Open smoser opened 1 year ago
To make this a larger waste of bytes and screen real estate https://github.com/project-zot/zot/issues/1145 means that I have to include an annotations section in the stacker.yaml for every layer that will be published like the following:
annotations:
org.opencontainers.image.url: "https://github.com/project-machine"
org.opencontainers.image.source: "https://github.com/project-machine"
org.opencontainers.image.version: "n/a"
org.opencontainers.image.revision: "n/a"
org.opencontainers.image.vendor: "project-machine"
org.opencontainers.image.licenses: "GPLv2 and others"
org.opencontainers.image.title: "bootkit"
org.opencontainers.image.description: ""
That section will then be present in the image manifest both as actual annotations and as content in the included stacker.yaml.
FWIW, I have found the stacker_yaml annotation useful as a clue to find out where images were built, when trying to track down images that are included in ND but not rebuilt with ND, and thus got stale and had expired certs, etc.
I agree that leaking info is a potential problem (although passwords in a stackerfile seems bad for other reasons), so I am not sure what the right thing to do here is, just wanted to point out that there is a use case here.
stacker version
v1.0.0-rc1-c00511a
Describe the bug
When stacker publishes, it includes the content of the stacker yaml that built the image under the annotation io.stackeroci.stacker.stacker_yaml .
In all of our real-world stacker builds this annotation provides no added value, and could include sensitive information. In finding an example for this report, I actually stumbled upon a (encrypted) root password in an yaml that was published.
Because of this I believe this should be disabled by default.
Here is an example annotation section from a stacker-built oci image from https://github.com/project-machine/bootkit:
If you take the time to format the blob of text there, you see that the stacker.yaml file included looks like this:
There is no useful information to the reader because the actual work is done in the prerequisites. Including this annotation by default amounts to a waste of text in a manifest with the potential of leaking sensitive data.
To reproduce
No response
Expected behavior
No response
Screenshots
No response
Additional context
No response