql/create_proxy.sql
 RUN set -eux && \
     INSTALL_PKGS="bash \
             tini \
+            tzdata \
             traceroute \
             nmap \
             iputils \

Dockerfiles/proxy-mysql/centos/Dockerfile

@@ -64,6 +64,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/proxy-mysql/rhel/Dockerfile

@@ -90,12 +90,23 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --best \
             --setopt=tsflags=nodocs \
         ${INSTALL_PKGS} && \
-    microdnf -y reinstall \
+    microdnf -y update \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
             --enablerepo "ubi-8-baseos-rpms" \
             --setopt=install_weak_deps=0 \
             --best \
             --setopt=tsflags=nodocs \
         tzdata && \
+    microdnf -y reinstall \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
+            --setopt=keepcache=0 \
+            --best \
+            --setopt=tsflags=nodocs \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/proxy-mysql/ubuntu/Dockerfile

@@ -40,6 +40,7 @@ RUN --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
     INSTALL_PKGS="bash \
             tini \
+            tzdata \
             traceroute \
             nmap \
             ca-certificates \

Dockerfiles/proxy-sqlite3/alpine/Dockerfile

@@ -36,6 +36,7 @@ COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/conf/zabbix_proxy.conf", "/etc/
 RUN set -eux && \
     INSTALL_PKGS="bash \
             tini \
+            tzdata \
             traceroute \
             nmap \
             fping \

Dockerfiles/proxy-sqlite3/centos/Dockerfile

@@ -36,8 +36,9 @@ COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/conf/zabbix_proxy.conf", "/etc/
 RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     set -eux && \
     REPOLIST="baseos,appstream,epel" && \
-    INSTALL_PKGS="libevent \
+    INSTALL_PKGS="bash \
             tini \
+            libevent \
             traceroute \
             nmap \
             libssh \
@@ -59,6 +60,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/proxy-sqlite3/ubuntu/Dockerfile

@@ -38,6 +38,7 @@ RUN --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
     INSTALL_PKGS="bash \
             tini \
+            tzdata \
             traceroute \
             nmap \
             ca-certificates \

Dockerfiles/server-mysql/centos/Dockerfile

@@ -42,7 +42,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             traceroute \
             nmap \
             file-libs \
-            tzdata \
             iputils \
             traceroute \
             libevent \
@@ -67,6 +66,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/server-mysql/rhel/Dockerfile

@@ -61,7 +61,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             nmap \
             fping \
             shadow-utils \
-            tzdata \
             iputils \
             hostname \
             libcurl \
@@ -92,7 +91,17 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --best \
             --setopt=tsflags=nodocs \
         ${INSTALL_PKGS} && \
+    microdnf -y update \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
+            --best \
+            --setopt=tsflags=nodocs \
+        tzdata && \
     microdnf -y reinstall \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
             --enablerepo "ubi-8-baseos-rpms" \
             --setopt=install_weak_deps=0 \
             --setopt=keepcache=0 \

Dockerfiles/server-pgsql/centos/Dockerfile

@@ -44,7 +44,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             traceroute \
             nmap \
             iputils \
-            tzdata \
             traceroute \
             libevent \
             libssh \
@@ -67,6 +66,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/snmptraps/centos/Dockerfile

@@ -25,7 +25,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     set -eux && \
     REPOLIST="baseos,appstream" && \
     INSTALL_PKGS="bash \
-            tzdata \
             net-snmp" && \
     dnf -y install \
             --disablerepo "*" \
@@ -34,6 +33,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/snmptraps/rhel/Dockerfile

@@ -46,7 +46,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     set -eux && \
     INSTALL_PKGS="bash \
             shadow-utils \
-            tzdata \
             net-snmp" && \
     microdnf -y install \
             --disablerepo="*" \
@@ -57,6 +56,23 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --best \
             --setopt=tsflags=nodocs \
         ${INSTALL_PKGS} && \
+    microdnf -y update \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
+            --best \
+            --setopt=tsflags=nodocs \
+        tzdata && \
+    microdnf -y reinstall \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
+            --setopt=keepcache=0 \
+            --best \
+            --setopt=tsflags=nodocs \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/web-apache-mysql/alpine/Dockerfile

