Skip to content

Commit c04fc77

Browse files
jiridanekjstourac
jiridanek
and
jstourac
authored
NO-JIRA: tests(gha): add check-payload integration and dependency management (#1080)
* NO-JIRA: tests(gha): add `check-payload` integration and dependency management Introduce the `check-payload` tool for image vulnerability scanning. Updated workflows to cache Go module dependencies and run the `check-payload` scan, ensuring it doesn't fail the build by default. Added Go module files for managing dependencies of the new tooling. * fixup, add config to suppress stuff * fixup, mention FIPS in step name in .github/workflows/build-notebooks-TEMPLATE.yaml Co-authored-by: Jan Stourac <[email protected]> --------- Co-authored-by: Jan Stourac <[email protected]>
1 parent 90242a3 commit c04fc77

File tree

5 files changed

+2376
-1
lines changed

5 files changed

+2376
-1
lines changed

‎.github/workflows/build-notebooks-TEMPLATE.yaml

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ jobs:
8686
# for bin/buildinputs in scripts/sandbox.py
8787
- uses: actions/setup-go@v5
8888
with:
89-
cache-dependency-path: "**/*.sum"
89+
cache-dependency-path: "scripts/buildinputs/go.sum"
9090

9191
- run: sudo apt-get update
9292

@@ -561,6 +561,44 @@ jobs:
561561
562562
# endregion
563563

564+
# region Trivy vulnerability scan
565+
566+
- id: check-payload-vars
567+
run: |
568+
echo "GOPATH=${{ github.workspace }}/go-check-payload" >> "$GITHUB_OUTPUT"
569+
working-directory: scripts/check-payload
570+
571+
# for https://github.com/openshift/check-payload to cache the built binary
572+
- uses: actions/setup-go@v5
573+
with:
574+
cache-dependency-path: "scripts/check-payload/go.sum"
575+
env:
576+
GOPATH: ${{ steps.check-payload-vars.outputs.GOPATH }}
577+
578+
# F0512 15:43:03.219076 21568 main.go:294] Error: exec: "oc": executable file not found in $PATH
579+
- name: Install oc client
580+
run: |
581+
# Install the oc client
582+
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz -o /tmp/openshift-client-linux.tar.gz
583+
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
584+
rm -f /tmp/openshift-client-linux.tar.gz
585+
sudo mv ./oc /usr/local/bin
586+
587+
# use sudo to avoid
588+
# podman error (args=[image mount ghcr.io/...])
589+
# (stderr=Error: cannot use command "podman image mount" with the remote podman client
590+
# and use --preserve-env=PATH to avoid
591+
# F0512 16:31:58.425584 9911 main.go:294] Error: exec: "podman": executable file not found in $PATH
592+
- name: Check image with check-payload for FIPS compliance
593+
run: |
594+
set -Eeuxo pipefail
595+
sudo --preserve-env=PATH go run github.com/openshift/check-payload scan image --spec "${{ steps.calculated_vars.outputs.OUTPUT_IMAGE }}"
596+
working-directory: scripts/check-payload
597+
env:
598+
GOPATH: ${{ steps.check-payload-vars.outputs.GOPATH }}
599+
600+
# endregion
601+
564602
# region Typescript (browser) image tests
565603

