René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"3.11.4-slim adds dev packages","articleBody":"I run trivy for vulnerability scan on the python image. After upgrade from python:3.11.3-slim to python:3.11.4-slim, it started to report on vulnerabilities in Linux kernel due to linux-libc-dev.\r\n\r\nIt seems to contain upgrade from bullseye to bookworm. The base debian:bookworm-slim does not add the dev packages, but they seem to be added during Python build.\r\n\r\nThe added packages are these:\r\n\r\nlibc-dev-bin\r\nlibc6-dev\r\nlibcrypt-dev\r\nlibnsl-dev\r\nlibtirpc-dev\r\nlinux-libc-dev\r\nrpcsvc-proto\r\n\r\nThese total about 20 MB of unnecessary packages.\r\n\r\nI traced the problem into libc6-dev containing file paths that embed the searched library path\r\n\r\n```\r\n$ docker run --rm python:3.11.4-slim dpkg-query --search lib/x86_64-linux-gnu/libc.so.6\r\nlibc6-dev:amd64: /usr/share/gdb/auto-load/lib/x86_64-linux-gnu/libc.so.6-gdb.py\r\nlibc6:amd64: /lib/x86_64-linux-gnu/libc.so.6\r\n```\r\n\r\nTherefore it thinks libc6-dev is needed and marks it manually installed to be saved on the image.","author":{"url":"https://github.com/kohtala","@type":"Person","name":"kohtala"},"datePublished":"2023-08-02T05:47:42.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":5},"url":"https://github.com/857/python/issues/857"}