Add note about hardened_malloc

Signed-off-by: Tommy <contact@tommytran.io>

.github/workflows/build.yml

@@ -27,18 +27,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@main
+        uses: sigstore/cosign-installer@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.repository_owner }}
@@ -46,7 +46,7 @@ jobs:
 
       - name: Set Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -54,7 +54,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v5
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
@@ -65,5 +65,24 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
         run: cosign sign ${TAGS} -y
         env:
-          COSIGN_EXPERIMENTAL: "true"
           TAGS: ${{ steps.meta.outputs.tags }}
+
+  scan:
+    name: Scan current image & report results
+    needs: build
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'ghcr.io/tommytran732/matrix.to'
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
+          output: 'trivy-results.sarif'
+          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
+          vuln-type: "os,library"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'

.github/workflows/scan.yml

@@ -0,0 +1,27 @@
+name: Scan
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Scan the image regularly (once a day)
+    - cron: '0 23 * * *'
+
+jobs:
+  scan:
+    name: Scan current image & report results
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'ghcr.io/tommytran732/matrix.to'
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
+          output: 'trivy-results.sarif'
+          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
+          vuln-type: "os,library"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'

Dockerfile

@@ -1,3 +1,25 @@
+ARG HARDENED_MALLOC_VERSION=2024052100
+
+### Build Hardened Malloc
+FROM alpine:latest as hmalloc-builder
+
+ARG HARDENED_MALLOC_VERSION
+ARG CONFIG_NATIVE=false
+ARG VARIANT=default
+
+RUN apk -U upgrade \
+    && apk --no-cache add build-base git gnupg openssh-keygen
+    
+RUN cd /tmp \
+    && git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
+    && cd hardened_malloc \
+    && wget -q https://grapheneos.org/allowed_signers -O grapheneos_allowed_signers \
+    && git config gpg.ssh.allowedSignersFile grapheneos_allowed_signers \
+    && git verify-tag $(git describe --tags) \
+    && make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}
+
+### Build Production
+
 FROM node:alpine
 
 LABEL maintainer="Thien Tran contact@tommytran.io"
@@ -6,8 +28,8 @@ ARG UID=992
 ARG GID=992
 
 RUN apk -U upgrade \
-  && apk --no-cache add git \
+    && apk --no-cache add git \
-  && adduser -g ${GID} -u ${UID} --disabled-password --gecos "" matrix-to
+    && adduser -g ${GID} -u ${UID} --disabled-password --gecos "" matrix-to
 
 USER matrix-to
 
@@ -20,9 +42,13 @@ COPY element.patch /home/matrix-to/matrix.to
 WORKDIR /home/matrix-to/matrix.to
 
 RUN git apply /home/matrix-to/matrix.to/element.patch \
-  && rm -rf .git \
+    && rm -rf .git \
-  && yarn \
+    && yarn \
-  && yarn build
+    && yarn build
+
+COPY --from=hmalloc-builder /tmp/hardened_malloc/out/libhardened_malloc.so /usr/local/lib/
+
+ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
 
 EXPOSE 5000
 

README.md

@@ -1,5 +1,7 @@
 # Matrix.to-Docker
 
+![Build, scan & push](https://github.com/tommytran732/Matrix.to-Docker/actions/workflows/build.yml/badge.svg)
+
 Matrix.to is a simple url redirection service for the Matrix.org ecosystem which lets users share links to matrix entities without being tied to a specific app. Stylistically it serves as a landing page for rooms and communities.
 
 This is my own Docker image building from [the official repository](https://github.com/matrix-org/matrix.to).
@@ -9,3 +11,4 @@ This is my own Docker image building from [the official repository](https://gith
 - Don't trust random images: build yourself if you can.
 - Default Element instance is changed from [Element.io](https://app.element.io) to [ArcticFoxes.net](https://element.arcticfoxes.net)
 - The Dockerfile builds from the main branch, as releases do not come out frequently.
+- The image comes with the [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) built from the latest tag.