Use Alpine, Alpine's ImageMagick and terser

.env.template

@@ -70,8 +70,8 @@ MATOMO_AUTH_TOKEN=
 # Hyrax application setting
 HOST_APP_DATA_PATH=/data/
 DERIVATIVES_PATH=/shared/derivatives/
-FITS_PATH=/fits/fits-1.5.0/fits.sh
-FITS_VERSION=1.5.0
+FITS_PATH=/fits/fits-1.5.5/fits.sh
+FITS_VERSION=1.5.5
 UPLOADS_PATH=/shared/uploads/
 CACHE_PATH=/shared/cache/
 BRAND_PATH=/data/public/branding

.env.template.development

@@ -73,8 +73,8 @@ MATOMO_AUTH_TOKEN=
 # Hyrax application setting
 HOST_APP_DATA_PATH=./data/
 DERIVATIVES_PATH=/shared/derivatives/
-FITS_PATH=/fits/fits-1.5.0/fits.sh
-FITS_VERSION=1.5.0
+FITS_PATH=/fits/fits-1.5.5/fits.sh
+FITS_VERSION=1.5.5
 UPLOADS_PATH=/shared/uploads/
 CACHE_PATH=/shared/cache/
 BRAND_PATH=/data/public/branding

.gitlab-ci.yml

 image: docker:stable
-image: ruby:2.7.5
+image: ruby:2.7.7-alpine
 
 stages:
   - build
@@ -21,31 +21,22 @@ variables:
 build-job:
   stage: build
   before_script:
-    - apt-get update -qq && apt-get install -y -qq nodejs
-    - cd hyrax
-    - bundle install --jobs 4 --retry 3
+    - apk update && apk upgrade && apk add nodejs curl libarchive-tools build-base libpq-dev sqlite-dev libxml2-dev tzdata
+    - cd hyrax && bundle install --jobs 4 --retry 3
   script:
-    - export FITS_ROOT=~/rdms-hyrax/
-    - mkdir -p ${FITS_ROOT}
-    - wget -q https://github.com/harvard-lts/fits/releases/download/1.5.0/fits-1.5.0.zip -O ${FITS_ROOT}/fits-1.5.0.zip
-    - unzip -q ${FITS_ROOT}/fits-1.5.0.zip -d ${FITS_ROOT}/fits-1.5.0
-    - chmod a+x ${FITS_ROOT}/fits-1.5.0/fits.sh
-    - rm ${FITS_ROOT}/fits-1.5.0.zip
+    - mkdir -p /fits/fits-1.5.5
+    - curl --fail --location "https://github.com/harvard-lts/fits/releases/download/1.5.5/fits-1.5.5.zip" | bsdtar --extract --directory /fits/fits-1.5.5
+    - chmod +x "/fits/fits-1.5.5/fits.sh" "/fits/fits-1.5.5/fits-env.sh" "/fits/fits-1.5.5/fits-ngserver.sh"
     - bundle exec rake db:test:prepare
 
 test-job:
   stage: test
   coverage: '/coverage: \d+.\d+% of statements/'
   before_script:
-    - apt-get update -qq && apt-get install -y -qq nodejs
-    - apt-get update -qq && apt-get install -y -qq software-properties-common
-    - apt-add-repository 'deb http://security.debian.org/debian-security stretch/updates main'
-    - apt-get update && apt-get -y install openjdk-8-jdk libmediainfo-dev
-    - update-alternatives --set java /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java
-    - cd hyrax
-    - bundle install --jobs 4 --retry 3
+    - apk update && apk upgrade && apk add nodejs build-base libpq-dev libxml2-dev openjdk8-jre sqlite-dev
+    - cd hyrax && bundle install --jobs 4 --retry 3
   script:
-    - export FITS_PATH=~/rdms-hyrax/fits-1.3.0/fits.sh
+    - export FITS_PATH=/fits/fits-1.5.5/fits.sh
     - if test -f "lib/tasks/test_servers.rake"; then echo 'Running full tests' && bundle exec rake test:servers:start && bundle exec rspec && bundle exec rake test:servers:stop; else echo "Running limited tests"; bundle exec rspec --exclude-pattern "**/features/*_spec.rb"; fi
 
 deploy-job:

hyrax/Dockerfile

-FROM ruby:2.7.7-buster
+FROM ruby:2.7.7-alpine
 
 # Setup build variables
 ARG RAILS_ENV
 ARG DERIVATIVES_PATH
 ARG UPLOADS_PATH
 ARG CACHE_PATH
-ARG FITS_PATH
-ARG FITS_VERSION
-ARG IM_VERSION=7.0.7-39
+ARG FITS_VERSION=1.5.5
 
