fix(config,sbom): address multi-review risks

Apply fixes for 7 risks surfaced by the multi-role review:

- #1 (HIGH) buildResolvers() sorts by inputType before returning —
  deterministic resolver order across process restarts. Prevents flaky
  tests and non-reproducible SBOM output ordering.
  + regression tests: 'deterministic order across invocations' and
    'orders by inputType alphabetically'.

- #2 (HIGH) Ecosystems() returns maps.Clone(ecosystems) instead of the
  package-level map — defensive copy prevents accidental global mutation
  by callers.

- #3 (MEDIUM) pip install --no-cache-dir -r <spec> — standard Docker
  practice, prevents pip cache layer bloat in build images.

- #4 (MEDIUM) e2e pip fixture now uses short alias 'type: pip' (matches
  the exact user path from Kaiten 65682576). Previously covered only by
  unit tests; now e2e validates alias → canonical → install → SBOM.

- #5 (MEDIUM) fillFileBasedSpec rejects 'lock:' for ecosystems without
  lock semantics (pip) with 'lock is not supported for type %q'. Silent
  accept would confuse users about reproducibility guarantees.
  + failure test entry.

- #8 (MEDIUM) InstallCmd uses %q instead of %s for workdir/spec — shell-
  quotes values against injection. Defensive coding: values currently
  come from controlled werf.yaml, but template rendering ({{ env }})
  widens the attack surface.

- #11 (LOW) Drop redundant 'eco := eco' loop capture (Go 1.24 uses per-
  iteration binding natively).

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

Author: reyreavman

pkg/build/stage/packages_test.go

@@ -24,7 +24,7 @@ var _ = Describe("PackagesStage", func() {
 		)
 
 		It("returns stage when packages commands present", func(ctx context.Context) {
-			stage := generateTestPackagesStage(ctx, "cd /app && go mod download")
+			stage := generateTestPackagesStage(ctx, "cd \"/app\" && go mod download")
 			Expect(stage).NotTo(BeNil())
 		})
 	})
@@ -42,7 +42,7 @@ var _ = Describe("PackagesStage", func() {
 	)
 
 	It("Name returns packages", func(ctx context.Context) {
-		stage := generateTestPackagesStage(ctx, "cd /app && go mod download")
+		stage := generateTestPackagesStage(ctx, "cd \"/app\" && go mod download")
 		Expect(stage.Name()).To(Equal(Packages))
 	})
 
@@ -67,21 +67,21 @@ var _ = Describe("PackagesStage", func() {
 			},
 
 			Entry("same commands produce same hash",
-				[]string{"cd /app && go mod download"},
-				[]string{"cd /app && go mod download"},
+				[]string{"cd \"/app\" && go mod download"},
+				[]string{"cd \"/app\" && go mod download"},
 				true),
 			Entry("different commands produce different hash",
-				[]string{"cd /app && go mod download"},
-				[]string{"cd /lib && go mod download"},
+				[]string{"cd \"/app\" && go mod download"},
+				[]string{"cd \"/lib\" && go mod download"},
 				false),
 			Entry("different number of commands produce different hash",
-				[]string{"cd /app && go mod download"},
-				[]string{"cd /app && go mod download", "cd /lib && go mod download"},
+				[]string{"cd \"/app\" && go mod download"},
+				[]string{"cd \"/app\" && go mod download", "cd \"/lib\" && go mod download"},
 				false),
 		)
 
 		It("returns non-empty hash", func(ctx context.Context) {
-			s := generateTestPackagesStage(ctx, "cd /app && go mod download")
+			s := generateTestPackagesStage(ctx, "cd \"/app\" && go mod download")
 			digest, err := s.GetDependencies(ctx, testConveyor(), nil, nil, nil, nil)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(digest).NotTo(BeEmpty())
@@ -92,7 +92,7 @@ var _ = Describe("PackagesStage", func() {
 		It("does not affect install stage creation", func(ctx context.Context) {
 			imageBaseConfig := &config.StapelImageBase{
 				Shell: &config.Shell{
-					Packages: []string{"cd /app && go mod download"},
+					Packages: []string{"cd \"/app\" && go mod download"},
 					Install:  []string{"go build ./..."},
 				},
 			}
@@ -158,20 +158,20 @@ var _ = Describe("GeneratePackagesCommands", func() {
 
