Normalize Git subdir fragments and validate checkout subdir components
so each segment must be a real directory, preventing traversal and symlink escapes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 8c994eb561a2646b35352e5663afecd225306214)
Add detached PGP verification for HTTP sources during metadata resolution
and expose LLB options/caps/attrs for signature validation.
Extract shared OpenPGP verification/parsing logic into util/pgpsign and
reuse it from git signing, plus add integration and source-level tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Current RejectExpiredKeys didn't work as CheckDetachedSignature
validates expiration date internally.
It looks like go-crypto library does not allow signature checks
with completely ignoring exipration times (as Github UI allows
for example). With this change we allow (option for) keys to be expired,
but the signature creation time can not be after key expiry.
If we would set the reference time to the key creation time
that would cause a different error where validation would not work
because signatures are created in future.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The `ParseGitRef` function was only used in `frontend/{dockerfile, dockerui}`,
expect a single occurrence in `solver/llbsolver/history.go`.
The occurrence in `solver/llbsolver/history.go` now uses
`util/gitutil/git_url.go:ParseURL()`.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Update to containerd 1.7.18, which now migrated to the errdefs module. The
existing errdefs package is now an alias for the module, and should no longer
be used directly.
This patch:
- updates the containerd dependency: https://github.com/containerd/containerd/compare/v1.7.17...v1.7.18
- replaces uses of the old package in favor of the new module
- adds a linter check to prevent accidental re-introduction of the old package
- adds a linter check to enforce using an alias, to prevent accidental use
of the errdefs package in BuildKit or Moby.
- adds a linter check to prevent using the "log" package, which was also
migrated to a separate module.
There are still some uses of the old package in (indirect) dependencies,
which should go away over time.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
During git refactoring, git refs accidentally became significantly
broader in definition - specifically, files like "foo.bar/test.git" - is
this a git repo at "foo.bar", or a local git directory?
We need to restrict this a lot more, previously, we only did this clever
conversion for the "github.com" prefix. This restores this previous
behavior.
Signed-off-by: Justin Chadwell <me@jedevc.com>
URLs that look like `./path/to/file` and `../path/to/file` definitely
aren't git URLs - so we should bail out early.
This was causing a weird issue where if you copied `./.git` this would
be detected as a valid url parsing with `host = "."` and `path = "/git"`.
The fix for this is to make sure that for these explicit file-like
paths, we *never* parse them as url-refs.
Also some tests to make sure this doesn't break again!
Signed-off-by: Justin Chadwell <me@jedevc.com>
This resolves a regression introduced in
50e75e3565. In this previous patch, I'd
incorrectly assumed that scp-like URLs can express a subset of
"standard"-URLs and so we can always safely convert them for
consistency. This isn't true - the URL "git@example.com:foo" should be
resolved to the home directory of the host, however, the converted URL
"ssh://git@example.com/foo" will be resolved to the root of the host.
To resolve this, we need to not perform this conversion. However, we
also need preserve the behaviour of firm distinction between SCP and
normal URL types (so as to keep proper port parsing).
To do this, we add a new GitURL type to the gitutil package. This new
type contains all useful fields shared in common between the standard
libraries url package and our custom scp-style url parsing package. This
keeps the previous property of a single clean interface to all GitURLs,
while also ensuring that we preserve the original URL to pass to the Git
CLI (making sure we strip fragments out, which are used as
buildkit-level metadata).
As a side-effect of this, the client-side calling code for parsing
git urls is simplified (so we don't have to do fragment wrangling at
every call point).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Move all of the git command line logic into a single object, inspired by
the object already in buildx.
The basic implemenation allows for configuring a git cli for a specific
repository, along with various authorization settings and custom
binaries. Commands can be run for that repository, and a few helpers are
provided for accessing data on it - more to come in the future
hopefully.
Signed-off-by: Justin Chadwell <me@jedevc.com>
- the git protocol detection is required by buildx, and should reside in
a seperate exported gitutil package.
Signed-off-by: Alex Couture-Beil <alex@earthly.dev>