@@ -31,6 +31,7 @@ COPY ["conf/etc/", "/etc/"]
 
 RUN set -eux && \
     INSTALL_PKGS="bash \
+            tzdata \
             apache2 \
             curl \
             mariadb-client \

Dockerfiles/web-apache-mysql/centos/Dockerfile

@@ -59,6 +59,13 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --setopt=install_weak_deps=False \
             --best \
         ${INSTALL_PKGS} && \
+    dnf -y reinstall \
+            --disablerepo "*" \
+            --enablerepo "baseos" \
+            --setopt=tsflags=nodocs \
+            --setopt=install_weak_deps=False \
+            --best \
+        tzdata && \
     groupadd \
             --system \
             --gid 1995 \

Dockerfiles/web-apache-mysql/ubuntu/Dockerfile

@@ -33,6 +33,7 @@ RUN --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     set -eux && \
     echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
     INSTALL_PKGS="bash \
+            tzdata \
             apache2 \
             curl \
             libapache2-mod-php \

Dockerfiles/web-apache-pgsql/alpine/Dockerfile

@@ -31,6 +31,7 @@ COPY ["conf/etc/", "/etc/"]
 
 RUN set -eux && \
     INSTALL_PKGS="bash \
+            tzdata \
             apache2 \
             curl \
             php8-apache2 \

Dockerfiles/web-apache-pgsql/ubuntu/Dockerfile

@@ -33,6 +33,7 @@ RUN --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     set -eux && \
     echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
     INSTALL_PKGS="bash \
+            tzdata \
             apache2 \
             curl \
             libapache2-mod-php \

Dockerfiles/web-nginx-mysql/alpine/Dockerfile

@@ -31,6 +31,7 @@ COPY ["conf/etc/", "/etc/"]
 
 RUN set -eux && \
     INSTALL_PKGS="bash \
+            tzdata \
             curl \
             mariadb-client \
             mariadb-connector-c \

Dockerfiles/web-nginx-mysql/rhel/Dockerfile

@@ -51,7 +51,6 @@ COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/ui", "/usr/share/zabbix"]
 RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
     set -eux && \
     INSTALL_PKGS="bash \
-            tzdata \
             curl \
             supervisor \
             shadow-utils \
@@ -84,12 +83,22 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             --best \
             --setopt=tsflags=nodocs \
         ${INSTALL_PKGS} && \
-    microdnf -y reinstall \
+    microdnf -y update \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
             --enablerepo "ubi-8-baseos-rpms" \
             --setopt=install_weak_deps=0 \
             --best \
             --setopt=tsflags=nodocs \
+        tzdata && \
+    microdnf -y reinstall \
+            --disableplugin=subscription-manager \
+            --disablerepo "*" \
+            --enablerepo "ubi-8-baseos-rpms" \
+            --setopt=install_weak_deps=0 \
             --setopt=keepcache=0 \
+            --best \
+            --setopt=tsflags=nodocs \
         tzdata && \
     groupadd \
             --system \

Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile

@@ -33,6 +33,7 @@ RUN --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     set -eux && \
     echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
     INSTALL_PKGS="bash \
+            tzdata \
             ca-certificates \
             curl \
             mysql-client \

Dockerfiles/web-nginx-pgsql/alpine/Dockerfile

@@ -31,6 +31,7 @@ COPY ["conf/etc/", "/etc/"]
 
 RUN set -eux && \
     INSTALL_PKGS="bash \
+            tzdata \
             curl \
             nginx \
             php8-bcmath \

Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile

@@ -33,6 +33,7 @@ RUN --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     set -eux && \
     echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
     INSTALL_PKGS="bash \
+            tzdata \
             ca-certificates \
             curl \
             nginx \