566604
# https://playwright.dev/docs/ci

‎scripts/check-payload/config.toml

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
2+
# DEFAULT CONFIG
3+
# **************
4+
# https://github.com/openshift/check-payload/blob/main/config.toml
5+
6+
certified_distributions = []
7+
8+
# List of directories to ignore. This is a prefix match,
9+
# i.e. everything under a matched directory is ignored.
10+
filter_dirs = [
11+
"/lib/firmware",
12+
"/lib/modules",
13+
"/usr/lib/.build-id",
14+
"/usr/lib/firmware",
15+
"/usr/lib/grub",
16+
"/usr/lib/modules",
17+
"/usr/share/app-info",
18+
"/usr/share/doc",
19+
"/usr/share/fonts",
20+
"/usr/share/icons",
21+
"/usr/share/openshift",
22+
"/usr/src/plugins",
23+
"/rootfs",
24+
"/sysroot",
25+
]
26+
27+
java_fips_disabled_algorithms = [
28+
"DH keySize < 2048",
29+
"TLSv1.1",
30+
"TLSv1",
31+
"SSLv3",
32+
"SSLv2",
33+
"TLS_RSA_WITH_AES_256_CBC_SHA256",
34+
"TLS_RSA_WITH_AES_256_CBC_SHA",
35+
"TLS_RSA_WITH_AES_128_CBC_SHA256",
36+
"TLS_RSA_WITH_AES_128_CBC_SHA",
37+
"TLS_RSA_WITH_AES_256_GCM_SHA384",
38+
"TLS_RSA_WITH_AES_128_GCM_SHA256",
39+
"DHE_DSS",
40+
"RSA_EXPORT",
41+
"DHE_DSS_EXPORT",
42+
"DHE_RSA_EXPORT",
43+
"DH_DSS_EXPORT",
44+
"DH_RSA_EXPORT",
45+
"DH_anon",
46+
"ECDH_anon",
47+
"DH_RSA",
48+
"DH_DSS",
49+
"ECDH",
50+
"3DES_EDE_CBC",
51+
"DES_CBC",
52+
"RC4_40",
53+
"RC4_128",
54+
"DES40_CBC",
55+
"RC2",
56+
"HmacMD5",
57+
]
58+
59+
[[rpm.tini.ignore]]
60+
error = "ErrNotDynLinked"
61+
files = ["/usr/bin/tini-static"]
62+
63+
[[rpm.glibc-common.ignore]]
64+
error = "ErrNotDynLinked"
65+
files = ["/usr/sbin/build-locale-archive"]
66+
67+
[[rpm.glibc.ignore]]
68+
error = "ErrNotDynLinked"
69+
files = ["/usr/sbin/ldconfig", "/sbin/ldconfig"]
70+
71+
[[rpm.runc.ignore]]
72+
error = "ErrGoMissingTag"
73+
files = ["/usr/bin/runc"]
74+
75+
[[rpm.runc.ignore]]
76+
error = "ErrGoInvalidTag"
77+
files = ["/usr/bin/runc"]
78+
79+
[[rpm.runc.ignore]]
80+
# See OCPBUGS-36541.
81+
error = "ErrGoMissingSymbols"
82+
files = ["/usr/bin/runc"]
83+
84+
[[rpm.runc.ignore]]
85+
# See OCPBUGS-36541.
86+
error = "ErrLibcryptoMissing"
87+
files = ["/usr/bin/runc"]
88+
89+
[[rpm.podman.ignore]]
90+
error = "ErrGoMissingTag"
91+
files = [
92+
"/usr/bin/podman",
93+
"/usr/libexec/podman/quadlet",
94+
"/usr/libexec/podman/rootlessport",
95+
]
96+
97+
[[rpm.podman.ignore]]
98+
error = "ErrNotDynLinked"
99+
files = ["/usr/libexec/podman/catatonit"]
100+
101+
[[rpm.podman.ignore]]
102+
error = "ErrGoMissingSymbols"
103+
files = ["/usr/libexec/podman/rootlessport"]
104+
105+
[[rpm.podman-catatonit.ignore]]
106+
error = "ErrNotDynLinked"
107+
files = ["/usr/libexec/catatonit/catatonit"]
108+
109+
[[rpm.skopeo.ignore]]
110+
error = "ErrGoMissingTag"
111+
files = ["/usr/bin/skopeo"]
112+
113+
[[rpm.cri-o.ignore]]
114+
error = "ErrGoMissingTag"
115+
files = ["/usr/bin/crio", "/usr/bin/crio-status"]
116+
117+
[[rpm.cri-o.ignore]]
118+
error = "ErrNotDynLinked"
119+
files = ["/usr/bin/pinns"]
120+
121+
[[rpm.cri-tools.ignore]]
122+
error = "ErrGoMissingTag"
123+
files = ["/usr/bin/crictl"]
124+
125+
[[rpm.containernetworking-plugins.ignore]]
126+
error = "ErrGoMissingTag"
127+
dirs = ["/usr/libexec/cni"]
128+
129+
[[rpm.ignition.ignore]]
130+
error = "ErrGoMissingTag"
131+
files = ["/usr/lib/dracut/modules.d/30ignition/ignition"]
132+
133+
[[payload.openshift-enterprise-pod-container.ignore]]
134+
error = "ErrNotDynLinked"
135+
files = ["/usr/bin/pod"]
136+
137+
[[payload.openshift-virtualization-virt-container.ignore]]
138+
error = "ErrNotDynLinked"
139+
files = ["/usr/bin/container-disk"]
140+
141+
[[payload.openshift-virtualization-cdi-container.ignore]]
142+
error = "ErrGoNotCgoEnabled"
143+
files = ["/usr/bin/cdi-containerimage-server"]
144+
145+
[[payload.openshift-istio-cni-rhel8-container.ignore]]
146+
error = "ErrLibcryptoSoMissing"
147+
files = ["/opt/cni/bin/istio-cni-rhel9"]
148+
149+
[[payload.rhacs-main-container.ignore]]
150+
error = "ErrGoNotCgoEnabled"
151+
dirs = ["/assets/downloads/cli"]
152+
153+
[[payload.rhacs-main-container.ignore]]
154+
