From 7e9945a6dff3ed1fbc38c5532840c7b7035fd344 Mon Sep 17 00:00:00 2001
From: Nir Rubin <63152795+impervius@users.noreply.github.com>
Date: Thu, 10 Jul 2025 23:59:27 +0300
Subject: [PATCH 1/5] Move to ubuntu 25.04 and don't compile 7zip as upstream
 package is already 24.09

---
 Dockerfile | 113 +++++++++++++++++++++++++----------------------------
 1 file changed, 53 insertions(+), 60 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 20117c126..c7ddbd767 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,10 @@
 ## Scratch build stage
-FROM ubuntu:24.04 AS build
+FROM ubuntu:25.04 AS build
 
 ARG BUILD_DIR="/tmp"
 ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk}"
 ARG SASQUATCH_FILENAME="sasquatch_1.0_amd64.deb"
 ARG SASQUATCH_FILE_URL="https://github.com/onekey-sec/sasquatch/releases/download/sasquatch-v4.5.1-4/${SASQUATCH_FILENAME}"
-ARG ZIP_FILENAME="7z2409-linux-x64.tar.xz"
-ARG ZIP_FILE_URL="https://www.7-zip.org/a/${ZIP_FILENAME}"
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Etc/UTC
@@ -19,26 +17,24 @@ WORKDIR ${BINWALK_BUILD_DIR}
 # this stage won't make it into the final image unless it's explicitly copied
 RUN apt-get update -y \
     && apt-get -y --no-install-recommends install \
-        ca-certificates \
-        tzdata \
-        curl \
-        git \
-        wget \
-        build-essential \
-        clang \
-        zlib1g \
-        zlib1g-dev \
-        liblz4-1 \
-        libsrecord-dev \
-        liblzma-dev \
-        liblzo2-dev \
-        libucl-dev \
-        liblz4-dev \
-        libbz2-dev \
-        libssl-dev \
-        pkg-config \
-    && curl -L -o "${ZIP_FILENAME}" "${ZIP_FILE_URL}" \
-    && tar -xf "${ZIP_FILENAME}" 7zzs \
+    ca-certificates \
+    tzdata \
+    curl \
+    git \
+    wget \
+    build-essential \
+    clang \
+    zlib1g \
+    zlib1g-dev \
+    liblz4-1 \
+    libsrecord-dev \
+    liblzma-dev \
+    liblzo2-dev \
+    libucl-dev \
+    liblz4-dev \
+    libbz2-dev \
+    libssl-dev \
+    pkg-config \
     && curl -L -o "${SASQUATCH_FILENAME}" "${SASQUATCH_FILE_URL}" \
     && git clone https://github.com/askac/dumpifs.git ${BUILD_DIR}/dumpifs \
     && git clone https://github.com/lzfse/lzfse.git ${BUILD_DIR}/lzfse \
@@ -53,14 +49,12 @@ RUN apt-get update -y \
 
 
 ## Prod image build stage
-FROM ubuntu:24.04
+FROM ubuntu:25.04
 
 ARG BUILD_DIR="/tmp"
 ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk}"
 ARG DEFAULT_WORKING_DIR="/analysis"
 ARG SASQUATCH_FILENAME="sasquatch_1.0_amd64.deb"
-ARG ZIP_FILENAME="7z2409-linux-x64.tar.xz"
-ARG ZIP_FILE_URL="https://www.7-zip.org/a/${ZIP_FILENAME}"
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PIP_OPTIONS='--break-system-packages'
@@ -69,7 +63,6 @@ ENV TZ=Etc/UTC
 WORKDIR ${BUILD_DIR}
 
 # Copy the build artifacts from the scratch build stage
-COPY --from=build ${BINWALK_BUILD_DIR}/7zzs /usr/local/bin/7zzs
 COPY --from=build ${BINWALK_BUILD_DIR}/${SASQUATCH_FILENAME} ${BUILD_DIR}/${SASQUATCH_FILENAME}
 COPY --from=build /usr/local/bin/lzfse ${BUILD_DIR}/dumpifs/dumpifs ${BUILD_DIR}/dmg2img/dmg2img ${BUILD_DIR}/dmg2img/vfdecrypt ${BINWALK_BUILD_DIR}/target/release/binwalk /usr/local/bin/
 
