search

openshift / builder

The image run by build pods to execute image building+pushing
Apache License 2.0
31 stars 50 forks source link

OCPBUGS-25495: Upgrade s2i and buildah #392

Closed adambkaplan closed 4 months ago

adambkaplan commented 4 months ago

Upgrade s2i and buildah to latest versions. These collectively help mitigate CVE-2023-48795

openshift-ci-robot commented 4 months ago

@adambkaplan: This pull request references Jira Issue OCPBUGS-25495, which is valid.

3 validation(s) were run on this bug * bug is open, matching expected state (open) * bug target version (4.16.0) matches configured target version for branch (4.16.0) * bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact: /cc @jitendar-singh

The bug has been updated to refer to the pull request using the external bug tracker.

In response to [this](https://github.com/openshift/builder/pull/392): >Upgrade s2i and buildah to latest versions. These collectively help mitigate CVE-2023-48795 Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fbuilder). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
adambkaplan commented 4 months ago

/assign @ayushsatyam146

/cc @apoorvajagtap

adambkaplan commented 4 months ago

@nalind this is interesting - builds aren't able to pull the base image. Seeing the following message:

could not find "netavark" in one of {[/usr/local/libexec/podman /usr/local/lib/podman /usr/libexec/podman /usr/lib/podman] {<nil>}}.  To resolve this error, set the helper_binaries_dir key in the `[engine]` section of containers.conf to the directory containing your helper binaries.
  2024-05-15T20:38:13.308570874Z Warning: Pull failed, retrying in 5s ...
nalind commented 4 months ago

There's a check for the default networking backend that we have to do pretty early due to the way the backward compatibility logic for using CNI was implemented. The builder ends up using "host" (in the container) networking when handling RUN instructions, but the dependency is still there because the library doesn't know that we'll never ask for it.

adambkaplan commented 4 months ago

ack - given that it is part of Podman 4 and can be installed on UBI9 via dnf, adding that package to the set of dependencies is fine by me. But I won't want it to land in 4.16 just yet - at this point bumping buildah should merge for 4.17 so the update gets plenty of "soak time." We'll only backport the golang/x/crypto dep for 4.16 and earlier.

adambkaplan commented 4 months ago

/assign @ayushsatyam146

adambkaplan commented 4 months ago

/cc @nalind

adambkaplan commented 4 months ago

/label px-approved

No impact to product experience

/label docs-approved

Release note will provide documentation

adambkaplan commented 4 months ago

/retest

openshift-ci[bot] commented 4 months ago

@adambkaplan: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/security 6fccd94f4dc3d5fbe0da336dd266d147bbcf7e89 link false /test security

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
apoorvajagtap commented 4 months ago

/lgtm

openshift-ci[bot] commented 4 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adambkaplan, apoorvajagtap, nalind

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/builder/blob/master/OWNERS)~~ [adambkaplan] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
openshift-ci-robot commented 4 months ago

@adambkaplan: Jira Issue OCPBUGS-25495: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-25495 has not been moved to the MODIFIED state.

In response to [this](https://github.com/openshift/builder/pull/392): >Upgrade s2i and buildah to latest versions. These collectively help mitigate CVE-2023-48795 Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fbuilder). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-bot commented 4 months ago

[ART PR BUILD NOTIFIER]

This PR has been included in build openshift-enterprise-builder-container-v4.17.0-202405271211.p0.gd920ddb.assembly.stream.el9 for distgit openshift-enterprise-builder. All builds following this will include this PR.