ERROR: Service 'django' failed to build

[splunk-user1]

Trying to install orochi on Ubuntu 20.04 VM. Get following error during docker-compose build / up.

Step 16/42 : WORKDIR /tmp/yara-python
 ---> Using cache
 ---> aa786afe3c8b
Step 17/42 : RUN python setup.py build
 ---> Running in 072ffdba7475
/usr/local/lib/python3.10/site-packages/setuptools/config/setupcfg.py:463: SetuptoolsDeprecationWarning: The license_file parameter is deprecated, use license_files instead.
  warnings.warn(msg, warning_class)
running build
running build_ext
building 'yara' extension
<--snip-->
<--snip-->

error: command '/usr/bin/gcc' failed with exit code 1
ERROR: Service 'django' failed to build: The command '/bin/sh -c python setup.py build' returned a non-zero code: 1

[garanews]

We're following current issue in yara-python VirusTotal/yara-python#212
At the moment you should be able at least to run our images, are available since some month and are working also if don't have latest updated dependencies.
So with docker-compose pull and then docker-compose up at least you should be able to use and try the tool.

[splunk-user1]

So with docker-compose pull and then docker-compose up at least you should be able to use and try the tool.

Thank you @garanews But I get same error with docker-compose pull and then docker-compose up

ubuntu:~/orochi$ sudo docker-compose pull
WARNING: The http_proxy variable is not set. Defaulting to a blank string.
WARNING: The https_proxy variable is not set. Defaulting to a blank string.
WARNING: Some services (worker) use the 'deploy' key, which will be ignored. Compose does not support 'deploy' configuration - use `docker stack deploy` to deploy to a swarm.
Pulling mailhog   ... done
Pulling redis     ... done
Pulling es01      ... done
Pulling kib01     ... done
Pulling scheduler ... done


ubuntu:~/orochi$ sudo docker-compose up
WARNING: The http_proxy variable is not set. Defaulting to a blank string.
WARNING: The https_proxy variable is not set. Defaulting to a blank string.
WARNING: Some services (worker) use the 'deploy' key, which will be ignored. Compose does not support 'deploy' configuration - use `docker stack deploy` to deploy to a swarm.
Building django
Step 1/42 : FROM python:3.10-slim-buster as common-base
 ---> 8addbbd4348f

<--snip-->
<--snip-->

Step 17/42 : RUN python setup.py build
 ---> Running in df2316ccb809
/usr/local/lib/python3.10/site-packages/setuptools/config/setupcfg.py:463: SetuptoolsDeprecationWarning: The license_file parameter is deprecated, use license_files instead.
  warnings.warn(msg, warning_class)
running build
running build_ext
building 'yara' extension
creating build
creating build/temp.linux-x86_64-cpython-310
creating build/temp.linux-x86_64-cpython-310/yara
creating build/temp.linux-x86_64-cpython-310/yara/libyara
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/console
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/demo
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/elf
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/hash
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/math
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/pe
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/pe/authenticode-parser
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/tests
creating build/temp.linux-x86_64-cpython-310/yara/libyara/modules/time
creating build/temp.linux-x86_64-cpython-310/yara/libyara/proc
creating build/temp.linux-x86_64-cpython-310/yara/libyara/tlshc
gcc -pthread -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -D_GNU_SOURCE=1 -DUSE_LINUX_PROC=1 -DHAVE_STDBOOL_H=1 -DHAVE_MEMMEM=1 -DHASH_MODULE=1 -DHAVE_LIBCRYPTO=1 -Iyara/libyara/include -Iyara/libyara/ -I. -I/usr/local/include/python3.10 -c yara-python.c -o build/temp.linux-x86_64-cpython-310/yara-python.o -std=c99
yara-python.c: In function ‘convert_object_to_python’:
yara-python.c:479:27: warning: comparison of integer expressions of different signedness: ‘int64_t’ {aka ‘long int’} and ‘long long unsigned int’ [-Wsign-compare]
       if (object->value.i != YR_UNDEFINED)

[garanews]

With docker-compose pull no need to build the images, they are downloaded from repo, like do:

docker pull ghcr.io/ldo-cert/orochi_django:latest
docker pull ghcr.io/ldo-cert/orochi_worker:latest
docker pull ghcr.io/ldo-cert/orochi_postgres:latest
...
...

Anyway if you want to build, at the moment need to use v4.2.x branch of yara-python , to do so edit those 2 lines
https://github.com/LDO-CERT/orochi/blob/master/compose/local/django/Dockerfile#L50
https://github.com/LDO-CERT/orochi/blob/master/compose/local/dask/Dockerfile#L35
replacing with:

RUN git clone --branch v4.2.x --recursive https://github.com/VirusTotal/yara-python

[garanews]

Just tried with everything clean (no previous images built or created, just deleted everything with docker system prune -a).
I cloned repo with git clone https://github.com/LDO-CERT/orochi and cd orochi
Then docker-compose pull , when done docker-compose up

As you can see from screenshoot below, the images are pulled and not built:

Hope this helps.
By the way, which versions of docker and docker-compose are you using? Maybe you need to update those.

[garanews]

At the moment we rebuilt images with inside the pinned version of yara-python
git clone --branch v4.2.x --recursive https://github.com/VirusTotal/yara-python
The images build successfully.