Bugfix/wm 16100 update dotnet 10 on all services CVE 2026 40372

.github/workflows/default.yml

@@ -162,7 +162,7 @@ jobs:
     steps:
       - name: Set variables
         run: |
-          echo "PGREPACK_VERSION=1.5.1" >> $GITHUB_ENV
+          echo "PGREPACK_VERSION=1.5.3" >> $GITHUB_ENV
           echo "PG_VERSION=17" >> $GITHUB_ENV
       - name: Checkout code
         uses: actions/checkout@v4

17/Dockerfile

@@ -1,17 +1,13 @@
-FROM alpine:3.20
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.22
 
 ENV PG_MAJOR 17
 ENV PG_VERSION 17.0
 ENV PG_SHA256 7e276131c0fdd6b62588dbad9b3bb24b8c3498d5009328dba59af16e819109de
-ENV PG_REPACK_VERSION 1.5.1
+ENV PG_REPACK_VERSION 1.5.3
 
 ENV LANG en_US.utf8
 WORKDIR /pg_repack
 
-ENV DOCKER_PG_LLVM_DEPS \
-		llvm15-dev \
-		clang15
-
 RUN set -eux; \
 	\
 	wget -O postgresql.tar.bz2 "https://ftp.postgresql.org/pub/source/v$PG_VERSION/postgresql-$PG_VERSION.tar.bz2"; \
@@ -26,7 +22,6 @@ RUN set -eux; \
 	rm postgresql.tar.bz2; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		$DOCKER_PG_LLVM_DEPS \
 		bison \
 		coreutils \
 		dpkg-dev dpkg \
@@ -63,9 +58,6 @@ RUN set -eux; \
 	wget -O config/config.guess 'https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=7d3d27baf8107b630586c962c057e22149653deb'; \
 	wget -O config/config.sub 'https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=7d3d27baf8107b630586c962c057e22149653deb'; \
 	\
-	export LLVM_CONFIG="/usr/lib/llvm15/bin/llvm-config"; \
-	export CLANG=clang-15; \
-	\
 	./configure \
 		--enable-option-checking=fatal \
 		--build="$gnuArch" \
@@ -87,7 +79,6 @@ RUN set -eux; \
 		--with-libxml \
 		--with-libxslt \
 		--with-icu \
-		--with-llvm \
 		--with-lz4 \
 		--with-zstd \
 	; \
@@ -129,8 +120,7 @@ RUN set -eux; \
 
 COPY docker_entrypoint.sh /bin
 
-RUN set -x \
-    chmod +x /bin/docker_entrypoint.sh
+RUN chmod +x /bin/docker_entrypoint.sh
 
 ENTRYPOINT ["/bin/docker_entrypoint.sh"]
 CMD ["-no-superuser-check"]

WEBMED.md

@@ -0,0 +1,40 @@
+# WebMed: publishing `dotnet-pg-repack` to harbor
+
+This repo is a WebMed fork of [cherts/pg_repack_docker](https://github.com/CHERTS/pg_repack_docker). Upstream CI (`.github/workflows/release.yml`) publishes to Docker Hub (`cherts/pg-repack`). **WebMed does not use that pipeline for its internal image.**
+
+The image consumed by **WALL-E** (`harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack`) is **built and pushed manually from a local machine** — there is no CI that pushes to harbor. If you change a Dockerfile here, you must rebuild and push by hand or WALL-E will keep running the old image.
+
+## Why the base is `dotnet/aspnet` (not `dotnet/runtime`)
+
+WALL-E is an ASP.NET Core service (`Microsoft.NET.Sdk.Web`, health-check endpoint), so its published app needs the **`Microsoft.AspNetCore.App`** shared framework — which only `mcr.microsoft.com/dotnet/aspnet` ships, not `dotnet/runtime`. The `17/Dockerfile` `FROM` must stay on `aspnet`.
+
+LLVM/JIT is **not** built in (`--with-llvm` removed): JIT is a server-side feature and this is a client-side `pg_repack` image, so it's dead weight (and Alpine 3.22 no longer ships `clang15`).
+
+## Build & push (PostgreSQL 17 image)
+
+```bash
+# 1. Build (context is the PG-major dir, e.g. 17)
+docker build -t dotnet-pg-repack:<version> -f 17/Dockerfile 17
+
+# 2. Sanity-check the runtimes and pg_repack
+docker run --rm --entrypoint dotnet     dotnet-pg-repack:<version> --list-runtimes
+docker run --rm --entrypoint pg_repack  dotnet-pg-repack:<version> --version
+
+# 3. Tag for harbor and push
+docker login harbor.k8s.webmed.no:443
+docker tag  dotnet-pg-repack:<version> harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack:<version>
+docker push harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack:<version>
+```
+
+## Tag convention
+
+The harbor tag tracks the **pg_repack version** (e.g. `1.5.3`). Historically a `.N` revision suffix was used for rebuilds at the same pg_repack version (e.g. `1.5.2.1`). Keep WALL-E's `Dockerfile` base `FROM` in sync with whatever tag you push.
+
+| pushed tag | base image | pg_repack | notes |
+|------------|-----------|-----------|-------|
+| `1.5.2.1`  | `dotnet/aspnet:9.0-alpine3.20` | 1.5.2 | previous (.NET 9) |
+| `1.5.3`    | `dotnet/aspnet:10.0-alpine3.22` | 1.5.3 | .NET 10 (WM-16100) |
+
+## Consumer
+
+`WALL-E/Dockerfile` → `FROM harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack:<version>`.

build.sh

@@ -1,12 +1,8 @@
 #!/bin/bash
 
 PG_REPACK=(
-    "12,1.4.5"
-    "13,1.4.6"
-    "14,1.4.7"
-    "15,1.4.8"
-    "16,1.5.0"
-    "17,1.5.1"
+
+    "17,1.5.3"
 )
 
 # Check command exist function