 ENV APP_PRODUCTION=/data/ \
     APP_WORKDIR=/data
@@ -15,49 +13,23 @@ ENV APP_PRODUCTION=/data/ \
 # Add backports to apt-get sources
 # Install libraries, dependencies, java and fits
 
-RUN apt-get update -qq && \
-    apt-get -y install apt-transport-https && \
-    curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - && \
-    echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list && \
-    curl -sL https://deb.nodesource.com/setup_14.x | bash - && \
-    apt-get update -qq && apt-get install -y --no-install-recommends \
-    libpq-dev \
-    libxml2-dev libxslt1-dev \
-    nodejs \
-    libreoffice \
-    libass-dev libfreetype6-dev libmp3lame-dev libopus-dev libsdl2-dev libtheora-dev libtool libva-dev libvdpau-dev \
-    libvpx-dev libvorbis-dev libx264-dev libx265-dev libxcb1-dev libxcb-shm0-dev libxcb-xfixes0-dev nasm pkg-config \
-    texinfo wget yasm zlib1g-dev \
-    libjpeg-dev libtiff-dev libpng-dev libraw-dev libwebp-dev libjxr-dev \
-    libcairo2-dev libgs-dev librsvg2-dev \
-    libmp3lame-dev libvorbis-dev libtheora-dev libspeex-dev libx264-dev \
-    ghostscript ffmpeg \
-    ufraw \
-    bzip2 unzip xz-utils \
-    vim \
-    git \
-    openjdk-11-jre-headless \
-    yarn && \
-    yarn config set no-progress && \
-    yarn config set silent
-
-RUN git clone https://github.com/ImageMagick/ImageMagick.git && \
-    cd ImageMagick && git checkout ${IM_VERSION} && \
-    ./configure --prefix=/usr --without-magick-plus-plus --disable-docs --disable-static --with-tiff && \
-    make && make install
-
-RUN mkdir -p /fits/ \
-    && wget -q https://github.com/harvard-lts/fits/releases/download/$FITS_VERSION/fits-$FITS_VERSION.zip -O /fits/fits-$FITS_VERSION.zip \
-    && unzip -q /fits/fits-$FITS_VERSION.zip -d /fits/fits-$FITS_VERSION \
-    && chmod a+x $FITS_PATH \
-    && rm /fits/fits-$FITS_VERSION.zip
+RUN apk update && \
+    apk upgrade && \
+    apk add bash build-base curl curl-dev gcompat imagemagick imagemagick-libs imagemagick-dev libarchive-tools  \
+    libpq-dev libxml2-dev libxslt-dev nodejs openjdk11-jre-headless sqlite-dev tzdata yarn
+
+COPY policy.xml /etc/ImageMagick-7/policy.xml
+
+RUN mkdir -p /fits/fits-$FITS_VERSION \
+    && curl --fail --location "https://github.com/harvard-lts/fits/releases/download/$FITS_VERSION/fits-$FITS_VERSION.zip" | bsdtar --extract --directory /fits/fits-$FITS_VERSION \
+    && chmod +x "/fits/fits-$FITS_VERSION/fits.sh" "/fits/fits-$FITS_VERSION/fits-env.sh" "/fits/fits-$FITS_VERSION/fits-ngserver.sh"
 
 # copy gemfiles to production folder
 COPY Gemfile Gemfile.lock $APP_PRODUCTION
 
 # install gems to system - use flags dependent on RAILS_ENV
-RUN cd $APP_PRODUCTION && \
-    bundle config build.nokogiri --use-system-libraries \
+RUN cd $APP_PRODUCTION \
+    && bundle config build.nokogiri --use-system-libraries \
     && if [ "$RAILS_ENV" = "production" ]; then \
             bundle install --without test:development; \
         else \
@@ -75,7 +47,6 @@ RUN mkdir -p $CACHE_PATH
 
 # copy the application
 COPY . $APP_PRODUCTION
-COPY docker-entrypoint.sh /bin/
 
 # use the just built Gemfile.lock, not the one copied into the container and verify the gems are correctly installed
 RUN cd $APP_PRODUCTION \
@@ -89,6 +60,8 @@ RUN if [ "$RAILS_ENV" = "production" ]; then \
         && SECRET_KEY_BASE_PRODUCTION=0 bundle exec rake assets:clean assets:precompile; \
     fi
 
