Merge remote-tracking branch 'eclipse/main'

Author: RomanNikitenko

.github/workflows/image-publish.yml

@@ -198,5 +198,5 @@ jobs:
         run: |
           SHORT_SHA1=$(git rev-parse --short=7 HEAD)
           docker buildx build --platform linux/amd64 -f build/dockerfiles/dev.Dockerfile --push -t quay.io/che-incubator/che-code-dev:insiders -t quay.io/che-incubator/che-code-dev:next -t quay.io/che-incubator/che-code-dev:insiders-${SHORT_SHA1} .
-          docker buildx build --platform linux/amd64 -f build/dockerfiles/dev.sshd.Dockerfile --push -t quay.io/che-incubator/che-code-sshd:insiders -t quay.io/che-incubator/che-code-sshd:next -t quay.io/che-incubator/che-code-sshd:insiders-${SHORT_SHA1} .
+          docker buildx build --platform linux/amd64 -f build/dockerfiles/assembly.sshd.Dockerfile --push -t quay.io/che-incubator/che-code-sshd:insiders -t quay.io/che-incubator/che-code-sshd:next -t quay.io/che-incubator/che-code-sshd:insiders-${SHORT_SHA1} .
 

.rebase/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 The file to keep a list of changed files which will potentionaly help to resolve rebase conflicts.
 
+#### @RomanNikitenko
+https://github.com/che-incubator/che-code/pull/655
+
+- code/src/vs/platform/shell/node/shellEnv.ts
+- code/src/vs/server/node/remoteTerminalChannel.ts
+- code/src/vs/server/node/extensionHostConnection.ts
+---
+
+#### @sbouchet
+https://github.com/che-incubator/che-code/pull/647
+
+- code/test/monaco/package.json
+- code/build/package.json
+- code/package.json
+---
+
 #### @RomanNikitenko
 https://github.com/che-incubator/che-code/pull/617
 

.rebase/add/code/build/package.json

@@ -6,6 +6,7 @@
         "jsonwebtoken": {
             "jws": "^3.2.3"
         },
-        "qs": "6.14.1"
+        "qs": "6.14.1",
+        "lodash": "^4.17.23"
     }
 }

.rebase/add/code/package.json

@@ -31,6 +31,7 @@
         },
         "@azure/core-http": {
             "form-data": "4.0.4"
-        }
+        },
+        "lodash": "^4.17.23"
     }
 }

.rebase/add/code/test/monaco/package.json

@@ -0,0 +1,5 @@
+{
+    "overrides": {
+        "lodash": "^4.17.23"
+    }
+}

.rebase/replace/code/src/vs/platform/shell/node/shellEnv.ts.json

@@ -0,0 +1,14 @@
+[
+    {
+        "from": "import { clamp } from '../../../base/common/numbers.js';",
+        "by": "import { clamp } from '../../../base/common/numbers.js';\\\nimport { sanitizeLdLibraryPathInEnvironment, shouldStripLdLibraryPathForShellEnv } from '../../che/utils.js';"
+    },
+    {
+        "from": "const env = {",
+        "by": "const env: NodeJS.ProcessEnv = {"
+    },
+    {
+        "from": "delete env['VSCODE_RESOLVING_ENVIRONMENT'];",
+        "by": "delete env['VSCODE_RESOLVING_ENVIRONMENT'];\\\n\t\t\t\tif (shouldStripLdLibraryPathForShellEnv()) {\\\n\t\t\t\t\tsanitizeLdLibraryPathInEnvironment(env, message => logService.trace(message), 'shellEnv');\\\n\t\t\t\t}"
+    }
+]

.rebase/replace/code/src/vs/server/node/extensionHostConnection.ts.json

@@ -1,7 +1,7 @@
 [
     {
-        "from": "import { getNLSConfiguration } from 'vs/server/node/remoteLanguagePacks';",
-        "by": "import { getNLSConfiguration } from 'vs/server/node/remoteLanguagePacks';\\\nimport { getResolvedPathEnvVar } from 'vs/server/node/che/utils';"
+        "from": "import { getNLSConfiguration } from './remoteLanguagePacks.js';",
+        "by": "import { getNLSConfiguration } from './remoteLanguagePacks.js';\\\nimport { getResolvedPathEnvVar } from '../../platform/che/utils.js';"
     },
     {
         "from": "setCaseInsensitive(env, 'PATH', PATH);",