error = "ErrGoNoCgoInit"
155+
dirs = ["/assets/downloads/cli"]
156+
157+
[[payload.rhacs-main-container.ignore]]
158+
error = "ErrGoMissingSymbols"
159+
dirs = ["/assets/downloads/cli"]
160+
161+
[[payload.rhacs-main-container.ignore]]
162+
error = "ErrNotDynLinked"
163+
dirs = ["/assets/downloads/cli"]
164+
165+
[[payload.rhacs-main-container.ignore]]
166+
error = "ErrLibcryptoMissing"
167+
dirs = ["/assets/downloads/cli"]
168+
169+
[[payload.rhacs-main-container.ignore]]
170+
error = "ErrGoMissingTag"
171+
dirs = ["/assets/downloads/cli"]
172+
173+
# Temporary supprsssions for workbenches
174+
# https://github.com/openshift/check-payload/blob/main/internal/types/errors.go
175+
176+
[[rpm.rstudio-server.ignore]]
177+
error = "ErrNotDynLinked"
178+
files = [
179+
# executable is not dynamically linked
180+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/pandoc",
181+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/typst",
182+
]
183+
184+
[[rpm.rstudio-server.ignore]]
185+
error = "ErrNotDynLinked"
186+
files = [
187+
# executable is not dynamically linked
188+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/esbuild",
189+
]
190+
191+
[[rpm.rstudio-server.ignore]]
192+
error = "ErrGoNotCgoEnabled"
193+
files = [
194+
# go binary is not CGO_ENABLED
195+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/esbuild",
196+
]
197+
198+
[[rpm.rstudio-server.ignore]]
199+
error = "ErrGoNoCgoInit"
200+
files = [
201+
# x_cgo_init or _cgo_topofstack not found
202+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/esbuild",
203+
]
204+
205+
[[rpm.rstudio-server.ignore]]
206+
error = "ErrLibcryptoMissing"
207+
files = [
208+
# openssl: did not find libcrypto library within binary
209+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/esbuild",
210+
]
211+
212+
[[rpm.rstudio-server.ignore]]
213+
error = "ErrGoMissingSymbols"
214+
files = [
215+
# go binary does not contain required symbol(s)
216+
"/usr/lib/rstudio-server/bin/quarto/bin/tools/x86_64/esbuild",
217+
]
218+
219+
[[rpm.valgrind.ignore]]
220+
error = "ErrNotDynLinked"
221+
files = [
222+
# executable is not dynamically linked
223+
"/usr/libexec/valgrind/cachegrind-amd64-linux",
224+
"/usr/libexec/valgrind/callgrind-amd64-linux",
225+
"/usr/libexec/valgrind/dhat-amd64-linux",
226+
"/usr/libexec/valgrind/drd-amd64-linux",
227+
"/usr/libexec/valgrind/exp-bbv-amd64-linux",
228+
"/usr/libexec/valgrind/helgrind-amd64-linux",
229+
"/usr/libexec/valgrind/lackey-amd64-linux",
230+
"/usr/libexec/valgrind/massif-amd64-linux",
231+
"/usr/libexec/valgrind/memcheck-amd64-linux",
232+
"/usr/libexec/valgrind/none-amd64-linux",
233+
]
234+
235+
# https://issues.redhat.com/browse/RHOAIENG-24290
236+
237+
[[payload.python-311-container.ignore]]
238+
error = "ErrNotDynLinked"
239+
files = [
240+
# executable is not dynamically linked
241+
"/opt/app-root/bin/py-spy",
242+
]
243+
244+
[[rpm.code-server.ignore]]
245+
error = "ErrNotDynLinked"
246+
files = [
247+
# executable is not dynamically linked
248+
"/usr/lib/code-server/lib/vscode/node_modules/@vscode/ripgrep/bin/rg",
249+
]
250+
251+
# https://issues.redhat.com/browse/RHOAIENG-24340
252+
253+
[[rpm.mongocli.ignore]]
254+
error = "ErrNotDynLinked"
255+
files = [
256+
# executable is not dynamically linked
257+
"/usr/bin/mongocli",
258+
]
259+
260+
[[rpm.mongocli.ignore]]
261+
error = "ErrGoNotCgoEnabled"
262+
files = [
263+
# go binary is not CGO_ENABLED
264+
"/usr/bin/mongocli",
265+
]
266+
267+
[[rpm.mongocli.ignore]]
268+
error = "ErrGoNoCgoInit"
269+
files = [
270+
# x_cgo_init or _cgo_topofstack not found
271+
"/usr/bin/mongocli",
272+
]
273+
274+
[[rpm.mongocli.ignore]]
275+
error = "ErrGoMissingSymbols"
276+
files = [
277+
# go binary does not contain required symbol(s)
278+
"/usr/bin/mongocli",
279+
]
280+
281+
[[payload.openshift-ai-workbenches.ignore]]
282+
error = "ErrLibcryptoSoMissing"
283+
files = [
284+
# could not find dependent openssl version within container image: libcrypto.so.1.1
285+
"/opt/app-root/bin/oc",
286+
]

0 commit comments

Comments
 (0)