Bumped NDK version to 27

[jkurdek]

Updates the container to use LTS Android NDK. Should be merged just before the runtime changes PR: dotnet/runtime#110393

[jkoritzinsky]

Can you remove the deletion of clang-tidy now that we're updating the NDK?

[jkurdek]

@jkoritzinsky should we also remove the deletion of python site packages? NDK 27 contains python 3.11

[jkoritzinsky]

I'm not sure if we can remove the site packages deletion. If you try locally, can you run docker scout cves on the image and ensure it comes back clean? When I tried with NDK 27 the python version inside of the LLVM prebuild was still causing issues.

[jkurdek]

I checked - python site packages need to be removed. Also, even after removing site packages the output is not entirely clear. There are some vulnerabilities around pkg:npm/[email protected] and pkg:nuget/[email protected]. But I can see they are there even without the bump.

[jkoritzinsky]

What's the path of the npm/cross-spawn one?

The System.Formats.Asn1 one isn't one I'm worried about (as that's one of our packages, the docker team knows how to fix that one).

[akoeplinger]

npm/cross-spawn is coming from /usr/lib/node_modules/npm/node_modules/cross-spawn/package.json so from the upstream Azure Linux npm package.

The System.Formats.Asn1 is coming from /opt/microsoft/powershell/7/Modules/PSReadLine/_manifest/spdx_2.2/manifest.spdx.json

[akoeplinger]

comment should be updated since it doesn't apply anymore

[jkoritzinsky]

In that case, I think both of those are "fine" in the sense that S360 hasn't flagged them for us to fix.

[akoeplinger]

We could also remove the manual copying of Java since Azure Linux 3.0 now provides an out of the box package for msopenjdk-17 that we can install via tdnf

[jkurdek]

@akoeplinger if we remove Java copying here, what runtime changes would we have to implement?

[akoeplinger]

none, we'd just install the msopenjdk-17 package instead of the COPY --from=mcr.microsoft.com/openjdk/jdk:17-mariner $JAVA_HOME $JAVA_HOME. I can send a PR later, it's just an optimization.