fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-UBUNTU2004-BASH-581100
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-576079
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-576079
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-582552
- https://snyk.io/vuln/SNYK-UBUNTU2004-SYSTEMD-582552

CMakeLists.txt

@@ -1,6 +1,6 @@
 cmake_minimum_required (VERSION 3.1)
 
-project (rpc VERSION 1.2.1)
+project (rpc VERSION 1.2.0)
 
 set (CMAKE_CXX_STANDARD 11)
 

Dockerfile

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #*********************************************************************/
 
-FROM ubuntu:20.10 AS rpc-builder
+FROM ubuntu:rolling AS rpc-builder
 
 WORKDIR /
 ARG DEBIAN_FRONTEND=noninteractive
@@ -11,7 +11,7 @@ RUN \
   apt-get update -y -qq && \
   apt install -y -qq \
     git cmake build-essential libssl-dev zlib1g-dev \
-    curl unzip zip pkg-config ca-certificates
+    curl unzip zip pkg-config
 RUN git clone https://github.com/open-amt-cloud-toolkit/rpc.git
 WORKDIR /rpc
 RUN mkdir -p build
@@ -23,7 +23,7 @@ WORKDIR /rpc/build
 RUN cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_TOOLCHAIN_FILE=/rpc/vcpkg/scripts/buildsystems/vcpkg.cmake ..
 RUN cmake --build .
 
-FROM ubuntu:20.10 
+FROM ubuntu:rolling 
 
 LABEL license='SPDX-License-Identifier: Apache-2.0' \
       copyright='Copyright (c) 2021: Intel'

Jenkinsfile

@@ -1,171 +0,0 @@
-pipeline {
-    agent none
-    options {
-        buildDiscarder(logRotator(numToKeepStr: '5', daysToKeepStr: '30'))
-        timestamps()
-        timeout(unit: 'HOURS', time: 2)
-    }
-    
-    stages {
-        stage ('Parallel') {
-            parallel {
-                stage ('Linux') {
-                    agent { label 'docker-amt' }
-                    stages {
-                        stage ('Cloning Repository') {
-                            steps {
-                                script {
-                                    scmCheckout {
-                                        clean = true
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-                stage ('Windows') {
-                    agent { label 'openamt-win' }
-                    stages {
-                        stage ('Cloning Repository') {
-                            steps {
-                                script {
-                                    scmCheckout {
-                                        clean = true
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        stage ('Static Code Scan - Protex') {
-            agent { label 'docker-amt' }
-            steps {
-                script {
-                    staticCodeScan {
-                        // generic
-                        scanners             = ['protex']
-                        scannerType          = ['c','c++']
-
-                        protexProjectName    = 'OpenAMT - RPC'
-                        // internal, do not change
-                        protexBuildName      = 'rrs-generic-protex-build'
-                    }
-                }
-            }
-        }
-
-        stage ('Parallel Builds') {
-            parallel {
-                stage ('Linux') {
-                    agent { label 'docker-amt' }
-                    stages {
-                        stage('Build') {
-                            agent {
-                                docker {
-                                    image 'ubuntu:18.04'
-                                    reuseNode true
-                                }
-                            }
-                            steps {
-                                sh './scripts/jenkins-pre-build.sh'
-                                sh './scripts/jenkins-build.sh'
-                            }
-                        }
-                        stage ('Archive') {
-                            steps {
-                                archiveArtifacts allowEmptyArchive: true, artifacts: 'build/rpc', caseSensitive: false, onlyIfSuccessful: true
-                            }
-                        }
-                        
-                    }
-                }
-                stage ('Windows') {
-                    agent { label 'openamt-win' }
-                    stages{
-                        stage ('Build') {
-                            steps {
-                                bat 'scripts\\jenkins-pre-build.cmd'
-                                bat 'scripts\\jenkins-build.cmd'
-                                // prepare stash for the binary scan
-                                stash includes: "**/*.exe", name: 'rpc-app'
-                            }
-                        }
-                        stage ('Archive') {
-                            steps {
-                                archiveArtifacts allowEmptyArchive: true, artifacts: 'build\\Release\\rpc.exe', caseSensitive: false, onlyIfSuccessful: true
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        stage ('Parallel Scans') {
-            parallel {
-                stage ('Static Code Scan Linux') {
-                    agent { label 'docker-amt' }
-                    steps {
-                        script {
-                            staticCodeScan {
-                                // generic
-                                scanners             = ['bdba','klocwork']
-                                scannerType          = 'c++'
-
-                                protecodeGroup          = '25'
-                                protecodeScanName       = 'rpc-zip'
-                                protecodeDirectory      = './build/rpc'
-                                
-                                klockworkPreBuildScript = './scripts/jenkins-pre-build.sh'
-                                klockworkBuildCommand = './scripts/jenkins-build.sh'
-                                klockworkProjectName  = 'Panther Point Creek'
-                                klockworkIgnoreCompileErrors = true
-                            }
-                        }
-                    }
-                }
-                stage ('Static Code Scan Windows') {
-                    stages {
-                        stage ('Static Code Scan Windows - Klockwork') {
-                            agent { label 'openamt-win' }
-                            steps {
-                                script {
-                                    staticCodeScan {
-                                        // generic
-                                        scanners             = ['klocwork']
-                                        scannerType          = 'c++'
-                                        
-                                        klockworkPreBuildScript = 'scripts\\jenkins-pre-build.cmd'
-                                        klockworkBuildCommand = 'scripts\\jenkins-build.cmd'
-                                        klockworkProjectName  = 'Panther Point Creek'
-                                        klockworkIgnoreCompileErrors = true
-                                    }
-                                }
-                            }
-                        }
-                        stage ('Static Code Scan Windows - BDBA') {
-                            agent { label 'docker-amt' }
-                            steps {
-                                script {
-                                    sh "mkdir -p bdbaScanDir"
-                                    dir("bdbaScanDir") {
-                                        unstash 'rpc-app'
-                                    }
-                                    staticCodeScan {
-                                        // generic
-                                        scanners             = ['bdba']
-                                        scannerType          = 'c++'
-                                        
-                                        protecodeGroup          = '25'
-                                        protecodeScanName       = 'rpc-zip'
-                                        protecodeDirectory      = 'bdbaScanDir'
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-}

