chore: fix security vulns

fhevm-engine/fhevm-db/Dockerfile

@@ -1,19 +1,24 @@
 # Use the Rust image as the base
-FROM rust:1.74
+FROM rust:1.83.0-slim
 
 # Install dependencies and tools
 RUN apt-get update && \
     apt-get install -y --no-install-recommends libpq-dev postgresql-client xxd && \
-    cargo install sqlx-cli --no-default-features --features postgres --locked && \
+    cargo install sqlx-cli --version 0.7.2 --no-default-features --features postgres --locked && \
+    groupadd -r zama && useradd -r -g zama zama && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Copy migrations and initialization script
 COPY fhevm-engine/fhevm-db/initialize_db.sh /initialize_db.sh
 COPY fhevm-engine/fhevm-db/migrations /migrations
-COPY fhevm-engine/fhevm-keys /fhevm-keys
 
-# Make the script executable
-RUN chmod +x /initialize_db.sh
+# Change ownership of the copied files to the non-root user
+RUN mkdir /fhevm-keys && \
+    chown -R zama:zama /initialize_db.sh /migrations /fhevm-keys && \
+    chmod +x /initialize_db.sh
+
+# Switch to the non-root user
+USER zama
 
 # Run the initialization script as the entrypoint
 ENTRYPOINT ["/bin/bash", "/initialize_db.sh"]

fhevm-engine/fhevm-db/initialize_db.sh

@@ -1,31 +1,44 @@
 #!/bin/bash
+set -e  # Exit on error
 
 # 1: Create Database
 echo "Creating database..."
-sqlx database create
+sqlx database create || { echo "Failed to create database."; exit 1; }
 
 # 2: Run sqlx migrations
 echo "Running migrations..."
 sqlx migrate run --source /migrations || { echo "Failed to run migrations."; exit 1; }
 
 # 3. Insert test tenant with keys
 echo "Start preparing tenant query..."
-TENANT_API_KEY=a1503fb6-d79b-4e9e-826d-44cf262f3e05
-CHAIN_ID=12345
-ACL_CONTRACT_ADDRESS=0x339EcE85B9E11a3A3AA557582784a15d7F82AAf2
-INPUT_VERIFIER_ADDRESS=0x69dE3158643e738a0724418b21a35FAA20CBb1c5
-PKS_FILE="/fhevm-keys/pks"
-SKS_FILE="/fhevm-keys/sks"
-PUBLIC_PARAMS_FILE="/fhevm-keys/pp"
+
+# Settings
+CHAIN_ID=${CHAIN_ID:-"12345"}
+PKS_FILE=${PKS_FILE:-"/fhevm-keys/pks"}
+SKS_FILE=${SKS_FILE:-"/fhevm-keys/sks"}
+PUBLIC_PARAMS_FILE=${PUBLIC_PARAMS_FILE:-"/fhevm-keys/pp"}
+
+# Verify key files
+for file in "$PKS_FILE" "$SKS_FILE" "$PUBLIC_PARAMS_FILE"; do
+    if [[ ! -f $file ]]; then
+        echo "Error: Key file $file not found."; exit 1;
+    fi
+done
+
+# Ensure environment variables are set
+if [[ -z "$DATABASE_URL" || -z "$TENANT_API_KEY" || -z "$ACL_CONTRACT_ADDRESS" || -z "$INPUT_VERIFIER_ADDRESS" ]]; then
+    echo "Error: One or more required environment variables are missing."; exit 1;
+fi
 
 TMP_CSV="/tmp/tenant_data.csv"
 echo "tenant_api_key,chain_id,acl_contract_address,verifying_contract_address,pks_key,sks_key,public_params" > $TMP_CSV
 
-echo "$TENANT_API_KEY,$CHAIN_ID,$ACL_CONTRACT_ADDRESS,$INPUT_VERIFIER_ADDRESS,\"\\x$(cat $PKS_FILE | xxd -p | tr -d '\n')\",\"\\x$(cat $SKS_FILE | xxd -p | tr -d '\n')\",\"\\x$(cat $PUBLIC_PARAMS_FILE | xxd -p | tr -d '\n')\"" >> $TMP_CSV
+echo "$TENANT_API_KEY,$CHAIN_ID,$ACL_CONTRACT_ADDRESS,$INPUT_VERIFIER_ADDRESS,\"\\x$(< "$PKS_FILE" xxd -p | tr -d '\n')\",\"\\x$(< "$SKS_FILE" xxd -p | tr -d '\n')\",\"\\x$(< "$PUBLIC_PARAMS_FILE" xxd -p | tr -d '\n')\"" >> $TMP_CSV
 
 echo "Inserting tenant data using \COPY..."
-psql $DATABASE_URL -c "\COPY tenants (tenant_api_key, chain_id, acl_contract_address, verifying_contract_address, pks_key, sks_key, public_params) FROM '$TMP_CSV' CSV HEADER;"
+psql "$DATABASE_URL" -c "\COPY tenants (tenant_api_key, chain_id, acl_contract_address, verifying_contract_address, pks_key, sks_key, public_params) FROM '$TMP_CSV' CSV HEADER;" || {
+    echo "Error: Failed to insert tenant data."; exit 1;
+}
 
 rm -f $TMP_CSV
-
-echo "Database initialization complete."
+echo "Database initialization complete."