updated dockerfile for arm

Update git version to 2.30.2 to fix git clone vulnerability

docker/Dockerfile.linux.amd64

@@ -1,31 +1,10 @@
 FROM alpine:3.12
-RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl
+RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl aws-cli sudo
-
-ENV GLIBC_VER=2.31-r0
-RUN apk --no-cache add \
-        binutils \
-        curl \
-    && curl -sL https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub -o /etc/apk/keys/sgerrand.rsa.pub \
-    && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-${GLIBC_VER}.apk \
-    && curl -sLO https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VER}/glibc-bin-${GLIBC_VER}.apk \
-    && apk add --no-cache \
-        glibc-${GLIBC_VER}.apk \
-        glibc-bin-${GLIBC_VER}.apk \
-    && curl -sL https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.1.24.zip -o awscliv2.zip \
-    && unzip awscliv2.zip \
-    && aws/install \
-    && rm -rf \
-        awscliv2.zip \
-        aws \
-        /usr/local/aws-cli/v2/*/dist/aws_completer \
-        /usr/local/aws-cli/v2/*/dist/awscli/data/ac.index \
-        /usr/local/aws-cli/v2/*/dist/awscli/examples \
-    && apk --no-cache del \
-        binutils \
-        curl \
-    && rm glibc-${GLIBC_VER}.apk \
-    && rm glibc-bin-${GLIBC_VER}.apk \
-    && rm -rf /var/cache/apk/*
 
 ADD posix/* /usr/local/bin/
+RUN adduser -g Drone -s /bin/sh -D -u 1000 drone
+RUN echo 'drone ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/drone
+USER drone:drone
+RUN chmod -R 777 /home/drone
+
 ENTRYPOINT ["/usr/local/bin/clone"]

docker/Dockerfile.linux.arm

@@ -1,5 +1,9 @@
 FROM arm32v6/alpine:3.12
-RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl
+RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl aws-cli sudo
 
 ADD posix/* /usr/local/bin/
+RUN adduser -g Drone -s /bin/sh -D -u 1000 drone
+RUN echo 'drone ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/drone
+USER drone:drone
+RUN chmod -R 777 /home/drone
 ENTRYPOINT ["/usr/local/bin/clone"]

docker/Dockerfile.linux.arm6

@@ -1,5 +1,9 @@
 FROM arm32v6/alpine:3.12
-RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl
+RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl aws-cli sudo
 
 ADD posix/* /usr/local/bin/
+RUN adduser -g Drone -s /bin/sh -D -u 1000 drone
+RUN echo 'drone ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/drone
+USER drone:drone
+RUN chmod -R 777 /home/drone
 ENTRYPOINT ["/usr/local/bin/clone"]

docker/Dockerfile.linux.arm64

@@ -1,5 +1,9 @@
 FROM arm64v8/alpine:3.12
-RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl
+RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl aws-cli sudo
 
 ADD posix/* /usr/local/bin/
+RUN adduser -g Drone -s /bin/sh -D -u 1000 drone
+RUN echo 'drone ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/drone
+USER drone:drone
+RUN chmod -R 777 /home/drone
 ENTRYPOINT ["/usr/local/bin/clone"]

docker/Dockerfile.linux.arm7

@@ -1,5 +1,9 @@
 FROM arm32v6/alpine:3.12
-RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl
+RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl aws-cli sudo
 
 ADD posix/* /usr/local/bin/
+RUN adduser -g Drone -s /bin/sh -D -u 1000 drone
+RUN echo 'drone ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/drone
+USER drone:drone
+RUN chmod -R 777 /home/drone
 ENTRYPOINT ["/usr/local/bin/clone"]

docker/Dockerfile.linux.arm8

@@ -1,5 +1,9 @@
 FROM arm64v8/alpine:3.12
-RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl
+RUN apk add --no-cache ca-certificates git git-lfs openssh curl perl aws-cli sudo
 
 ADD posix/* /usr/local/bin/
+RUN adduser -g Drone -s /bin/sh -D -u 1000 drone
+RUN echo 'drone ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/drone
+USER drone:drone
+RUN chmod -R 777 /home/drone
 ENTRYPOINT ["/usr/local/bin/clone"]

posix/clone

@@ -1,14 +1,34 @@
 #!/bin/sh
 
 if [[ ! -z "${DRONE_WORKSPACE}" ]]; then
+	if [[ -n "${CI}" ]]; then
+		sudo mkdir -p ${DRONE_WORKSPACE}
+		sudo chown drone:drone ${DRONE_WORKSPACE}
+	else
+		mkdir -p ${DRONE_WORKSPACE}
+	fi
 	cd ${DRONE_WORKSPACE}
 fi
 
+# we default home directory to /home/drone
+
+if [ "$HOME" != "/home/drone" ]; then
+	export HOME=/home/drone
+fi
+
+# if the home directory does not exist it should
+# be created.
+
+if [ ! -d "${HOME}" ]; then
+	echo "HOME directory does not exist; creating ${HOME}"
+	mkdir -p ${HOME}
+fi
+
 # if the netrc enviornment variables exist, write
 # the netrc file.
 
 if [[ ! -z "${DRONE_NETRC_MACHINE}" ]]; then
-	cat <<EOF > /root/.netrc
+	cat <<EOF > ${HOME}/.netrc
 machine ${DRONE_NETRC_MACHINE}
 login ${DRONE_NETRC_USERNAME}
 password ${DRONE_NETRC_PASSWORD}
@@ -20,12 +40,12 @@ fi
 # known hosts file.
 
 if [[ ! -z "${DRONE_SSH_KEY}" ]]; then
-	mkdir /root/.ssh
+	mkdir ${HOME}/.ssh
-	echo -n "$DRONE_SSH_KEY" > /root/.ssh/id_rsa
+	echo -n "$DRONE_SSH_KEY" > ${HOME}/.ssh/id_rsa
-	chmod 600 /root/.ssh/id_rsa
+	chmod 600 ${HOME}/.ssh/id_rsa
 
-	touch /root/.ssh/known_hosts
+	touch ${HOME}/.ssh/known_hosts
-	chmod 600 /root/.ssh/known_hosts
+	chmod 600 ${HOME}/.ssh/known_hosts
 	ssh-keyscan -H ${DRONE_NETRC_MACHINE} > /etc/ssh/ssh_known_hosts 2> /dev/null
 fi