Skip to content

[sec-check] fix: verify SHA-256 of ponytail files in Containerfile.runner #771

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kubestellar-hive wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[sec-check] fix: verify SHA-256 of ponytail files in Containerfile.runner #771

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion container/Containerfile.runner
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,12 +83,18 @@ RUN microdnf install -y --setopt=install_weak_deps=0 gcc python3-devel \
# Install the pure-Python ponytail module (qecore imports it for input events via
# gnome-ponytail-daemon). Not on PyPI — downloaded directly from the tagged release.
ARG PONYTAIL_VERSION=0.0.11
# SHA-256 of the two files at tag 0.0.11 — tags are mutable, so verify content
# before installing into site-packages (fixes projectbluefin/testsuite#769).
ARG PONYTAIL_INIT_SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ARG PONYTAIL_PY_SHA256=e86a3ce2ae6eb0662bb26516085b6dbb2c8248ffaa8384d2789c474db67b00ff
RUN PDIR="$(python3 -c 'import site; print(site.getsitepackages()[0])')/ponytail" && \
mkdir -p "$PDIR" && \
curl -sSfL "https://gitlab.gnome.org/ofourdan/gnome-ponytail-daemon/-/raw/${PONYTAIL_VERSION}/ponytail/__init__.py" \
-o "$PDIR/__init__.py" && \
curl -sSfL "https://gitlab.gnome.org/ofourdan/gnome-ponytail-daemon/-/raw/${PONYTAIL_VERSION}/ponytail/ponytail.py" \
-o "$PDIR/ponytail.py"
-o "$PDIR/ponytail.py" && \
echo "${PONYTAIL_INIT_SHA256} $PDIR/__init__.py" | sha256sum -c - && \
echo "${PONYTAIL_PY_SHA256} $PDIR/ponytail.py" | sha256sum -c -

# Symlink qecore helpers onto PATH
RUN for f in /usr/local/bin/qecore_*; do \
Expand Down
Loading