 		Entry("go-mod /app", []*config.PackagesDirective{
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/app"}},
-		}, []string{"cd /app && go mod download"}),
+		}, []string{"cd \"/app\" && go mod download"}),
 
 		Entry("go-mod /src/backend", []*config.PackagesDirective{
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/src/backend"}},
-		}, []string{"cd /src/backend && go mod download"}),
+		}, []string{"cd \"/src/backend\" && go mod download"}),
 
 		Entry("multiple go-mod entries", []*config.PackagesDirective{
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/app"}},
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/lib"}},
-		}, []string{"cd /app && go mod download", "cd /lib && go mod download"}),
+		}, []string{"cd \"/app\" && go mod download", "cd \"/lib\" && go mod download"}),
 
 		Entry("root workdir", []*config.PackagesDirective{
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/"}},
-		}, []string{"cd / && go mod download"}),
+		}, []string{"cd \"/\" && go mod download"}),
 
 		Entry("unsupported type", []*config.PackagesDirective{
 			{Type: config.PackagesDirectiveType("unknown")},
@@ -191,28 +191,28 @@ var _ = Describe("GeneratePackagesCommands", func() {
 			{Type: config.PackagesDirectiveTypeOSPM, Spec: config.PackagesSpec{Packages: []string{"curl"}}},
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/app"}},
 			{Type: config.PackagesDirectiveType("cargo")},
-		}, []string{"pm install curl", "cd /app && go mod download"}),
+		}, []string{"pm install curl", "cd \"/app\" && go mod download"}),
 
 		Entry("python-pip /app requirements.txt", []*config.PackagesDirective{
 			{
 				Type:      config.PackagesDirectiveTypePythonPip,
 				FileBased: config.FileBasedSpec{Workdir: "/app", Spec: "requirements.txt"},
 			},
-		}, []string{"cd /app && pip install -r requirements.txt"}),
+		}, []string{"cd \"/app\" && pip install --no-cache-dir -r \"requirements.txt\""}),
 
 		Entry("python-poetry /svc", []*config.PackagesDirective{
 			{
 				Type:      config.PackagesDirectiveTypePythonPoetry,
 				FileBased: config.FileBasedSpec{Workdir: "/svc"},
 			},
-		}, []string{"cd /svc && poetry install --no-root"}),
+		}, []string{"cd \"/svc\" && poetry install --no-root"}),
 
 		Entry("python-uv /api", []*config.PackagesDirective{
 			{
 				Type:      config.PackagesDirectiveTypePythonUV,
 				FileBased: config.FileBasedSpec{Workdir: "/api"},
 			},
-		}, []string{"cd /api && uv sync --frozen"}),
+		}, []string{"cd \"/api\" && uv sync --frozen"}),
 
 		Entry("mixed: go-mod + python-uv + os-pm all produce commands", []*config.PackagesDirective{
 			{Type: config.PackagesDirectiveTypeGoMod, FileBased: config.FileBasedSpec{Workdir: "/app"}},
@@ -221,7 +221,7 @@ var _ = Describe("GeneratePackagesCommands", func() {
 				FileBased: config.FileBasedSpec{Workdir: "/lib"},
 			},
 			{Type: config.PackagesDirectiveTypeOSPM, Spec: config.PackagesSpec{Packages: []string{"curl"}}},
-		}, []string{"cd /app && go mod download", "cd /lib && uv sync --frozen", "pm install curl"}),
+		}, []string{"cd \"/app\" && go mod download", "cd \"/lib\" && uv sync --frozen", "pm install curl"}),
 	)
 })
 
