add virus scanning via clamscan

Dockerfile

@@ -3,7 +3,7 @@
 # !! This is a builder image. Not for general use !!
 # Use this as the base image for the Rails / Sidekiq services.
 ##
-FROM ruby:2.7.8-slim-bullseye as spot-base
+FROM ruby:2.7.8-slim-bullseye AS spot-base
 
 RUN apt-get clean && \
     apt-get update && \
@@ -14,6 +14,7 @@ RUN apt-get clean && \
     apt-get update -y && apt-get install -y --no-install-recommends \
         awscli \
         build-essential \
+        clamav \
         coreutils \
         git \
         libpq-dev \
@@ -59,7 +60,7 @@ HEALTHCHECK CMD curl -skf https://localhost/healthcheck/default || exit 1
 #  Target: spot-asset-builder
 #  !! This is a builder image, do not use !!
 ##
-FROM spot-base as spot-asset-builder
+FROM spot-base AS spot-asset-builder
 ENV RAILS_ENV=production
 COPY . /spot
 
@@ -69,7 +70,7 @@ RUN SECRET_KEY_BASE="$(bin/rake secret)" FEDORA_URL="http://fakehost:8080/rest"
 # TARGET: pdfjs-installer
 # !! This is a builder image. Not for general use !!
 ##
-FROM alpine:3 as pdfjs-installer
+FROM alpine:3 AS pdfjs-installer
 ARG PDFJS_VERSION="4.0.379"
 ENV PDFJS_VERSION="${PDFJS_VERSION}"
 ADD https://github.com/mozilla/pdf.js/releases/download/v${PDFJS_VERSION}/pdfjs-${PDFJS_VERSION}-legacy-dist.zip /tmp/pdfjs.zip
@@ -83,7 +84,7 @@ COPY config/pdfjs/web/lafayette-viewer-enhancements.js /tmp/pdfjs/web
 # Used for the development version of the user-facing application.
 # Installs Ruby development dependencies
 ##
-FROM spot-base as spot-web-development
+FROM spot-base AS spot-web-development
 RUN bundle config unset with &&\
     bundle config unset without && \
     bundle config set with "development:test" && \
@@ -101,7 +102,7 @@ CMD ["bundle", "exec", "rails", "server", "-b", "ssl://0.0.0.0:443?key=/spot/tmp
 # TARGET: spot-web-production
 # Precompiles assets for production
 ##
-FROM spot-base as spot-web-production
+FROM spot-base AS spot-web-production
 ENV RAILS_ENV=production
 COPY . /spot
 COPY --from=spot-asset-builder /spot/public/assets /spot/public/assets
@@ -116,7 +117,7 @@ COPY --from=pdfjs-installer /tmp/pdfjs /spot/public/pdf
 # @see https://github.com/harvard-lts/fits
 # @see https://github.com/samvera/hyrax/blob/3.x-stable/Dockerfile#L59-L65
 ##
-FROM alpine:3 as fits-installer
+FROM alpine:3 AS fits-installer
 ARG FITS_VERSION="1.6.0"
 ENV FITS_VERSION="${FITS_VERSION}"
 ADD https://github.com/harvard-lts/fits/releases/download/${FITS_VERSION}/fits-${FITS_VERSION}.zip /tmp/fits.zip
@@ -129,7 +130,7 @@ RUN unzip -d /tmp/fits /tmp/fits.zip && \
 # TARGET: spot-worker
 # Installs dependencies for running background jobs
 ##
-FROM spot-base as spot-worker-base
+FROM spot-base AS spot-worker-base
 # @see https://github.com/mperham/sidekiq/wiki/Memory#bloat
 ENV MALLOC_ARENA_MAX=2
 # We don't need the entrypoint script to generate an SSL cert
@@ -159,7 +160,7 @@ ENV PATH="${PATH}:/usr/local/fits"
 CMD ["bundle", "exec", "sidekiq"]
 EXPOSE 3000
 
-FROM spot-worker-base as spot-worker-development
+FROM spot-worker-base AS spot-worker-development
 ENV RAILS_ENV=development
 
 RUN bundle config unset with &&\
@@ -173,7 +174,7 @@ COPY . /spot/
 # Target: spot-worker-production
 # Copies compiled assets for use in production.
 ##
-FROM spot-worker-base as spot-worker-production
+FROM spot-worker-base AS spot-worker-production
 ENV RAILS_ENV=production
 
 COPY . /spot/

Gemfile

@@ -55,6 +55,8 @@ gem 'bootsnap', '~> 1.17', require: false
 gem 'browse-everything', '~> 1.1.2'
 gem 'bulkrax', '~> 5.5.1'
 
+gem 'clamby', '1.6.8'
+
 # This needs to be here if we want to compile our own JS
 # (there's like a single coffee-script file still remaining in hyrax)
 gem 'coffee-rails', '~> 5.0.0'

Gemfile.lock

@@ -209,6 +209,7 @@ GEM
       activesupport (>= 4.0.0)
       mime-types (>= 1.16)
       ssrf_filter (~> 1.0, < 1.1.0)
+    clamby (1.6.8)
     clipboard-rails (1.7.1)
     coderay (1.1.3)
     coffee-rails (5.0.0)
@@ -1112,6 +1113,7 @@ DEPENDENCIES
   byebug (~> 11.1.3)
   capybara (~> 3.38)
   capybara-screenshot (~> 1.0.26)
+  clamby (= 1.6.8)
   coffee-rails (~> 5.0.0)
   database_cleaner (~> 2.0.1)
   devise (~> 4.9.0)

app/models/spot/virus_scanner.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+require 'clamby'
+
+module Spot
+  # The ClamAV gem, which Hyrax uses for virus scanning, has been dormant
+  # for ~13 years, so we're choosing to use the Clamby gem.
+  #
+  # @see https://github.com/samvera/hyrax/blob/hyrax-v3.6.0/app/models/hyrax/virus_scanner.rb
+  class VirusScanner < ::Hyrax::VirusScanner
+    def infected?
+      Clamby.virus?(file)
+    end
+  end
+end

app/views/records/edit_fields/_subject.html.erb

@@ -5,14 +5,14 @@
           input_html: {
             class: 'form-control',
             data: {
-              'autocomplete-url' => '/authorities/search/linked_data/oclc_fast',
+              'autocomplete-url' => '/authorities/search/assign_fast/all',
               'autocomplete' => 'subject'
             }
           },
           ### Required for the ControlledVocabulary javascript:
           wrapper_html: {
             data: {
-              'autocomplete-url' => '/authorities/search/linked_data/oclc_fast',
+              'autocomplete-url' => '/authorities/search/assign_fast/all',
               'field-name' => 'subject'
             }
           },

config/authorities/remote_authorities.yml

@@ -1,7 +1,7 @@
 terms:
   - id: fast
     label: FAST
-    search: /authorities/search/linked_data/oclc_fast
+    search: /authorities/search/assign_fast/all
   - id: geonames
     label: GeoNames
     search: /authorities/search/geonames

config/environments/test.rb

@@ -39,5 +39,4 @@
   config.active_support.deprecation = :stderr
 
   config.active_job.queue_adapter = :test
-  config.exceptions_app = ->(env) { ErrorController.action(:show).call(env) }
 end

config/initializers/hyrax.rb

@@ -307,6 +307,7 @@
   ]
 
   config.branding_path = ENV.fetch('HYRAX_COLLECTION_BRANDING_PATH', Rails.root.join('public', 'branding'))
+  config.virus_scanner = Rails.env.test? ? nil : Spot::VirusScanner
 end
 
 Date::DATE_FORMATS[:standard] = "%m/%d/%Y"

config/initializers/spot_overrides.rb

@@ -231,4 +231,27 @@ def retrieve_cloud_files(files)
       nil
     end
   end
+
+  # Modifying how Questiong Authority returns AssignFAST results by
+  # converting fst ids into URLs
+  require 'qa/authorities/assign_fast'
+  Qa::Authorities::AssignFast::GenericAuthority.class_eval do
+    private
+
+    def parse_authority_response(raw_response)
+      raw_response['response']['docs'].map do |doc|
+        index = Qa::Authorities::AssignFast.index_for_authority(subauthority)
+        term = doc[index].first
+        term += " (USE #{doc['auth']})" if doc['type'] == 'alt'
+        fast_id = Array.wrap(doc['idroot']).first
+
+        {
+          fast_id: fast_id,
+          id: "http://id.worldcat.org/fast/#{fast_id.gsub(/^fst/, '')}",
+          label: term,
+          value: doc['auth']
+        }
+      end
+    end
+  end
 end

docker-compose.yml

@@ -1,4 +1,3 @@
-version: '3.9'
 services:
   app:
     image: lafayette/spot-web
@@ -78,6 +77,13 @@ services:
     depends_on:
       - db
 
