Skip to content

Commit 7e29609

Browse files
Honny1Honny1
committed
Consolidate build secret tests and assert no podman-build-secret leak
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
1 parent e18bb9e commit 7e29609

4 files changed

Lines changed: 40 additions & 50 deletions

File tree

‎test/e2e/build/remote-secret-copy/Dockerfile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,3 @@ FROM alpine
22
COPY . .
33
RUN test -e hello
44
RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret
5-
RUN sh -c 'test -z "$(find / -name '\''podman-build-secret*'\'' 2>/dev/null | head -n1)"'

‎test/e2e/build/remote-secret-dockerignore-star/Dockerfile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,3 @@ FROM alpine
22
COPY . .
33
RUN test ! -e ignored-by-dockerignore.txt
44
RUN --mount=type=secret,id=MY_SECRET cat /run/secrets/MY_SECRET
5-
RUN sh -c 'test -z "$(find / -name '\''podman-build-secret*'\'' 2>/dev/null | head -n1)"'

‎test/e2e/build/secret-verify-leak/Containerfile.with-secret-verify-leak‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎test/e2e/build_test.go‎

Lines changed: 40 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -89,67 +89,62 @@ var _ = Describe("Podman build", func() {
8989
})
9090

9191
It("podman build with a secret from file", func() {
92-
session := podmanTest.Podman([]string{"build", "-f", "build/Containerfile.with-secret", "-t", "secret-test", "--secret", "id=mysecret,src=build/secret.txt", "build/"})
93-
session.WaitWithDefaultTimeout()
94-
Expect(session).Should(ExitCleanly())
92+
image := "secret-test"
93+
94+
session := podmanTest.PodmanExitCleanly("build", "-f", "build/Containerfile.with-secret", "-t", image, "--secret", "id=mysecret,src=build/secret.txt", "build/")
9595
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
9696

97-
session = podmanTest.Podman([]string{"rmi", "secret-test"})
98-
session.WaitWithDefaultTimeout()
99-
Expect(session).Should(ExitCleanly())
100-
})
97+
session = podmanTest.PodmanExitCleanly("run", "--rm", image, "sh", "-c", `find / -name 'podman-build-secret*' 2>/dev/null`)
98+
Expect(session.OutputToString()).To(BeEmpty(), "podman-build-secret path leaked into image")
10199

102-
It("podman build with a secret from env", func() {
103-
os.Setenv("MYSECRET", "somesecret")
104-
defer os.Unsetenv("MYSECRET")
105-
session := podmanTest.PodmanExitCleanly("build", "-f", "build/Containerfile.with-secret", "-t", "secret-test", "--secret", "id=mysecret,env=MYSECRET", "build/")
106-
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
100+
podmanTest.PodmanExitCleanly("rmi", image)
107101

108-
podmanTest.PodmanExitCleanly("rmi", "secret-test")
109-
})
102+
// Test for: https://github.com/containers/podman/issues/25314 - file secrets must reach the server when .dockerignore is '*'.
103+
image = "e2e-remote-secret-dignore"
110104

111-
It("podman build with multiple secrets from files", func() {
112-
session := podmanTest.Podman([]string{"build", "-f", "build/Containerfile.with-multiple-secret", "-t", "multiple-secret-test", "--secret", "id=mysecret,src=build/secret.txt", "--secret", "id=mysecret2,src=build/anothersecret.txt", "build/"})
113-
session.WaitWithDefaultTimeout()
114-
Expect(session).Should(ExitCleanly())
105+
session = podmanTest.PodmanExitCleanly("build", "-f", "build/remote-secret-dockerignore-star/Dockerfile", "-t", image, "--secret", "id=MY_SECRET,type=file,src=build/remote-secret-dockerignore-star/host-secret.txt", "build/remote-secret-dockerignore-star")
106+
Expect(session.OutputToString()).To(ContainSubstring("Super Secret"))
107+
108+
session = podmanTest.PodmanExitCleanly("run", "--rm", image, "sh", "-c", `find / -name 'podman-build-secret*' 2>/dev/null`)
109+
Expect(session.OutputToString()).To(BeEmpty(), "podman-build-secret path leaked into image")
110+
111+
podmanTest.PodmanExitCleanly("rmi", image)
112+
113+
// build with multiple secrets from files
114+
image = "multiple-secret-test"
115+
session = podmanTest.PodmanExitCleanly("build", "-f", "build/Containerfile.with-multiple-secret", "-t", image, "--secret", "id=mysecret,src=build/secret.txt", "--secret", "id=mysecret2,src=build/anothersecret.txt", "build/")
115116
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
116117
Expect(session.OutputToString()).To(ContainSubstring("anothersecret"))
117118