@@ -82,39 +75,39 @@ COPY --from=build /usr/local/bin/lzfse ${BUILD_DIR}/dumpifs/dumpifs ${BUILD_DIR}
 RUN apt-get update -y \
     && apt-get upgrade -y \
     && apt-get -y install --no-install-recommends \
-        ca-certificates \
-        tzdata \
-        7zip \
-        zstd \
-        srecord \
-        tar \
-        unzip \
-        sleuthkit \
-        cabextract \
-        curl \
-        wget \
-        git \
-        lz4 \
-        lzop \
-        unrar \
-        unyaffs \
-        python3-pip \
-        zlib1g \
-        zlib1g-dev \
-        liblz4-1 \
-        libsrecord-dev \
-        liblzma-dev \
-        liblzo2-dev \
-        libucl-dev \
-        liblz4-dev \
-        libbz2-dev \
-        libssl-dev \
-        libfontconfig1-dev \
-        libpython3-dev \
-        7zip-standalone \
-        cpio \
-        device-tree-compiler \
-        clang \
+    ca-certificates \
+    tzdata \
+    7zip \
+    zstd \
+    srecord \
+    tar \
+    unzip \
+    sleuthkit \
+    cabextract \
+    curl \
+    wget \
+    git \
+    lz4 \
+    lzop \
+    unrar \
+    unyaffs \
+    python3-pip \
+    zlib1g \
+    zlib1g-dev \
+    liblz4-1 \
+    libsrecord-dev \
+    liblzma-dev \
+    liblzo2-dev \
+    libucl-dev \
+    liblz4-dev \
+    libbz2-dev \
+    libssl-dev \
+    libfontconfig1-dev \
+    libpython3-dev \
+    7zip-standalone \
+    cpio \
+    device-tree-compiler \
+    clang \
     && dpkg -i ${BUILD_DIR}/${SASQUATCH_FILENAME} \
     && rm ${BUILD_DIR}/${SASQUATCH_FILENAME} \
     && mkdir -p $HOME/.config/pip \

From 827162efafa7b2c16507e1718d2de376c2c7790b Mon Sep 17 00:00:00 2001
From: Nir Rubin <63152795+impervius@users.noreply.github.com>
Date: Fri, 11 Jul 2025 00:00:55 +0300
Subject: [PATCH 2/5] Upgrade sasquatch package

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index c7ddbd767..8df244e98 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ FROM ubuntu:25.04 AS build
 ARG BUILD_DIR="/tmp"
 ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk}"
 ARG SASQUATCH_FILENAME="sasquatch_1.0_amd64.deb"
-ARG SASQUATCH_FILE_URL="https://github.com/onekey-sec/sasquatch/releases/download/sasquatch-v4.5.1-4/${SASQUATCH_FILENAME}"
+ARG SASQUATCH_FILE_URL="https://github.com/onekey-sec/sasquatch/releases/download/sasquatch-v4.5.1-5/${SASQUATCH_FILENAME}"
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Etc/UTC

From 378ec3aa978f94d85d8f337ea8e4027151194122 Mon Sep 17 00:00:00 2001
From: Nir Rubin <63152795+impervius@users.noreply.github.com>
Date: Fri, 11 Jul 2025 00:01:52 +0300
Subject: [PATCH 3/5] Remvoe extra }

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 8df244e98..1fd534319 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 FROM ubuntu:25.04 AS build
 
 ARG BUILD_DIR="/tmp"
-ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk}"
+ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk"
 ARG SASQUATCH_FILENAME="sasquatch_1.0_amd64.deb"
 ARG SASQUATCH_FILE_URL="https://github.com/onekey-sec/sasquatch/releases/download/sasquatch-v4.5.1-5/${SASQUATCH_FILENAME}"
 
@@ -52,7 +52,7 @@ RUN apt-get update -y \
 FROM ubuntu:25.04
 
 ARG BUILD_DIR="/tmp"
-ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk}"
+ARG BINWALK_BUILD_DIR="${BUILD_DIR}/binwalk"
 ARG DEFAULT_WORKING_DIR="/analysis"
 ARG SASQUATCH_FILENAME="sasquatch_1.0_amd64.deb"
 

