I have an update!

I have given this idea to the Claude AI that I want this to work inside Docker container using Wine and this is what I got:

# file: Dockerfile
#
# RptToXml on Linux — Crystal Reports .rpt -> XML inside a Wine container.
# Reproducible, self-contained build of the recipe proven in this spike (AR-11988).
#
# Supply chain (all official; verified at build time by verify-binaries.sh):
#   - WineHQ stable            : official apt repo
#   - .NET Framework 4.8       : vendored ndp48 (official MS CDN), Microsoft-signed
#   - VC++ 2015-2022 / MFC     : vendored vc_redist (official MS), Microsoft-signed -> mfc140u.dll
#   - SAP Crystal runtime SP39 : CRRuntime_{64,32}bit_13_0_39.msi, SAP-signed
#   - RptToXml 1.1.7           : official GitHub release (OSS, unsigned by design)
FROM ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive

RUN dpkg --add-architecture i386 && apt-get update && apt-get install -y --no-install-recommends \
      wget gnupg2 ca-certificates xvfb cabextract unzip winbind procps xauth osslsigncode \
    && rm -rf /var/lib/apt/lists/*

# WineHQ stable (official repo)
RUN mkdir -p /etc/apt/keyrings && \
    wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key && \
    wget -NP /etc/apt/sources.list.d/ https://dl.winehq.org/wine-builds/ubuntu/dists/noble/winehq-noble.sources && \
    apt-get update && apt-get install -y --install-recommends winehq-stable && rm -rf /var/lib/apt/lists/*

RUN wget -O /usr/local/bin/winetricks https://raw.githubusercontent.com/Winetricks/winetricks/master/src/winetricks && \
    chmod +x /usr/local/bin/winetricks

# ---------------------------------------------------------------------------
# SUPPLY-CHAIN GATE: verify SHA-256 pins + Authenticode signers of every
# vendored binary BEFORE anything is installed. Build aborts on any mismatch.
# ---------------------------------------------------------------------------
WORKDIR /build
COPY SHA256SUMS verify-binaries.sh ./
COPY CRRuntime_64bit_13_0_39.msi CRRuntime_32bit_13_0_39.msi ./
COPY vendor ./vendor
RUN chmod +x verify-binaries.sh && ./verify-binaries.sh
# seed winetricks cache from the now-verified installers (no network re-download)
RUN mkdir -p /root/.cache/winetricks && cp -r ./vendor/winetricks-cache/. /root/.cache/winetricks/

ENV WINEARCH=win64 WINEPREFIX=/opt/wineprefix WINEDEBUG=-all

# Initialise prefix with mono/gecko disabled (no blocking GUI prompt during build)
RUN WINEDLLOVERRIDES="mscoree=,mshtml=" xvfb-run -a sh -c 'wineboot --init; wineserver -w'

# .NET Framework 4.8 (real MS runtime; Mono can't host the Crystal COM stack)
RUN xvfb-run -a winetricks -q dotnet48 && wineserver -w

# MFC / VC++ 2015-2022 runtime — crpe32.dll links mfc140u.dll, which Wine does not ship
RUN xvfb-run -a winetricks -q vcrun2022 && wineserver -w

# SAP Crystal runtime — BOTH bitnesses: the 64-bit engine + the 32-bit one because
# RptToXml.exe is built x86 (CorFlags 32BITREQUIRED) and activates the 32-bit RAS COM server.
RUN xvfb-run -a wine msiexec /i /build/CRRuntime_64bit_13_0_39.msi /qn && wineserver -w
RUN xvfb-run -a wine msiexec /i /build/CRRuntime_32bit_13_0_39.msi /qn && wineserver -w

# RptToXml (config already patched: supportedRuntime sku relaxed to accept .NET 4.8)
COPY rpttoxml /opt/rpttoxml
COPY entrypoint.sh /usr/local/bin/rpttoxml
RUN chmod +x /usr/local/bin/rpttoxml

# Usage: docker run --rm -v "$PWD":/data img /data/in.rpt /data/out.xml
WORKDIR /data
ENTRYPOINT ["/usr/local/bin/rpttoxml"]

and entrypoint.sh file:

