common: pin and verify the components#271
Conversation
Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>
|
@Mergifyio backport v1.8 |
✅ Backports have been createdDetails
|
There was a problem hiding this comment.
Pull request overview
This PR aims to improve supply-chain integrity and reproducibility by pinning versions/SHAs of build-time components (and adding checksum verification) used in local builds and CI.
Changes:
- Pin the
dapperdownload to a specific version and add SHA-512 verification inMakefile. - Switch image packaging scripts to use
docker buildx(paired with installing buildx in the dapper image). - Pin/verify Helm download in CI helper script and update the pinned
read-vault-secretsGitHub Action SHA.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
scripts/package_webhook |
Use docker buildx for building the webhook image. |
scripts/package_controller |
Use docker buildx for building the controller image. |
Makefile |
Pin dapper version and verify the downloaded binary via SHA-512. |
Dockerfile.dapper |
Install buildx via package manager and pin golangci-lint via image digest. |
ci/scripts/helpers.sh |
Attempt to pin Helm version and verify download checksum. |
.github/workflows/fossa.yml |
Update pinned SHA for rancher-eio/read-vault-secrets action. |
.github/workflows/factory.yaml |
Update pinned SHA for rancher-eio/read-vault-secrets action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| echo "Checksum verification failed!"; \ | ||
| exit 1; \ | ||
| fi | ||
| @@chmod +x .dapper.tmp |
There was a problem hiding this comment.
The .dapper recipe uses @@chmod, which Make interprets as “silent” (@) plus a literal @ passed to the shell. That results in trying to execute a command named @chmod and will fail, breaking make ci/any target that depends on .dapper. Use a single leading @ (or none) before chmod.
| @@chmod +x .dapper.tmp | |
| @chmod +x .dapper.tmp |
ci/scripts/helpers.sh
Outdated
| ARG HELM_VERSION=v3.20.0 | ||
| ARG HELM_SUM_amd64=dbb4c8fc8e19d159d1a63dda8db655f9ffa4aac1b9a6b188b34a40957119b286 | ||
| ARG HELM_SUM_arm64=bfb14953295d5324d47ab55f3dfba6da28d46c848978c8fbf412d4271bdc29f1 | ||
| ARG HELM_SUM="HELM_SUM_${ARCH}" |
There was a problem hiding this comment.
ARG is Dockerfile syntax, not valid in bash. With the #!/bin/bash -e shebang, the script will exit immediately with “ARG: command not found”, so none of the CI scripts that source helpers.sh will work. Replace these with normal bash variable assignments (and ensure ARCH is set before it’s used).
| ARG HELM_VERSION=v3.20.0 | |
| ARG HELM_SUM_amd64=dbb4c8fc8e19d159d1a63dda8db655f9ffa4aac1b9a6b188b34a40957119b286 | |
| ARG HELM_SUM_arm64=bfb14953295d5324d47ab55f3dfba6da28d46c848978c8fbf412d4271bdc29f1 | |
| ARG HELM_SUM="HELM_SUM_${ARCH}" | |
| ARCH="${ARCH:-amd64}" | |
| HELM_VERSION="v3.20.0" | |
| HELM_SUM_amd64="dbb4c8fc8e19d159d1a63dda8db655f9ffa4aac1b9a6b188b34a40957119b286" | |
| HELM_SUM_arm64="bfb14953295d5324d47ab55f3dfba6da28d46c848978c8fbf412d4271bdc29f1" | |
| HELM_SUM="HELM_SUM_${ARCH}" |
| curl -O https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz | ||
| echo "${!HELM_SUM}" helm-${HELM_VERSION}-linux-${ARCH}.tar.gz | sha256sum -c - | ||
| tar xvzf helm-${HELM_VERSION}-linux-${ARCH}.tar.gz | ||
| HELM=$TOP_DIR/linux-amd64/helm |
There was a problem hiding this comment.
The extracted helm binary path is still hardcoded to linux-amd64/helm, but the download/extract is now architecture-dependent (linux-${ARCH}). This will break on arm64 (and is inconsistent even on amd64 if ARCH differs). Point HELM at the extracted linux-${ARCH}/helm directory (or derive it from the tar contents).
| HELM=$TOP_DIR/linux-amd64/helm | |
| HELM=$TOP_DIR/linux-${ARCH}/helm |
Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>
Vicente-Cheng
force-pushed
the
pin-n-verify-components
branch
from
dc8885c to
79bfac2
Compare
|
@Mergifyio backport v1.8 |
☑️ Command
|
Problem:
pin and verify the components
Solution:
pin and verify the components
Related Issue:
https://github.com/rancher/rancher-security/issues/1512
Test plan: