When git runs as root under sudo it consults SUDO_UID to decide whether a
repository's ownership can be trusted, additionally granting access to
repositories owned by the user who invoked sudo. GitCLI builds a
restricted environment for the git subprocess and did not forward
SUDO_UID, so commands such as `sudo docker build` tripped git's "detected
dubious ownership" check and silently lost commit provenance: the build
still succeeds but prints "current commit information was not captured by
the build".
Forward SUDO_UID (only when present) on the host git config path enabled
via WithHostGitConfig, i.e. client-side local git inspection. The default
isolated path used by daemon-side callers is left untouched so it does not
pick up host environment. This matches git's own default behavior under
sudo: it does not disable safe.directory checks and is not equivalent to
safe.directory=*; it merely lets git trust repositories owned by the
invoking user. Only SUDO_UID is forwarded (git's ownership check is
uid-based and never consults SUDO_GID).
Fixes the root cause for docker/buildx#3855. buildx inspects the build
context through this GitCLI with WithHostGitConfig enabled, so buildx
picks the fix up via a moby/buildkit dependency bump with no buildx-side
code change.
Signed-off-by: MohammadHasan Akbari <jarqvi.jarqvi@gmail.com>
Normalize Git subdir fragments and validate checkout subdir components
so each segment must be a real directory, preventing traversal and symlink escapes.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 8c994eb561a2646b35352e5663afecd225306214)
Add detached PGP verification for HTTP sources during metadata resolution
and expose LLB options/caps/attrs for signature validation.
Extract shared OpenPGP verification/parsing logic into util/pgpsign and
reuse it from git signing, plus add integration and source-level tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Current RejectExpiredKeys didn't work as CheckDetachedSignature
validates expiration date internally.
It looks like go-crypto library does not allow signature checks
with completely ignoring exipration times (as Github UI allows
for example). With this change we allow (option for) keys to be expired,
but the signature creation time can not be after key expiry.
If we would set the reference time to the key creation time
that would cause a different error where validation would not work
because signatures are created in future.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
The `ParseGitRef` function was only used in `frontend/{dockerfile, dockerui}`,
expect a single occurrence in `solver/llbsolver/history.go`.
The occurrence in `solver/llbsolver/history.go` now uses
`util/gitutil/git_url.go:ParseURL()`.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Update to containerd 1.7.18, which now migrated to the errdefs module. The
existing errdefs package is now an alias for the module, and should no longer
be used directly.
This patch:
- updates the containerd dependency: https://github.com/containerd/containerd/compare/v1.7.17...v1.7.18
- replaces uses of the old package in favor of the new module
- adds a linter check to prevent accidental re-introduction of the old package
- adds a linter check to enforce using an alias, to prevent accidental use
of the errdefs package in BuildKit or Moby.
- adds a linter check to prevent using the "log" package, which was also
migrated to a separate module.
There are still some uses of the old package in (indirect) dependencies,
which should go away over time.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
During git refactoring, git refs accidentally became significantly
broader in definition - specifically, files like "foo.bar/test.git" - is
this a git repo at "foo.bar", or a local git directory?
We need to restrict this a lot more, previously, we only did this clever
conversion for the "github.com" prefix. This restores this previous
behavior.
Signed-off-by: Justin Chadwell <me@jedevc.com>
URLs that look like `./path/to/file` and `../path/to/file` definitely
aren't git URLs - so we should bail out early.
This was causing a weird issue where if you copied `./.git` this would
be detected as a valid url parsing with `host = "."` and `path = "/git"`.
The fix for this is to make sure that for these explicit file-like
paths, we *never* parse them as url-refs.
Also some tests to make sure this doesn't break again!
Signed-off-by: Justin Chadwell <me@jedevc.com>
This resolves a regression introduced in
50e75e3565. In this previous patch, I'd
incorrectly assumed that scp-like URLs can express a subset of
"standard"-URLs and so we can always safely convert them for
consistency. This isn't true - the URL "git@example.com:foo" should be
resolved to the home directory of the host, however, the converted URL
"ssh://git@example.com/foo" will be resolved to the root of the host.
To resolve this, we need to not perform this conversion. However, we
also need preserve the behaviour of firm distinction between SCP and
normal URL types (so as to keep proper port parsing).
To do this, we add a new GitURL type to the gitutil package. This new
type contains all useful fields shared in common between the standard
libraries url package and our custom scp-style url parsing package. This
keeps the previous property of a single clean interface to all GitURLs,
while also ensuring that we preserve the original URL to pass to the Git
CLI (making sure we strip fragments out, which are used as
buildkit-level metadata).
As a side-effect of this, the client-side calling code for parsing
git urls is simplified (so we don't have to do fragment wrangling at
every call point).
Signed-off-by: Justin Chadwell <me@jedevc.com>
Move all of the git command line logic into a single object, inspired by
the object already in buildx.
The basic implemenation allows for configuring a git cli for a specific
repository, along with various authorization settings and custom
binaries. Commands can be run for that repository, and a few helpers are
provided for accessing data on it - more to come in the future
hopefully.
Signed-off-by: Justin Chadwell <me@jedevc.com>
- the git protocol detection is required by buildx, and should reside in
a seperate exported gitutil package.
Signed-off-by: Alex Couture-Beil <alex@earthly.dev>
