Use trusted binary or build from source #114
Conversation
This commit changes the build process to either consume binaries from a trusted party, i.e. registry.redhat.io, or build the binary directly from source otherwise. This approach allows us to stay up to date with automation such as renovate or dependabot. For the binaries built from source, we can also update transitivie dependencies individually if needed. Since building from source requires a newer version of Go than what is officially released by Red Hat, the internal image from brew.registry.redhat.io is used instead. Signed-off-by: Luiz Carvalho <[email protected]>
|
Need to generate and add a token for brew.registry.redhat.io in the Konflux tenant. I'll do that once the token creation service is back online 😅 |
|
/retest |
|
@chmeliik, @mmorhun, @tnevrlka, @simonbaird, wdyt? This completely removes the need of downloading binaries from GitHub. |
|
|
||
| RUN \ | ||
| cd tools/yq && \ | ||
| go install -trimpath --mod=readonly github.com/mikefarah/yq/v4 && \ |
There was a problem hiding this comment.
Just for my information, what does -trimpath do? (I did find the description, but I'm still not sure what it actually does here)
-trimpath
remove all file system paths from the resulting executable.
Instead of absolute file system paths, the recorded file names
will begin either a module path@version (when using modules),
or a plain import path (when using the standard library, or GOPATH).
There was a problem hiding this comment.
So someone inspecting the binary doesn't see the actual directory in which the go binary was built in.:
🐚 mkdir /tmp/no-trimpath
🐚 mkdir /tmp/with-trimpath
🐚 GOBIN=/tmp/with-trimpath go install -trimpath --mod=readonly github.com/mikefarah/yq/v4
🐚 GOBIN=/tmp/no-trimpath go install --mod=readonly github.com/mikefarah/yq/v4
🐚 strings /tmp/with-trimpath/yq | grep lucarval | head
<no output>
🐚 strings /tmp/no-trimpath/yq | grep lucarval | head
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/cpu/cpu.go
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/cpu/cpu_x86.go
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/cpu/cpu_x86.s
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/bytealg/count_native.go
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/bytealg/index_amd64.go
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/bytealg/compare_amd64.s
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/bytealg/count_amd64.s
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/bytealg/equal_amd64.s
/home/lucarval/gocode/pkg/mod/golang.org/[email protected]/src/internal/bytealg/index_amd64.s
|
|
||
| go 1.23.0 | ||
|
|
||
| require github.com/anchore/syft v1.14.2 |
There was a problem hiding this comment.
I think this version of Syft may have CVEs in dependencies, we recently had to update rh-syft because of it.
Konflux isn't catching those?
There was a problem hiding this comment.
It is not. I used the same version that was here before to avoid any change in behavior. Let's merge this and I'll follow up with an update.
This commit changes the build process to either consume binaries from a trusted party, i.e. registry.redhat.io, or build the binary directly from source otherwise.
This approach allows us to stay up to date with automation such as renovate or dependabot. For the binaries built from source, we can also update transitivie dependencies individually if needed.
Since building from source requires a newer version of Go than what is officially released by Red Hat, the internal image from brew.registry.redhat.io is used instead.