#!/bin/sh
# rpttoxml entrypoint — convert a Crystal Reports .rpt to XML under Wine.
# Usage: rpttoxml <input.rpt> <output.xml> [--ignore-errors] [--stdout]
#
# Env knobs that make Crystal-on-Wine work (see README):
#   COMPLUS_ZapDisable=1     -> force pure JIT, avoids the .NET NGen (mscorsvw) startup hang
#   COMPLUS_NoGuiFromShim=1  -> no blocking shim dialogs under headless Xvfb
set -e
export WINEPREFIX=/opt/wineprefix WINEARCH=win64 WINEDEBUG=-all
export COMPLUS_ZapDisable=1 COMPLUS_NoGuiFromShim=1
export DISPLAY=:99 XDG_RUNTIME_DIR=/tmp/xdg
mkdir -p /tmp/xdg && chmod 700 /tmp/xdg

# headless display for the Crystal engine
if ! pgrep -x Xvfb >/dev/null 2>&1; then
  Xvfb :99 -screen 0 1024x768x16 >/dev/null 2>&1 &
  sleep 2
fi

exec wine /opt/rpttoxml/RptToXml.exe "$@"

and verify-binaries.sh:

#!/bin/sh
# Supply-chain gate for every binary this image installs.
# Each file must (1) match its pinned SHA-256 in SHA256SUMS and
# (2) carry a valid Authenticode signature from the expected vendor.
# Any mismatch aborts (exit 1). Runs at build time AND standalone:
#     ./verify-binaries.sh
#
# Requires: coreutils (sha256sum), osslsigncode.
set -eu
cd "$(dirname "$0")"

echo "==> 1/2  SHA-256 pins (exact bytes we vetted)"
# --ignore-missing: the build stage copies only the installables, not the source zip;
# standalone (full dir) every listed file is present and checked.
sha256sum -c --ignore-missing SHA256SUMS

echo "==> 2/2  Authenticode signatures"
# check <file> <expected signer Org> <require_full_chain: yes|no>
#   yes  -> require "Signature verification: ok" (root must be in the CA bundle; true for SAP/DigiCert)
#   no   -> require the expected signer + intact content digest (Microsoft root not in distro bundle;
#           the SHA-256 pin above already locks the exact bytes, so signer+digest is sufficient)
check() {
  f="$1"; who="$2"; full="$3"
  out=$(osslsigncode verify "$f" 2>&1 || true)
  echo "$out" | grep -q "Subject:.*${who}" || { echo "FAIL ${f}: expected signer '${who}' not found"; exit 1; }
  # a signature must be present and parse cleanly
  echo "$out" | grep -q "Number of verified signatures" || { echo "FAIL ${f}: no parseable signature"; exit 1; }
  if [ "$full" = yes ]; then
    # root in the distro CA bundle (SAP -> DigiCert) -> require full chain validation
    echo "$out" | grep -q "Signature verification: ok" || { echo "FAIL ${f}: signature/chain not verified"; exit 1; }
  fi
  # For the "no" case (Microsoft root not shipped in the distro bundle), the SHA-256 pin
  # above already locks the exact bytes, so signer identity + parseable signature is sufficient.
  echo "  OK  ${f}  <-  ${who}"
}

check CRRuntime_64bit_13_0_39.msi                              "SAP SE"                yes
check CRRuntime_32bit_13_0_39.msi                              "SAP SE"                yes
check vendor/winetricks-cache/dotnet48/ndp48-x86-x64-allos-enu.exe "Microsoft Corporation" no
check vendor/winetricks-cache/vcrun2022/vc_redist.x86.exe      "Microsoft Corporation" no
check vendor/winetricks-cache/vcrun2022/vc_redist.x64.exe      "Microsoft Corporation" no

echo "==> All binaries verified (SHA-256 + Authenticode signer)."

and SHA256SUMS file:

0716944644faf8e7c2613bd46655c79454808a2a3dd71e58642939fd7839320c  CRRuntime_64bit_13_0_39.msi
dab1078a7281a81413e3d9eb9e7af13811b2771cfb2a02fd79a92cc12aa65e3a  CRRuntime_32bit_13_0_39.msi
ca05042bced7045ea659e5b4362052304890d4fac9d80aae2a986da8aea756df  RptToXml_1.1.7.zip
95889d6de3f2070c07790ad6cf2000d33d9a1bdfc6a381725ab82ab1c314fd53  vendor/winetricks-cache/dotnet48/ndp48-x86-x64-allos-enu.exe
0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64  vendor/winetricks-cache/vcrun2022/vc_redist.x86.exe
cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b  vendor/winetricks-cache/vcrun2022/vc_redist.x64.exe

and I can confirm it works.

I am not sure if you want to use this in any "official capacity" in your project but you could mention it in docs that this is something that could be done but with risk of some licensing issues as you need to download some proprietary binaries and put them into your docker images.

Question: Running RptToXml in linux-based container #65

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions