git/make missing from Builder in Dockerfile

[singe]

When building the docker image, the builder is unable to clone the speakeasy repository as git is not installed:

#8 622.8 Collecting git+https://github.com/mandiant/speakeasy@master (from -r requirements.txt (line 8))
#8 622.8   Cloning https://github.com/mandiant/speakeasy (to revision master) to /tmp/pip-req-build-3wih63jr
#8 622.8   ERROR: Error [Errno 2] No such file or directory: 'git' while executing command git version
#8 622.8 ERROR: Cannot find command 'git' - do you have 'git' installed and in your PATH?

The fix is to simply add git to line 13 of the Dockerfile:

apt-get install -y cpp gcc swig libssl-dev libpcap0.8-dev && \
becomes
apt-get install -y cpp gcc swig libssl-dev libpcap0.8-dev git && \

Next up I ran into unicorn failing build due to make missing:

#8 926.6   Running setup.py install for unicorn: started
#8 926.8   Running setup.py install for unicorn: finished with status 'error'
#8 926.8   error: subprocess-exited-with-error
#8 926.8   
#8 926.8   × Running setup.py install for unicorn did not run successfully.
#8 926.8   │ exit code: 1
#8 926.8   ╰─> [5 lines of output]
#8 926.8       running install
#8 926.8       running build
#8 926.8       Building C extensions
#8 926.8       ./make.sh: 123: make: not found
#8 926.8       error: [Errno 2] No such file or directory: 'libunicorn.so'
#8 926.8       [end of output]

So I updated the Dockerfile to include build-essential and are continuing to test.

[cecio]

yeah, great catch! I'll fix it asap.
Thanks for pointing this out!

[cecio]

Fixed with commit 1a001f3

[cecio]

I can not replicate the 2nd part of your issue: with the add of git package I see the entire build running fine 🤔

[singe]

It may be because I'm building an arm64 docker image and the bullseye packages are slightly different on that arch.

[cecio]

Good point.
I added build-essential as well

Thanks a lot for your help!

[singe]

ok, yara_python is a mess on amd64, I can only get it running with the latest from the git repo and a static build. Here's the Dockerfile that's working for me. It's kludgy because I'm uninstalling yara after it gets installed, but this is just a test:

FROM python:3.9-slim AS builder
ENV DEBIAN_FRONTEND=noninteractive
WORKDIR /app
COPY requirements.txt .
RUN apt-get update -y && \
    apt-get install -y cpp gcc swig libssl-dev libpcap0.8-dev build-essential git && \
    python -m venv .venv && \
    .venv/bin/pip install --no-cache-dir -r requirements.txt && \
    find .venv \( -type d -a -name test -o -name tests -o -name __pycache__ \) -o \( -type f -a -name '*.pyc' -o -name '*.pyo' \) -exec rm {} \;
RUN apt install -y yara && \
    .venv/bin/pip uninstall -y yara_python yara && \
    git clone --recursive --depth=1 https://github.com/VirusTotal/yara-python && \
    cd yara-python && \
    ../.venv/bin/python setup.py build && \
    ../.venv/bin/python setup.py install 

FROM python:3.9-slim
ENV DEBIAN_FRONTEND=noninteractive
WORKDIR /app
COPY --from=builder /app .
COPY . /app
RUN apt-get update -y && \
    apt-get install -y tcpdump && \ 
    ./.venv/bin/python apply_patch.py -f && \
    apt-get autoremove -y && \
    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
CMD [ "/app/.venv/bin/python", "rew-sploit.py"]