.rebase/replace/code/src/vs/server/node/remoteTerminalChannel.ts.json

@@ -0,0 +1,18 @@
+[
+    {
+        "from": "import { shouldUseEnvironmentVariableCollection } from '../../platform/terminal/common/terminalEnvironment.js';",
+        "by": "import { shouldUseEnvironmentVariableCollection } from '../../platform/terminal/common/terminalEnvironment.js';\\\nimport { sanitizeLdLibraryPathInEnvironment, shouldStripLdLibraryPathForTerminal } from '../../platform/che/utils.js';"
+    },
+    {
+        "from": "const baseEnv = await buildUserEnvironment(args.resolverEnv, !!args.shellLaunchConfig.useShellEnvironment, platform.language, this._environmentService, this._logService, this._configurationService);",
+        "by": "const baseEnv = await buildUserEnvironment(args.resolverEnv, !!args.shellLaunchConfig.useShellEnvironment, platform.language, this._environmentService, this._logService, this._configurationService);\\\n\t\tif (shouldStripLdLibraryPathForTerminal()) {\\\n\t\t\tsanitizeLdLibraryPathInEnvironment(baseEnv, message => this._logService.trace(message), 'remoteTerminalChannel:baseEnv');\\\n\t\t}"
+    },
+    {
+        "from": "// Apply extension environment variable collections to the environment",
+        "by": "if (shouldStripLdLibraryPathForTerminal()) {\\\n\t\t\tsanitizeLdLibraryPathInEnvironment(env, message => this._logService.trace(message), 'remoteTerminalChannel:terminalEnv');\\\n\t\t}\\\n\\\n\t\t// Apply extension environment variable collections to the environment"
+    },
+    {
+        "from": "return { ...process.env };",
+        "by": "const env: platform.IProcessEnvironment = { ...process.env };\\\n\t\tif (shouldStripLdLibraryPathForTerminal()) {\\\n\t\t\tsanitizeLdLibraryPathInEnvironment(env, message => this._logService.trace(message), 'remoteTerminalChannel:getEnvironment');\\\n\t\t}\\\n\t\treturn env;"
+    }
+]

build/dockerfiles/assembly.sshd.Dockerfile

@@ -0,0 +1,47 @@
+# Copyright (c) 2025 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+
+# UBI 8
+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.10 as sshd-ubi8
+
+USER 0
+
+RUN microdnf -y install libsecret openssh-server nss_wrapper-libs \
+      gzip tar which && \
+    microdnf -y clean all --enablerepo='*'
+
+# UBI 9/10
+FROM registry.access.redhat.com/ubi9/nodejs-20-minimal:9.7
+
+USER 0
+
+RUN microdnf -y install libsecret openssh-server nss_wrapper-libs && \
+    microdnf -y clean all --enablerepo='*'
+
+RUN mkdir -p /sshd-staging/ubi8 /sshd-staging/ubi9
+# UBI 8
+COPY --from=sshd-ubi8 /usr/sbin/sshd /usr/bin/ssh-keygen /usr/bin/tar /usr/bin/gzip /usr/bin/which /usr/lib64/libnss_wrapper.so /usr/lib64/libpam.so.0 /sshd-staging/ubi8/
+# UBI 9/10
+RUN cp /usr/sbin/sshd /usr/bin/ssh-keygen /usr/bin/tar /usr/bin/gzip /usr/bin/which /usr/lib64/libnss_wrapper.so /usr/lib64/libpam.so.0 /usr/lib64/libeconf.so.0 /usr/lib64/libcrypt.so.2 /sshd-staging/ubi9/
+
+# sshd_config is root:root 600
+RUN chmod 644 /etc/ssh/sshd_config
+RUN cp /etc/ssh/sshd_config /sshd-staging/
+
+# Add script to start and stop the service
+COPY --chown=0:0 /build/scripts/sshd.init /build/scripts/sshd.start /sshd-staging/
+
+RUN mkdir /opt/www
+COPY /build/scripts/code-sshd-page/* /opt/www/
+
+# Lock down /etc/passwd until fixed in UDI
+RUN chmod 644 /etc/passwd
+
+EXPOSE 2022 3400
+
+USER 10001