Draft: Feature/glibc updates fix for fcrepo

This should probably be the latest version 4.7.5 from fcrepo's 4.7-maintenance branch (though of course I'd always prefer to use less antique versions if possible).

Caution, passing credentials/secrets in this way (e.g. as command line parameters) results in all of these parameters (including the contents of all variables used, like for example $POSTGRES_PASSWORD) being readable for all (even unprivileged) users in both the fcrepo container and on the host system. See CWE-214 for more details.

There are two to three possible ways to avoid this:

1. Pass the secret via a configuration file (this obviously requires the command/program to support such a configuration file in the first place).
2. Pass the secret through stdin (this is obviously only possible for a single value per command/program, and it requires said program to be aware of the meaning of that stdin stream, and of course that configuration file should have restrictive access permissions in the file system).
3. Pass the secret through an environment variable (this obviously also requires the invoked command/program to be aware of that specific variable and the meaning of its contents). Please note that depending on the specific use case, this method may also consitute a potential security issue. See CWE-526 for more details. Also, logs, stack traces and other error or debugging output will oftentimes list the whole environment, e.g. all available environment variables, which would then also include the above mentioned secrets. There, try to avoid this third method if possible, and only use it as a last resort.

added parked label

added 144 commits

• 2d82aa38...04613f3b - 143 commits from branch develop
• 69242ddf - Merge branch 'develop' into feature/glibc_updates_fix_for_fcrepo

Compare with previous version

closed