crux: add 3.5 amd64 version, update maintainers

[mcharytoniuk]

arm version is in progress
maintainers updated according to this comment: #5073 (comment)

[yosifkit]

Diff: https://gist.github.com/docker-library-bot/a3a8f1187605c067e58f141598b67e03

[yosifkit]

Build test of #7130; 2331385; amd64 (crux):

$ bashbrew build crux:3.5
Building bashbrew/cache:741cec4bc5eaa39e8d0e1903691e6cc53779c36a0479ade3e6a56c2465c7edab (crux:3.5)
Tagging crux:3.5
Tagging crux:latest

$ test/run.sh crux:3.5
testing crux:3.5
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...warning: garbage password detected for 'bin': 'x'
error: empty password detected for 'root'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'mail': 'x'
warning: garbage password detected for 'ftp': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'www': 'x'
failed
	'override-cmd' [4/4]...passed


$ bashbrew build crux:3.4
Using bashbrew/cache:b1c8ca8be778284ca194f9d9d1947eec97a30e0ba635ed59dfaf678b6f91f954 (crux:3.4)
Tagging crux:3.4

$ test/run.sh crux:3.4
testing crux:3.4
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...warning: garbage password detected for 'bin': 'x'
error: empty password detected for 'root'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'mail': 'x'
warning: garbage password detected for 'ftp': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'www': 'x'
failed
	'override-cmd' [4/4]...passed


$ bashbrew build crux:3.2
Using bashbrew/cache:384b91fbeb15c40ee2ddcd6bad5d1dd6c539baff203e55bb036a04447fa62a6c (crux:3.2)
Tagging crux:3.2

$ test/run.sh crux:3.2
testing crux:3.2
	'utc' [1/4]...passed
	'cve-2014--shellshock' [2/4]...passed
	'no-hard-coded-passwords' [3/4]...warning: garbage password detected for 'bin': 'x'
error: empty password detected for 'root'
warning: garbage password detected for 'messagebus': 'x'
warning: garbage password detected for 'mail': 'x'
warning: garbage password detected for 'ftp': 'x'
warning: garbage password detected for 'daemon': 'x'
warning: garbage password detected for 'nobody': 'x'
warning: garbage password detected for 'www': 'x'
failed
	'override-cmd' [4/4]...passed

The following images failed at least one test:

• crux:
  • crux:3.5
  • crux:3.4
  • crux:3.2

I would highly recommend that 3.5 should be updated to have a non-empty root password. The test failure comes from #5880 to prevent CVE-2019-5021 on other images (see also alpinelinux/docker-alpine#13). Will 3.2 & 3.4 be updated or are they really no longer supported? In other words, they are snapshot builds of past releases?

[mcharytoniuk]

@yosifkit Thank you. I'll see into the password issue. Version prior to 3.5 are snapshots of past releases.

[tianon]

So for the older releases, I'd recommend just dropping them from the library/crux file. Removing tags here will remove them from the "Supported" section on the Hub readme (and will prevent us from spending cycles rebuilding them on the official build servers), but the tags will still be available to users who want them. (See https://github.com/docker-library/official-images#library-definition-files for more detail on this.)

[github-actions]

Diff for 2331385:

TODO diff too large for GitHub comment!
See: http://github.com/docker-library/official-images/actions/runs/96647399

[tianon]

Friendly ping?

[mcharytoniuk]

@tianon sorry, I got stuck with that. I think it would require some substantial alterations in the build process or maybe some small changes in crux itself just to pass this check. I'll keep it on hold for now.

[tianon]

Ok, fair enough; do you think we should add a proper deprecation notice to the image description for now, so we communicate clearly to users that this image isn't currently actively maintained? (For context, it's been over 500 days since the last library/crux image update. 😱)

[tianon]

I've opened docker-library/docs#1751 to add a simple deprecation notice so users know what's going on with this image -- I'm going to close this PR in the meantime, but let's please revisit as soon as you've got cycles to update the image! ❤️