Merge pull request #592 from jmtd/OPENJDK-3935-artifact-permissions

[OPENJDK-3935] Fix script permissions for artifacts

Author: jmtd

modules/jvm/configure.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -euo pipefail
+
+# OPENJDK-3695: force +x for scripts
+chmod 0755 /opt/jboss/container/java/jvm/*

modules/jvm/module.yaml

@@ -9,6 +9,9 @@ artifacts:
   - path: artifacts/jvm
     dest: /opt/jboss/container/java/jvm
 
+execute:
+- script: configure.sh
+
 modules:
   install:
   - name: jboss.container.user

modules/jvm/tests/features/files.feature

@@ -0,0 +1,9 @@
+Feature: test file properties for JVM module
+
+  @ubi9
+  Scenario: Ensure image scripts are executable (OPENJDK-3935)
+    When container is started with args
+    | arg     | value                                                        |
+    | command | find /opt/jboss/container/java/ -type f -printf "%h/%f %M\n" |
+    Then available container log should contain /opt/jboss/container/java/jvm/debug-options -rwxr-xr-x
+    And  available container log should contain /opt/jboss/container/java/jvm/java-default-options -rwxr-xr-x

modules/maven/s2i/configure.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -euo pipefail
+
+# OPENJDK-3695: force +x for scripts
+chmod 0755 /usr/libexec/s2i/save-artifacts

modules/maven/s2i/module.yaml

@@ -30,6 +30,9 @@ modules:
   - name: jboss.container.maven.default
   - name: jboss.container.util.logging
 
+execute:
+- script: configure.sh
+
 packages:
   install:
   - tar

modules/maven/s2i/tests/features/files.feature

@@ -0,0 +1,10 @@
+Feature: test file properties for Maven S2I module
+
+  # builder-only test
+  @ubi9/openjdk-17
+  @ubi9/openjdk-21
+  Scenario: Ensure save-artifacts script is executable (OPENJDK-3935)
+    When container is started with args
+    | arg     | value                                         |
+    | command | find /usr/local/s2i -type f -printf "%f %M\n" |
+    Then available container log should contain save-artifacts -rwxr-xr-x

modules/run/configure.sh

@@ -17,3 +17,6 @@ else
     javasecurity="${JAVA_HOME}/conf/security/java.security"
 fi
 sed -i 's/\(networkaddress.cache.negative.ttl\)=[0-9]\+$/\1=0/' "$javasecurity"
+
+# OPENJDK-3695: force +x for scripts
+chmod 0755 /opt/jboss/container/java/run/run-java.sh

modules/run/tests/features/run.feature

@@ -6,3 +6,8 @@ Feature: OpenJDK run script tests
       | JAVA_OPTS_APPEND | -Djavax.net.ssl.trustStorePassword=sensitiveString |
     Then container log should not contain sensitiveString
 
+  Scenario: Ensure image scripts are executable (OPENJDK-3935)
+    When container is started with args
+    | arg     | value                                                        |
+    | command | find /opt/jboss/container/java/ -type f -printf "%h/%f %M\n" |
+    Then available container log should contain /opt/jboss/container/java/run/run-java.sh -rwxr-xr-x

modules/s2i/bash/configure.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -euo pipefail
+
+# OPENJDK-3695: force +x for scripts
+chmod 0755 /usr/local/s2i/{assemble,run,usage}

modules/s2i/bash/module.yaml

@@ -23,3 +23,6 @@ artifacts:
     dest: /usr/local/s2i
   - path: artifacts/opt
     dest: /opt/jboss/container/java/s2i
+
+execute:
+- script: configure.sh