118-
session = podmanTest.Podman([]string{"rmi", "multiple-secret-test"})
119-
session.WaitWithDefaultTimeout()
120-
Expect(session).Should(ExitCleanly())
119+
session = podmanTest.PodmanExitCleanly("run", "--rm", image, "sh", "-c", `find / -name 'podman-build-secret*' 2>/dev/null`)
120+
Expect(session.OutputToString()).To(BeEmpty(), "podman-build-secret path leaked into image")
121+
122+
podmanTest.PodmanExitCleanly("rmi", image)
121123
})
122124

123-
It("podman build with a secret from file and verify if secret file is not leaked into image", func() {
124-
session := podmanTest.Podman([]string{"build", "-f", "build/secret-verify-leak/Containerfile.with-secret-verify-leak", "-t", "secret-test-leak", "--secret", "id=mysecret,src=build/secret.txt", "build/secret-verify-leak"})
125-
session.WaitWithDefaultTimeout()
126-
Expect(session).Should(ExitCleanly())
127-
Expect(session.OutputToString()).To(ContainSubstring("somesecret"))
125+
It("podman build with a secret from env", func() {
126+
secret := "somesecretvalue"
127+
GinkgoT().Setenv("MYSECRET", secret)
128+
image := "secret-test"
128129

129-
session = podmanTest.Podman([]string{"run", "--rm", "secret-test-leak", "ls"})
130-
session.WaitWithDefaultTimeout()
131-
Expect(session).Should(ExitCleanly())
132-
Expect(session.OutputToString()).To(Not(ContainSubstring("podman-build-secret")))
130+
session := podmanTest.PodmanExitCleanly("build", "-f", "build/Containerfile.with-secret", "-t", image, "--secret", "id=mysecret,env=MYSECRET", "build/")
131+
Expect(session.OutputToString()).To(ContainSubstring(secret))
133132

134-
session = podmanTest.Podman([]string{"rmi", "secret-test-leak"})
135-
session.WaitWithDefaultTimeout()
136-
Expect(session).Should(ExitCleanly())
137-
})
133+
session = podmanTest.PodmanExitCleanly("run", "--rm", image, "sh", "-c", `find / -name 'podman-build-secret*' 2>/dev/null`)
134+
Expect(session.OutputToString()).To(BeEmpty(), "podman-build-secret path leaked into image")
138135

139-
It("podman remote build file secret with dockerignore that ignores all files", func() {
140-
// Test for: https://github.com/containers/podman/issues/25314
141-
session := podmanTest.PodmanExitCleanly("build", "-f", "build/remote-secret-dockerignore-star/Dockerfile", "--secret", "id=MY_SECRET,type=file,src=build/remote-secret-dockerignore-star/host-secret.txt", "build/remote-secret-dockerignore-star")
142-
Expect(session.OutputToString()).To(ContainSubstring("Super Secret"))
143-
})
136+
podmanTest.PodmanExitCleanly("rmi", image)
144137

145-
It("podman remote build env secret with COPY does not leak podman-build-secret temp files", func() {
146-
// Test for: https://github.com/containers/podman/issues/28334
147-
secret := "somesecretvalue"
148-
os.Setenv("MYSECRET", secret)
149-
defer os.Unsetenv("MYSECRET")
138+
// Test for: https://github.com/containers/podman/issues/28334 - env secrets + COPY must not add host-shaped podman-build-secret paths to the image.
139+
image = "e2e-remote-secret-copy"
150140

151-
session := podmanTest.PodmanExitCleanly("build", "-f", "build/remote-secret-copy/Dockerfile", "--secret", "id=mysecret,env=MYSECRET", "build/remote-secret-copy")
141+
session = podmanTest.PodmanExitCleanly("build", "-f", "build/remote-secret-copy/Dockerfile", "-t", image, "--secret", "id=mysecret,env=MYSECRET", "build/remote-secret-copy")
152142
Expect(session.OutputToString()).To(ContainSubstring(secret))
143+
144+
session = podmanTest.PodmanExitCleanly("run", "--rm", image, "sh", "-c", `find / -name 'podman-build-secret*' 2>/dev/null`)
145+
Expect(session.OutputToString()).To(BeEmpty(), "podman-build-secret path leaked into image")
146+
147+
podmanTest.PodmanExitCleanly("rmi", image)
153148
})
154149

155150
It("podman build with not found Containerfile or Dockerfile", func() {

0 commit comments

Comments
 (0)