xCAT/xcat-dep
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-dep.git synced 2026-09-12 12:36:23 +00:00
Code Issues Projects Releases Wiki Activity

fix(build): --verify-repo must assert the repomd signature; abs-path the re-exec

Browse Source 
Two review follow-ups to the EL matrix build:

1. Standalone --verify-repo silently PASSED the signature check when no
   --gpg-key-name/--gpg-home was configured, contradicting its documented
   contract (it advertises a signature assertion). verify_target_repo now
   takes a sig_required flag, set for the standalone mode, so a missing
   signing identity is a loud SIGKEY failure instead of a false pass. The
   pipeline auto-runs are unaffected (they always pass --gpg-sign).

2. The mount-namespace re-exec used a bare $0, which the re-exec'd perl
   could fail to find if the script was invoked via a $PATH name from a
   different cwd (exec succeeds, so the unisolated fallback never runs and
   the build dies hard). Resolve $0 to an absolute path first.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This commit is contained in:
Daniel Hilst
2026-08-13 10:05:09 -03:00
parent 9bf3f7ad22
commit 6e51366cef
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mockbuild-all.pl
+12 -3
View File
@@ -40,7 +40,10 @@ unless ($ENV{MOCKBUILD_ALL_MOUNTNS}) {
. "may unmount the host /sys/fs/cgroup on a shared-propagation host\n";
} else {
$ENV{MOCKBUILD_ALL_MOUNTNS} = 1;
my @reexec = ('unshare', '--mount', '--propagation', 'slave', '--', $^X, $0, @ARGV);
# Absolute path to self so the re-exec'd perl finds the script regardless of cwd or a bare
# $PATH invocation (unshare does not change cwd, but $0 may be relative or a bare name).
my $self = abs_path($0) // $0;
my @reexec = ('unshare', '--mount', '--propagation', 'slave', '--', $^X, $self, @ARGV);
exec { $reexec[0] } @reexec;
# exec only returns on failure -- fall through and run unisolated rather than abort the build.
warn "WARN: exec unshare failed ($!) -- continuing without mount-namespace isolation\n";
@@ -180,7 +183,9 @@ if ($verify_repo ne '') {
my $tgt = $target ne '' ? $target : derive_target_from_repo_path($rdir);
die "--verify-repo: cannot derive a target from repo path '$rdir'; pass --target\n"
if !defined($tgt) || $tgt eq '';
verify_target_repo($rdir, $tgt); # manifest defaults to repo_root/packages-manifest.conf
# sig_required=1: a standalone verify MUST assert the repomd signature (its documented contract),
# never silently skip it when no gpg key/home is configured (that would be a false PASS on sigs).
verify_target_repo($rdir, $tgt, undef, 1); # manifest defaults to repo_root/packages-manifest.conf
exit 0;
}
@@ -1217,7 +1222,7 @@ sub repomd_observed_signer {
# problem. Both the automatic post-build gate (deploy_target) and the standalone --verify-repo mode
# call this, so there is exactly one gate implementation.
sub verify_target_repo {
my ($dir, $tgt, $manifest) = @_;
my ($dir, $tgt, $manifest, $sig_required) = @_;
$manifest //= "$repo_root/packages-manifest.conf";
my %MAN = read_manifest($manifest);
my %req = %{ $MAN{$tgt} // {} };
@@ -1247,6 +1252,10 @@ sub verify_target_repo {
my %obs_sig = ('repomd' => repomd_observed_signer($asc, $repomd, $gpg_home));
push @problems, verify_repo_signature(\%exp_sig, \%obs_sig);
}
} elsif ($sig_required) {
# Standalone --verify-repo advertises a signature check; with no keyring we cannot resolve the
# CLI key or read the signer, so refuse rather than silently pass (which would be a false PASS).
push @problems, "SIGKEY: --verify-repo requires --gpg-key-name + --gpg-home to check the repomd signature (none configured)";
} else {
print "[verify-repo] $tgt: no gpg key/home configured -- skipping repomd signature check\n";
}