@@ -258,7 +258,7 @@ var _ = Describe("Shell.Packages config field", func() {
 			}
 		},
 
-		Entry("populated", &config.Shell{Packages: []string{"cd /app && go mod download"}}, 1, "cd /app && go mod download"),
+		Entry("populated", &config.Shell{Packages: []string{"cd \"/app\" && go mod download"}}, 1, "cd \"/app\" && go mod download"),
 		Entry("empty", &config.Shell{}, 0, ""),
 	)
 
@@ -290,12 +290,12 @@ var _ = Describe("Builder interface Packages methods", func() {
 		},
 
 		Entry("same commands — same checksum",
-			[]string{"cd /app && go mod download"},
-			[]string{"cd /app && go mod download"},
+			[]string{"cd \"/app\" && go mod download"},
+			[]string{"cd \"/app\" && go mod download"},
 			true),
 		Entry("different commands — different checksum",
-			[]string{"cd /app && go mod download"},
-			[]string{"cd /lib && go mod download"},
+			[]string{"cd \"/app\" && go mod download"},
+			[]string{"cd \"/lib\" && go mod download"},
 			false),
 	)
 

pkg/config/packages_directive.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"fmt"
+	"maps"
 	"sort"
 )
 
@@ -39,31 +40,33 @@ var ecosystems = map[PackagesDirectiveType]PackageEcosystem{
 		Type:          PackagesDirectiveTypeGoMod,
 		DefaultSpec:   "go.mod",
 		DefaultLock:   "go.sum",
-		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %s && go mod download", workdir) },
+		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %q && go mod download", workdir) },
 		CatalogerName: "go-module-file-cataloger",
 	},
 	PackagesDirectiveTypePythonUV: {
 		Type:          PackagesDirectiveTypePythonUV,
 		Aliases:       []string{"uv"},
 		DefaultSpec:   "pyproject.toml",
 		DefaultLock:   "uv.lock",
-		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %s && uv sync --frozen", workdir) },
+		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %q && uv sync --frozen", workdir) },
 		CatalogerName: "python-package-cataloger",
 	},
 	PackagesDirectiveTypePythonPip: {
-		Type:          PackagesDirectiveTypePythonPip,
-		Aliases:       []string{"pip"},
-		DefaultSpec:   "requirements.txt",
-		DefaultLock:   "",
-		InstallCmd:    func(workdir, spec string) string { return fmt.Sprintf("cd %s && pip install -r %s", workdir, spec) },
+		Type:        PackagesDirectiveTypePythonPip,
+		Aliases:     []string{"pip"},
+		DefaultSpec: "requirements.txt",
+		DefaultLock: "",
+		InstallCmd: func(workdir, spec string) string {
+			return fmt.Sprintf("cd %q && pip install --no-cache-dir -r %q", workdir, spec)
+		},
 		CatalogerName: "python-package-cataloger",
 	},
 	PackagesDirectiveTypePythonPoetry: {
 		Type:          PackagesDirectiveTypePythonPoetry,
 		Aliases:       []string{"poetry"},
 		DefaultSpec:   "pyproject.toml",
 		DefaultLock:   "poetry.lock",
-		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %s && poetry install --no-root", workdir) },
+		InstallCmd:    func(workdir, _ string) string { return fmt.Sprintf("cd %q && poetry install --no-root", workdir) },
 		CatalogerName: "python-package-cataloger",
 	},
 }
@@ -78,10 +81,10 @@ var aliasToType = func() map[string]PackagesDirectiveType {
 	return idx
 }()
 
