Merge pull request #103 from steveb/pipeline-secure

Harden build pipeline: pin build-time dependencies and secure credential handling

Author: openshift-merge-bot[bot]

bootc/install-repo-setup.sh

@@ -2,9 +2,17 @@
 
 set -eux
 
+# Pin repo-setup to a specific commit on the stable branch
+# To update: change REPO_SETUP_COMMIT, download the new archive, and update REPO_SETUP_SHA256
+REPO_SETUP_COMMIT=85321f7e0af502d7f06f845886058daf09da34f6
+REPO_SETUP_SHA256=1050e4ed0472098165c4bde84a9991a6a13171426d16862f6651e28635d1727f
+
 pushd output
-curl -sL https://github.com/openstack-k8s-operators/repo-setup/archive/refs/heads/main.tar.gz | tar xvz
-pushd repo-setup-main
+curl -sL -o repo-setup.tar.gz \
+    "https://github.com/openstack-k8s-operators/repo-setup/archive/${REPO_SETUP_COMMIT}.tar.gz"
+echo "${REPO_SETUP_SHA256}  repo-setup.tar.gz" | sha256sum -c -
+tar xzf repo-setup.tar.gz
+pushd "repo-setup-${REPO_SETUP_COMMIT}"
 python3 -m venv ./venv
 source ./venv/bin/activate
 PBR_VERSION=0.0.0 python3 -m pip install ./

bootc/rhsm.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -eux
+set -eu
 
 # Edit RHSM_ values for the subscription configuration
 RHSM_USER=unset
@@ -13,8 +13,19 @@ RHSM_REPOS=${RHSM_REPOS:-"--enable=rhoso-18.0-for-rhel-${RHEL_MAJOR}-x86_64-rpms
 RHSM_POOL=""
 
 rm -f /etc/yum.repos.d/*.repo
-subscription-manager register --username=$RHSM_USER --password=$RHSM_PASSWORD
+# Disable subscription-manager container detection so that registration
+# works during container builds. subscription-manager checks for
+# /etc/rhsm-host (a symlink to ../run/secrets/rhsm) to detect
+# container mode.
+if [ -L /etc/rhsm-host ]; then
+    rm -f /etc/rhsm-host
+fi
+
+# Suppress xtrace to avoid leaking credentials to the build log
+set +x
+subscription-manager register --username="$RHSM_USER" --password="$RHSM_PASSWORD"
+set -x
 if [ -n "${RHSM_POOL}" ]; then
-    subscription-manager attach --pool=$RHSM_POOL
+    subscription-manager attach --pool="$RHSM_POOL"
 fi
 subscription-manager repos $RHSM_REPOS

dib/repo-setup/pre-install.d/00-03-repo-setup

@@ -9,10 +9,16 @@ if [ -n "${DIB_YUM_REPO_CONF:-}" ] ; then
     exit 0
 fi
 
-# Install latest version of repo-setup without installing pip or git
+# Install repo-setup pinned to a specific commit on the stable branch
+# To update: change REPO_SETUP_COMMIT, download the new archive, and update REPO_SETUP_SHA256
+REPO_SETUP_COMMIT=85321f7e0af502d7f06f845886058daf09da34f6
+REPO_SETUP_SHA256=1050e4ed0472098165c4bde84a9991a6a13171426d16862f6651e28635d1727f
 cd /tmp
-curl -sL https://github.com/openstack-k8s-operators/repo-setup/archive/refs/heads/main.tar.gz | tar xvz
-cd repo-setup-main
+curl -sL -o repo-setup.tar.gz \
+    "https://github.com/openstack-k8s-operators/repo-setup/archive/${REPO_SETUP_COMMIT}.tar.gz"
+echo "${REPO_SETUP_SHA256}  repo-setup.tar.gz" | sha256sum -c -
+tar xzf repo-setup.tar.gz
+cd "repo-setup-${REPO_SETUP_COMMIT}"
 python3 -m venv ./venv
 source ./venv/bin/activate
 PBR_VERSION=0.0.0 python3 -m pip install ./