search

containerbuildsystem / koji-containerbuild

Container build support for Koji buildsystem
GNU Lesser General Public License v2.1
29 stars 31 forks source link

Lack of Dockerfile checkout for Flatpaks can bypass plugins #189

Closed owtaylor closed 3 years ago

owtaylor commented 4 years ago

Internally inside Red Hat, we use a plugin that hooks into the koji postSCMCheckout callback to enforce policy on branches for container builds. This hook doesn't get run at all for a Flatpak build, because Flatpaks don't need the label checks, which means that Flatpaks bypass the policy enforcement.

I think it would make most sense to check out the repo and run the hooks. I don't see any value in trying to extensively validate the repo (this will be done when building), but a basic check that there is a container.yaml with a 'flatpak:' section might make sense to catch accidentally triggering a Flatpak build on some inappropriate repo (though rpkg already is going to check that 'container.yaml' exists and has compose: modules)

MartinBasti commented 3 years ago

In https://github.com/containerbuildsystem/osbs-client/pull/1005 was implemented check in osbs-client that will cause early fail in koji builder

lcarva commented 3 years ago

Closing due to lack of interest and activity. If you're still interested feel free to reopen it.