-// Ecosystems returns the registry of file-based package ecosystems.
-// The map is intended read-only; callers must not mutate entries.
+// Ecosystems returns a defensive copy of the file-based package ecosystems registry.
+// The returned map is safe to iterate; mutating it does not affect the internal registry.
 func Ecosystems() map[PackagesDirectiveType]PackageEcosystem {
-	return ecosystems
+	return maps.Clone(ecosystems)
 }
 
 type PackagesDirective struct {

pkg/config/packages_directive_python_test.go

@@ -214,5 +214,19 @@ var _ = Describe("rawPackagesDirective python", func() {
 				},
 			},
 		),
+
+		Entry("python-pip with lock field is rejected (pip has no lock semantics)",
+			map[string]interface{}{
+				"image": "image1",
+				"from":  "python:3.12",
+				"packages": []map[string]interface{}{
+					{
+						"type":    "python-pip",
+						"workdir": "/app",
+						"lock":    "requirements.lock",
+					},
+				},
+			},
+		),
 	)
 })

pkg/config/raw_packages_directive.go

@@ -107,6 +107,9 @@ func (r *rawPackagesDirective) fillFileBasedSpec(d *PackagesDirective) error {
 
 	d.FileBased.Lock = eco.DefaultLock
 	if r.Lock != "" {
+		if eco.DefaultLock == "" {
+			return fmt.Errorf("lock is not supported for type %q", d.Type)
+		}
 		d.FileBased.Lock = r.Lock
 	}
 

pkg/sbom/managedinput/managedinput.go

@@ -2,6 +2,7 @@ package managedinput
 
 import (
 	"path"
+	"slices"
 	"strings"
 
 	cdx "github.com/CycloneDX/cyclonedx-go"
@@ -20,9 +21,16 @@ type inputResolver struct {
 var resolvers = buildResolvers()
 
 func buildResolvers() []inputResolver {
-	built := make([]inputResolver, 0, len(config.Ecosystems()))
-	for _, eco := range config.Ecosystems() {
-		eco := eco
+	ecosystems := config.Ecosystems()
+	types := make([]config.PackagesDirectiveType, 0, len(ecosystems))
+	for t := range ecosystems {
+		types = append(types, t)
+	}
+	slices.Sort(types)
+
+	built := make([]inputResolver, 0, len(types))
+	for _, t := range types {
+		eco := ecosystems[t]
 		built = append(built, inputResolver{
 			inputType:     eco.Type,
 			catalogerName: eco.CatalogerName,

pkg/sbom/managedinput/managedinput_test.go

@@ -2,6 +2,7 @@ package managedinput
 
 import (
 	"fmt"
+	"sort"
 
 	cdx "github.com/CycloneDX/cyclonedx-go"
 	. "github.com/onsi/ginkgo/v2"
@@ -11,6 +12,37 @@ import (
 	"github.com/werf/werf/v2/pkg/sbom/scanner"
 )
 
+var _ = Describe("buildResolvers", func() {
+	It("returns resolvers in deterministic order across invocations", func() {
+		first := buildResolvers()
+		firstOrder := make([]config.PackagesDirectiveType, len(first))
+		for i, r := range first {
+			firstOrder[i] = r.inputType
+		}
+
+		for i := 0; i < 20; i++ {
+			next := buildResolvers()
+			nextOrder := make([]config.PackagesDirectiveType, len(next))
+			for j, r := range next {
+				nextOrder[j] = r.inputType
+			}
+			Expect(nextOrder).To(Equal(firstOrder))
+		}
+	})
+
+	It("orders resolvers by inputType alphabetically", func() {
+		built := buildResolvers()
+		order := make([]string, len(built))
+		for i, r := range built {
+			order[i] = string(r.inputType)
+		}
+		sorted := make([]string, len(order))
+		copy(sorted, order)
+		sort.Strings(sorted)
+		Expect(order).To(Equal(sorted))
+	})
+})
+
 var _ = Describe("ToCatalogers", func() {
 	DescribeTable("maps packages directives to syft catalogers",
 		func(packages []*config.PackagesDirective, expected []scanner.Cataloger) {

test/e2e/sbom/_fixtures/inject/pip_simple/werf.yaml

@@ -14,5 +14,5 @@ shell:
   install:
     - cd /app && pip install -r requirements.txt
 packages:
-  - type: python-pip
+  - type: pip
     workdir: /app