From dd6b565ace7b5819e4d78bce144f0d331281cea6 Mon Sep 17 00:00:00 2001
From: Nir Rubin <63152795+impervius@users.noreply.github.com>
Date: Fri, 11 Jul 2025 00:39:19 +0300
Subject: [PATCH 4/5] Move from pip to uv, and compile on up to date
 environment

---
 Dockerfile | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 1fd534319..b029cbc42 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,6 +16,7 @@ WORKDIR ${BINWALK_BUILD_DIR}
 # Cleaning up our mess here doesn't matter, as anything generated in
 # this stage won't make it into the final image unless it's explicitly copied
 RUN apt-get update -y \
+    && apt-get upgrade -y \
     && apt-get -y --no-install-recommends install \
     ca-certificates \
     tzdata \
@@ -57,9 +58,11 @@ ARG DEFAULT_WORKING_DIR="/analysis"
 ARG SASQUATCH_FILENAME="sasquatch_1.0_amd64.deb"
 
 ENV DEBIAN_FRONTEND=noninteractive
-ENV PIP_OPTIONS='--break-system-packages'
 ENV TZ=Etc/UTC
 
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+ENV UV_SYSTEM_PYTHON=1 UV_BREAK_SYSTEM_PACKAGES=1
+
 WORKDIR ${BUILD_DIR}
 
 # Copy the build artifacts from the scratch build stage
@@ -77,6 +80,7 @@ RUN apt-get update -y \
     && apt-get -y install --no-install-recommends \
     ca-certificates \
     tzdata \
+    python3 \
     7zip \
     zstd \
     srecord \
@@ -91,7 +95,6 @@ RUN apt-get update -y \
     lzop \
     unrar \
     unyaffs \
-    python3-pip \
     zlib1g \
     zlib1g-dev \
     liblz4-1 \
@@ -110,16 +113,11 @@ RUN apt-get update -y \
     clang \
     && dpkg -i ${BUILD_DIR}/${SASQUATCH_FILENAME} \
     && rm ${BUILD_DIR}/${SASQUATCH_FILENAME} \
-    && mkdir -p $HOME/.config/pip \
-    && printf "[global]\nbreak-system-packages = true" > $HOME/.config/pip/pip.conf \
-    && pip3 install uefi_firmware $PIP_OPTIONS \
-    && pip3 install jefferson $PIP_OPTIONS \
-    && pip3 install ubi-reader $PIP_OPTIONS \
-    && CC=clang pip3 install --upgrade lz4 zstandard git+https://github.com/clubby789/python-lzo@b4e39df $PIP_OPTIONS \
-    && CC=clang pip3 install --upgrade git+https://github.com/marin-m/vmlinux-to-elf $PIP_OPTIONS \
+    && CC=clang uv pip install uefi_firmware jefferson jefferson ubi-reader git+https://github.com/marin-m/vmlinux-to-elf \
+    && uv cache clean \
     && apt-get purge clang -y \
     && apt autoremove -y \
-    && rm -rf /var/cache/apt/archives /var/lib/apt/lists/* \
+    && rm -rf /var/cache/apt/archives /var/lib/apt/lists/* /bin/uv /bin/uvx \
     && mkdir -p ${DEFAULT_WORKING_DIR} \
     && chmod 777 ${DEFAULT_WORKING_DIR}
 

From 09ad9d8403b4fe428fa28705a0921d521dc6e823 Mon Sep 17 00:00:00 2001
From: Nir Rubin <63152795+impervius@users.noreply.github.com>
Date: Fri, 11 Jul 2025 09:38:00 +0300
Subject: [PATCH 5/5] Remove duplicate jefferson

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index b029cbc42..64175d18d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -113,7 +113,7 @@ RUN apt-get update -y \
     clang \
     && dpkg -i ${BUILD_DIR}/${SASQUATCH_FILENAME} \
     && rm ${BUILD_DIR}/${SASQUATCH_FILENAME} \
-    && CC=clang uv pip install uefi_firmware jefferson jefferson ubi-reader git+https://github.com/marin-m/vmlinux-to-elf \
+    && CC=clang uv pip install uefi_firmware jefferson ubi-reader git+https://github.com/marin-m/vmlinux-to-elf \
     && uv cache clean \
     && apt-get purge clang -y \
     && apt autoremove -y \