+  fits-servlet:
+    build:
+      context: ./docker/fits_servlet
+    ports:
+      - 8000:8080
+    restart: unless-stopped
+
   minio:
     image: minio/minio:latest
     environment:
@@ -105,6 +111,8 @@ services:
       target: spot-worker-development
     env_file:
       - .env.local
+    environment:
+      - FITS_SERVLET_URL=http://fits-servlet:8080/fits
     ports:
       - "3003:3000"
     command: ["bundle", "exec", "sidekiq"]
@@ -115,6 +123,7 @@ services:
     depends_on:
       - db
       - fedora
+      - fits-servlet
       - redis
       - solr
 

docker/fits_servlet/Dockerfile

@@ -0,0 +1,79 @@
+##
+# Target: fits-installer
+# !! Not for general consumption !!
+##
+FROM alpine:3 AS fits-installer
+ARG FITS_VERSION="1.6.0"
+ENV FITS_VERSION="${FITS_VERSION}"
+WORKDIR /tmp
+
+ADD https://github.com/harvard-lts/fits/releases/download/${FITS_VERSION}/fits-${FITS_VERSION}.zip /tmp
+
+RUN unzip -d /tmp/fits /tmp/fits-${FITS_VERSION}.zip && \
+    chmod a+x /tmp/fits/fits.sh && \
+    rm /tmp/fits-${FITS_VERSION}.zip
+
+# Remove bundled version of mediainfo in favor of system
+# @see https://github.com/harvard-lts/fits?tab=readme-ov-file#system-requirements
+RUN rm -r /tmp/fits/tools/mediainfo
+
+
+##
+# Target: servlet-installer
+# !! Not for general consumption !!
+##
+FROM alpine:3 AS servlet-installer
+ARG FITS_SERVLET_VERSION="2.1.0"
+ENV FITS_SERVLET_VERSION="${FITS_SERVLET_VERSION}"
+ADD https://github.com/harvard-lts/FITSservlet/releases/download/${FITS_SERVLET_VERSION}/fits-service-${FITS_SERVLET_VERSION}.war /tmp/fits-service.war
+
+##
+# Default image
+##
+FROM docker.io/tomcat:9-jre17-temurin-jammy
+
+# see https://github.com/harvard-lts/FITSservlet/blob/2.1.0/docker/Dockerfile#L18-L42
+RUN apt-get update && \
+    apt-get install -yqq \
+    # jpylyzer dependencies
+    python3 \
+    python-is-python3 \
+    # exiftool dependencies https://github.com/exiftool/exiftool
+    libarchive-zip-perl \
+    libio-compress-perl \
+    libcompress-raw-zlib-perl \
+    libcompress-bzip2-perl \
+    libcompress-raw-bzip2-perl \
+    libio-digest-perl \
+    libdigest-md5-file-perl \
+    libdigest-perl-md5-perl \
+    libdigest-sha-perl \
+    libposix-strptime-perl \
+    libunicode-linebreak-perl\
+    # file dependencies
+    file \
+    make \
+    gcc \
+    # mediainfo dependencies
+    mediainfo \
+    libmms0 \
+    libcurl3-gnutls \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install FITS + servlet
+COPY --from=fits-installer /tmp/fits /opt/fits
+COPY --from=servlet-installer /tmp/fits-service.war $CATALINA_HOME/webapps/fits.war
+
+# Copy config, scripts, etc
+COPY assets/catalina.properties $CATALINA_HOME/conf/catalina.properties
+COPY assets/log4j2.xml $CATALINA_HOME/conf/log4j2.xml
+COPY scripts/fits-servlet-entrypoint.sh /opt/fits-servlet-entrypoint.sh
+
+# Bind the current working directory here so that FITS can access files on the host
+WORKDIR /work
+
+ENTRYPOINT ["/opt/fits-servlet-entrypoint.sh"]
+
+# need to explictly provide a CMD when adding a custom ENTRYPOINT
+# @see https://github.com/docker-library/tomcat/blob/master/9.0/jre21/temurin-jammy/Dockerfile#L47
+CMD ["catalina.sh", "run"]