SECURITY.md

@@ -1,5 +0,0 @@
-# Security Policy
-Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. 
-
-## Reporting a Vulnerability
-Please report any security vulnerabilities in this project utilizing the guidelines [here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).

scripts/jenkins-build.cmd

@@ -14,7 +14,7 @@ set BASE_DIR=%cd%
 set VCPKG_DIR=C:\opt\vcpkg-source
 
 REM build RPC
-
+cd %BASE_DIR%/rpc
 
 if exist "build" rd /q /s "build"
 
@@ -23,4 +23,4 @@ cd build
 echo %VCPKG_DIR%\vcpkg\scripts\buildsystems\vcpkg.cmake
 cmake -DVCPKG_TARGET_TRIPLET=x64-windows-static -DCMAKE_TOOLCHAIN_FILE=%VCPKG_DIR%\vcpkg\scripts\buildsystems\vcpkg.cmake ..
 cmake --build . --config Release
-dir %BASE_DIR%\build
+dir %BASE_DIR%\rpc\build

scripts/jenkins-build.sh

@@ -5,9 +5,9 @@ set -x
 # Jenkins Build script
 #   - Ubuntu 18.04
 #
-export BASE_DIR="$PWD"
-export CMAKE_CXX_FLAGS="-isystem /usr/lib/gcc/x86_64-linux-gnu/7/include"
 
+export CMAKE_CXX_FLAGS="-isystem /usr/lib/gcc/x86_64-linux-gnu/7/include"
+cd "$BASE_DIR"/rpc
 
 if [ -d "build" ]; then
   rm -rf build
@@ -15,5 +15,5 @@ fi
 
 mkdir build
 cd build
-cmake -DCMAKE_TOOLCHAIN_FILE="$BASE_DIR"/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release ..
+cmake -DCMAKE_TOOLCHAIN_FILE="$BASE_DIR"/rpc/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_BUILD_TYPE=Release ..
 cmake --build .

scripts/jenkins-pre-build.sh

@@ -4,15 +4,14 @@
 #   - Ubuntu 18.04
 #
 
-apt update
+sudo apt install git cmake build-essential curl zip unzip tar pkg-config
-apt install git cmake build-essential curl zip unzip tar pkg-config -y
 
 ## current dir - RPC source directory
-#export BASE_DIR="$PWD"
+export BASE_DIR="$PWD"
 
-#cd "$BASE_DIR"/rpc
+cd "$BASE_DIR"/rpc
 ## build vcpkg
-git -C vcpkg pull || git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git vcpkg
+git clone --branch 2020.11-1 https://github.com/microsoft/vcpkg.git
 cd vcpkg
 ./bootstrap-vcpkg.sh
 

usage.cpp

@@ -49,15 +49,15 @@ void usage_show_help()
     std::cout << "Examples:"                                                                        << std::endl;
     std::cout << "  # Activate platform using profile1"                                             << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " --url wss://192.168.86.100/activate --cmd \"-t activate --profile profile1\""              << std::endl;
+       " --url wss://localhost:8080 --cmd \"-t activate --profile profile1\""                       << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Activate platform using profile1 and override DNS detection" << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " --url wss://mycloud.com/activate --cmd \"-t activate --profile profile1\" --dns corp.com"  << std::endl;
+       " --url wss://localhost:8080 --cmd \"-t activate --profile profile1\" --dns corp.com"        << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Deactivate platform and connect through a proxy"                              << std::endl;
     std::cout << "  " << PROJECT_NAME << \
-       " -u wss://mycloud.com/activate -c \"-t deactivate --password P@ssw0rd\" -p http://proxy.com:1000" << std::endl;
+       " -u wss://localhost:8080 -c \"-t deactivate --password P@ssw0rd\" -p http://proxy.com:1000" << std::endl;
     std::cout                                                                                       << std::endl;
     std::cout << "  # Show all informational items"                                                 << std::endl;
     std::cout << "  " << PROJECT_NAME << " --amtinfo all"                                           << std::endl;