+COPY docker-entrypoint.sh /bin/
+
 WORKDIR $APP_WORKDIR
 
 RUN chmod +x /bin/docker-entrypoint.sh

hyrax/Gemfile

@@ -12,10 +12,10 @@ gem 'puma', '~> 3.11'
 # Use SCSS for stylesheets
 gem 'sass-rails', '~> 5.0'
 # Use Uglifier as compressor for JavaScript assets
-gem 'uglifier', '>= 1.3.0'
+gem 'terser', '>= 1.1.12'
 # See https://github.com/rails/execjs#readme for more supported runtimes
 # gem 'mini_racer', platforms: :ruby
-gem 'therubyracer'
+gem 'execjs'
 # Use carrierwave-aws for upload file on aws s3
 gem 'carrierwave-aws'
 # Use CoffeeScript for .coffee assets and views

hyrax/Gemfile.lock

@@ -559,7 +559,6 @@ GEM
       rdf-vocab (~> 3.0)
     legato (0.7.0)
       multi_json
-    libv8 (3.16.14.19)
     libxml-ruby (3.1.0)
     link_header (0.0.8)
     linkeddata (3.1.6)
@@ -784,7 +783,6 @@ GEM
       redis (>= 4)
     redlock (1.3.2)
       redis (>= 3.0.0, < 6.0)
-    ref (2.0.0)
     reform (2.5.0)
       disposable (>= 0.4.2, < 0.5.0)
       representable (>= 2.4.0, < 3.1.0)
@@ -942,11 +940,10 @@ GEM
       tins (~> 1.0)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
+    terser (1.1.13)
+      execjs (>= 0.3.0, < 3)
     tether-rails (1.4.0)
       rails (>= 3.1)
-    therubyracer (0.12.3)
-      libv8 (~> 3.16.14.15)
-      ref
     thor (1.2.1)
     thread_safe (0.3.6)
     tilt (2.0.10)
@@ -966,8 +963,6 @@ GEM
     tzinfo (1.2.9)
       thread_safe (~> 0.1)
     uber (0.1.0)
-    uglifier (4.2.0)
-      execjs (>= 0.3.0, < 3)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.8)
@@ -1026,6 +1021,7 @@ DEPENDENCIES
   database_cleaner
   devise
   devise-guests (~> 0.6)
+  execjs
   factory_bot_rails
   fcrepo_wrapper
   hydra-role-management
@@ -1052,11 +1048,10 @@ DEPENDENCIES
   spring
   spring-watcher-listen (~> 2.0.0)
   sqlite3 (~> 1.3.0)
-  therubyracer
+  terser (>= 1.1.12)
   turbolinks (~> 5)
   twitter-typeahead-rails (= 0.11.1.pre.corejavascript)
   tzinfo-data
-  uglifier (>= 1.3.0)
   web-console (>= 3.3.0)
 
 RUBY VERSION

hyrax/config/environments/production.rb

@@ -33,7 +33,7 @@ Rails.application.configure do
   end
 
   # Compress JavaScripts and CSS.
-  config.assets.js_compressor = :uglifier
+  config.assets.js_compressor = :terser
   # config.assets.css_compressor = :sass
 
   # Do not fallback to assets pipeline if a precompiled asset is missed.

hyrax/config/initializers/hyrax.rb

@@ -79,7 +79,7 @@ Hyrax.config do |config|
   # config.redis_namespace = "hyrax"
 
   # Path to the file characterization tool
-  config.fits_path = ENV['FITS_PATH'] || "/fits/fits-1.5.0/fits.sh"
+  config.fits_path = ENV['FITS_PATH'] || "/fits/fits-1.5.5/fits.sh"
 
   # Path to the file derivatives creation tool
   # config.libreoffice_path = "soffice"

hyrax/config/initializers/sidekiq.rb

@@ -2,7 +2,7 @@
 config = YAML.safe_load(ERB.new(IO.read(Rails.root + 'config' + 'redis.yml')).result)[Rails.env].with_indifferent_access
 redis_config = config.merge(thread_safe: true)
 
-Sidekiq::Logging.logger.level = Logger::WARN if ENV['RAILS_ENV'] == 'production'
+Sidekiq.logger.level = Logger::WARN if ENV['RAILS_ENV'] == 'production'
 
 redis_conn = { url: "redis://#{config[:host]}:#{config[:port]}/" }
 

hyrax/docker-entrypoint.sh

-#!/bin/bash
+#!/bin/sh
 
 echo "Creating log folder"
-mkdir -p $APP_WORKDIR/log
+mkdir -p "${APP_WORKDIR}/log"
 
-if [ "$RAILS_ENV" = "production" ]; then
+if [ "${RAILS_ENV}" = "production" ]; then
     # Verify all the production gems are installed
     bundle check
 else
@@ -17,29 +17,29 @@ bundle exec rake db:exists && bundle exec rake db:migrate || bundle exec rake db
 
