Jupyterhubイメージ最新化,OpenSSL脆弱性対応等

.github/workflows/test.yml

@@ -43,7 +43,7 @@ jobs:
   # jobs or have "template" jobs, so we use `if` conditions on steps
   tests:
     runs-on: ubuntu-22.04
-    timeout-minutes: 10
+    timeout-minutes: 20
 
     permissions:
       contents: read

binderhub/repoproviders.py

@@ -357,16 +357,16 @@ class FigshareProvider(RepoProvider):
         "ref": {"enabled": False},
     }
 
-    url_regex = re.compile(r"(.*)/articles/([^/]+)/([^/]+)/(\d+)(/)?(\d+)?")
+    url_regex = re.compile(r"(.*)/articles/([^/]+)/(\d+)(/)?(\d+)?")
 
     async def get_resolved_ref(self):
         client = AsyncHTTPClient()
         req = HTTPRequest(f"https://doi.org/{self.spec}", user_agent="BinderHub")
         r = await client.fetch(req)
 
         match = self.url_regex.match(r.effective_url)
-        article_id = match.groups()[3]
-        article_version = match.groups()[5]
+        article_id = match.groups()[2]
+        article_version = match.groups()[4]
         if not article_version:
             article_version = "1"
         self.record_id = f"{article_id}.v{article_version}"

binderhub/static/js/components/LinkGenerator.jsx

@@ -342,6 +342,10 @@ export function LinkGenerator({
           </div>
         </div>
       </div>
+      <div style={{ textAlign: "right" }}>
+          →<a href="https://jdcat.jsps.go.jp/analysis-In-case-of-error.html" target="_blank" rel="noopener noreferrer">問い合わせ先/エラーが発生したときは</a><br/>
+          →<a href="https://jdcat.jsps.go.jp/analysis-In-case-of-error.html" target="_blank" rel="noopener noreferrer">Contact Information/Troubleshooting</a>
+      </div>
     </form>
   );
 }

ci/refreeze

@@ -10,5 +10,5 @@ docker run --rm \
     --volume="$PWD:/io" \
     --workdir=/io \
     --user=root \
-    python:3.11-bullseye \
+    python:3.13-bookworm \
     sh -c 'pip install pip-tools==7.* && pip-compile --allow-unsafe --strip-extras --upgrade helm-chart/images/binderhub/requirements.in'

helm-chart/binderhub/Chart.yaml

@@ -1,7 +1,7 @@
 # Chart.yaml v2 reference: https://helm.sh/docs/topics/charts/#the-chartyaml-file
 apiVersion: v2
 name: binderhub
-version: 0.2.0-jhub-1.1.3.git.2398.h2365dd6
+version: 0.2.5-20251121.3
 dependencies:
   # Source code:    https://github.com/jupyterhub/zero-to-jupyterhub-k8s
   # Latest version: https://github.com/jupyterhub/zero-to-jupyterhub-k8s/tags
@@ -12,7 +12,7 @@ dependencies:
   #            and run "./dependencies freeze --upgrade".
   #
   - name: jupyterhub
-    version: "4.1.0-0.dev.git.6950.h5e4c7698"
+    version: "4.1.0-20251118.2"
     repository: "https://rcosdp.github.io/CS-jhub-helm-chart/"
 description: |-
   BinderHub is like a JupyterHub that automatically builds environments for the

helm-chart/images/binderhub/Dockerfile

@@ -8,7 +8,7 @@
 #
 # NOTE: If the image version is updated, also update it in ci/refreeze!
 #
-FROM python:3.11-bullseye as build-stage
+FROM python:3.13-bookworm as build-stage
 
 # Workaround: CS-jupyterhub requires nodejs and npm to be installed.
 RUN apt-get update \
@@ -50,7 +50,7 @@ RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
 # ---------------
 # This stage is built and published as quay.io/jupyterhub/k8s-binderhub.
 #
-FROM python:3.11-slim-bullseye
+FROM python:3.13-slim-bookworm
 
 ENV PYTHONUNBUFFERED=1
 ENV DEBIAN_FRONTEND=noninteractive
@@ -68,6 +68,22 @@ RUN apt-get update \
               # or "kubectl delete pod" is run. By doing that the pod can
               # terminate very quickly.
         curl gpg \
+        # OpenSSL コンパイル用
+        build-essential \
+        wget \
+        zlib1g-dev \
+        ca-certificates \
+ && wget -O /tmp/ssl-source.tar.gz https://www.openssl.org/source/openssl-3.0.18.tar.gz \
+ && tar -xzf /tmp/ssl-source.tar.gz -C /tmp \
+ && (cd /tmp/openssl-3.0.18 && ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib shared zlib-dynamic) \
+ && (cd /tmp/openssl-3.0.18 && make -j$(nproc)) \
+ && (cd /tmp/openssl-3.0.18 && make install_sw) \
+ && echo "/usr/local/lib" > /etc/ld.so.conf.d/openssl-3.0.18.conf \      
+ && ldconfig \
+ && rm -f /tmp/ssl-source.tar.gz \
+ && rm -rf /tmp/openssl-3.0.18 \
+ && apt-get remove -y build-essential wget zlib1g-dev \
+ && apt-get autoremove -y \
  && rm -rf /var/lib/apt/lists/*
 
 # Workaround: CS-jupyterhub requires nodejs and npm to be installed.

helm-chart/images/binderhub/requirements.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.11
+# This file is autogenerated by pip-compile with Python 3.13
 # by the following command:
 #
 #    Use the "Run workflow" button at https://github.com/jupyterhub/binderhub/actions/workflows/watch-dependencies.yaml
@@ -14,6 +14,8 @@ anyio==4.11.0
     # via httpx
 arrow==1.4.0
     # via isoduration
+async-generator==1.10
+    # via jupyterhub
 attrs==25.4.0
     # via
     #   jsonschema
@@ -38,6 +40,8 @@ charset-normalizer==3.4.4
     # via requests
 cryptography==46.0.3
     # via certipy
+deprecated==1.2.18
+    # via opentelemetry-api
 docker==7.1.0
     # via
     #   -r helm-chart/images/binderhub/../../../requirements.txt
@@ -305,6 +309,8 @@ webcolors==25.10.0
     # via jsonschema
 websocket-client==1.9.0
     # via kubernetes
+wrapt==1.17.2
+    # via deprecated
 zipp==3.23.0
     # via importlib-metadata
 

testing/k8s-binder-k8s-hub/binderhub-chart-config-old.yaml

@@ -1,8 +1,5 @@
 # This config is used when both BinderHub and the JupyterHub it uses are
 # deployed to a kubernetes cluster.
-cors:
-  allowOrigin: '*'
-
 service:
   type: NodePort
   nodePort: 30901
@@ -15,6 +12,7 @@ config:
     hub_url_local: http://proxy-public
     use_registry: false
     log_level: 10
+    cors_allow_origin: "*"
 
 # NOTE: This is a mirror of the jupyterhub section in
 #       jupyterhub-chart-config.yaml in testing/local-binder-k8s-hub, keep these
@@ -23,10 +21,6 @@ jupyterhub:
   debug:
     enabled: true
 
-  custom:
-    cors:
-      allowOrigin: "*"
-
   hub:
     # cookieSecret must be a hex encoded even length string
     cookieSecret: "cccccccccc"
@@ -35,6 +29,9 @@ jupyterhub:
     services:
       binder:
         apiToken: "dummy-binder-secret-token"
+    config:
+      BinderSpawner:
+        cors_allow_origin: "*" 
 
   proxy:
     secretToken: "dummy-proxy-secret-token"