 # Check solr and fedora are running
 n=0
-solr_running=false
-fedora_running=false
-while [[ $n -lt 15 ]]
+solr_running=0
+fedora_running=0
+while [ ${n} -lt 15 ]
 do
     # check Solr is running
-    if [ "solr_running" = false ] ; then
-      SOLR=$(curl --silent --connect-timeout 45 "http://${SOLR_HOST:-solr}:${SOLR_PORT:-8983}/solr/" | grep "Apache SOLR")
-      if [ -n "$SOLR" ] ; then
+    if [ ${solr_running} -eq 0 ] ; then
+      solr_curl=$(curl --silent --connect-timeout 45 "http://${SOLR_HOST:-solr}:${SOLR_PORT:-8983}/solr/" | grep "Apache SOLR")
+      if [ -n "${solr_curl}" ] ; then
           echo "Solr is running"
-          solr_running=true
+          solr_running=1
       fi
     fi
 
     # check Fedora is running
-    if [ "fedora_running" = false ] ; then
-      FEDORA=$(curl --silent --connect-timeout 45 "http://${FEDORA_HOST:-fcrepo}:${FEDORA_PORT:-8080}/fcrepo/" | grep "Fedora Commons Repository")
-      if [ -n "$FEDORA" ] ; then
+    if [ ${fedora_running} -eq 0 ] ; then
+      fedora_curl=$(curl --silent --connect-timeout 45 "http://${FEDORA_HOST:-fcrepo}:${FEDORA_PORT:-8080}/fcrepo/" | grep "Fedora Commons Repository")
+      if [ -n "${fedora_curl}" ] ; then
           echo "Fedora is running"
-          fedora_running=true
+          fedora_running=1
       fi
     fi
 
-    if [ "solr_running" = true ] &&  [ "fedora_running" = true ] ; then
+    if [ ${solr_running} -eq 1 ] &&  [ ${fedora_running} -eq 1 ] ; then
       break
     else
       sleep 1
@@ -48,13 +48,13 @@ do
 done
 
 # Exit if Solr is not running
-if [ "solr_running" = false ] ; then
+if [ ${solr_running} -eq 0 ] ; then
     echo "ERROR: Solr is not running"
     exit 1
 fi
 
 # Exit if Fedora is not running
-if [ "fedora_running" = false ] ; then
+if [ ${fedora_running} -eq 0 ] ; then
     echo "ERROR: Fedora is not running"
     exit 1
 fi
@@ -62,6 +62,6 @@ fi
 echo "Setting up hyrax... (this can take a few minutes)"
 bundle exec rake rdms:setup_hyrax["seed/setup.json"]
 
-# echo "--------- Starting Hyrax in $RAILS_ENV mode ---------"
+# echo "--------- Starting Hyrax in ${RAILS_ENV} mode ---------"
 rm -f /tmp/hyrax.pid
 bundle exec rails server -p 3000 -b '0.0.0.0' --pid /tmp/hyrax.pid

hyrax/package.json

@@ -5,16 +5,15 @@
   "dependencies": {
     "postcss": "^8.4.14",
     "postcss-scss": "^4.0.4",
-    "universalviewer": "^3.0.16"
+    "universalviewer": "^3.1.4"
   },
   "scripts": {
     "preinstall": "rm -rf ./public/uv",
     "postinstall": "yarn run uv-install && yarn run uv-config",
-    "uv-install": "shx cp -r ./node_modules/universalviewer/dist ./public/uv",
-    "uv-config": "shx cp ./config/uv/uv.html ./public/uv/uv.html & shx cp ./config/uv/uv-config.json ./public/uv/"
+    "uv-install": "cp -r ./node_modules/universalviewer/dist ./public/uv",
+    "uv-config": "cp ./config/uv/uv.html ./public/uv/uv.html & cp ./config/uv/uv-config.json ./public/uv/"
   },
   "devDependencies": {
-    "shx": "^0.3.2",
     "stylelint-config-standard-scss": "^4.0.0"
   }
 }

hyrax/policy.xml

+<policymap>
+  <policy domain="delegate" rights="none" pattern="*" />
+  <policy domain="module" rights="none" pattern="*" />
+  <policy domain="module" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
+  <policy domain="coder" rights="write" pattern="{MSVG,MVG,PDF,PS,PS2,PS3,XPS}" />
+  <!-- <policy domain="resource" name="list-length" value="1"/> -->
+  <policy domain="module" rights="none" pattern="{PS,PDF,XPS}"/>
+  <policy domain="path" rights="none" pattern="@*"/>  <!-- indirect reads not permitted -->
+  <policy domain="system" name="memory-map" value="anonymous"/>
+  <policy domain="cache" name="memory-map" value="anonymous"/>
+  <policy domain="system" name="shred" value="1"/>
+  <policy domain="system" name="max-memory-request" value="256MiB"/>
+</policymap>