Repository navigation
build: keep test certificate fixtures out of the images - #979
Conversation
`COPY ./packages` put the trust-store test's fixture, which holds the compromised eMudhra certificates, in every client and server image, where an image scanner looking for those certificates finds it. Nothing loads it as a trust anchor, and the wheels never had it. The fixture stays in git for the test; only the Docker build context drops it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for opal-docs canceled.
|
EliMoshkovich
left a comment
EliMoshkovich
left a comment
There was a problem hiding this comment.
Deep review: not ready to merge (one HIGH finding). This would be REQUEST_CHANGES, but GitHub doesn't let an author request changes on their own PR.
HIGH: the new pattern doesn't reach any image that CI or the release builds. None of the docker/build-push-action steps in tests.yml or on_release.yml set context:, so the action builds from its default Git context. BuildKit applies .dockerignore only to a local context. With a Git context, MainContext in frontend/dockerui/config.go returns the cloned tree without any exclude patterns. Evidence:
- This PR's own E2E jobs log
load git source https://github.com/permitio/opal.git#refs/pull/979/merge, and so does everypublish_docker_imagesjob of the 0.9.10-rc.2 release. permitio/opal-server:0.9.10-rc.2was built from the #978 merge, which has the same.dockerignoreline, and it still contains/opal/packages/opal-common/opal_common/tests/emudhra_compromised_cas.pem.- I built
COPY ./packagesfrom this PR's head (b9583e9) twice. From a local path the.pemis gone. Fromhttps://github.com/permitio/opal.git#b9583e94…it is still there.
The verification in the description used a local-path build (make / docker build .), which is why it passed.
Suggested fix (works with both context types): exclude the fixture in the Dockerfile itself, at both COPY ./packages ./packages/ lines (common and common-alpine):
# syntax=docker/dockerfile:1.19 # first line; --exclude is stable from 1.19 (1.17/1.18 reject it)
...
COPY --exclude=**/tests/*.pem ./packages ./packages/I checked this from the Git context at b9583e9: no .pem, and the other 19 files in the tests directory are still copied. The .dockerignore line can stay for local builds. Deleting the file in a later RUN rm is not a fix, because the COPY layer would still hold it. An alternative is to add context: . to every build step, but that also brings the rest of .dockerignore and the release's __packaging__.py version stamp into the images (rc.2 currently ships __version__ = VERSION_STRING), so it's a bigger change than this PR needs.
It would be worth adding a check that fails CI if any *.pem is under /opal/packages in the built images, since this kind of regression is silent.
Follow-up: the release/0.9.x backport (#978, already merged) has the same no-op line, so 0.9.10-rc.2 ships the fixture. It needs the same Dockerfile change before 0.9.10 final.
Nothing else in the diff is a problem. The ** pattern is valid .dockerignore syntax, docker/Dockerfile.dockerignore doesn't exist, so the root file would apply to a local build, and the fixture is the only .pem under packages/.
… the images CI and the release build with docker/build-push-action's default Git context, and BuildKit applies .dockerignore only to a local context, so the .dockerignore rule kept the trust-store test's fixture out of local builds but not out of any image CI or a release produces. The Dockerfile now excludes it at both COPY ./packages lines with COPY --exclude, which needs the dockerfile 1.19 frontend (# syntax line). Both E2E jobs check the client and server images for any .pem under /opal/packages, after checking the find sees the test files. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ters The syntax line now pins docker/dockerfile:1.19 by digest, so a moved tag can't change the frontend that builds every image. The comments now give the real reason to keep the trust-store test's fixture out: a search of an image's files for the compromised certificates reports it, although nothing trusts it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…to 0.9.x) (#980) Backport of #979. The trust-store test's fixture holds the compromised eMudhra certificates (CVE-2026-111943). #978's .dockerignore rule doesn't apply to the Git context CI and the release build from, so docker/Dockerfile now uses COPY --exclude=**/tests/*.pem (dockerfile frontend 1.19, pinned by digest), .dockerignore keeps the rule for local builds, and both E2E jobs fail if any .pem is under /opal/packages in the images. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fixes Issue
Follow-up to #974, from review on #978 (its 0.9.x backport).
docker/DockerfilerunsCOPY ./packages ./packages/, so the trust-store test's fixturepackages/opal-common/opal_common/tests/emudhra_compromised_cas.pemends up in every client and server image. The fixture holds the compromised eMudhra certificates (CVE-2026-111943). Nothing loads it as a trust anchor and it isn't in the wheels, so it's not a vulnerability. But the published detection guidance for this CVE searches an image's whole filesystem for those certificates by fingerprint, and it reports this file as affected in exactly the images #974 fixed.Changes proposed
docker/Dockerfile:COPY --exclude=**/tests/*.pem ./packages ./packages/in thecommonandcommon-alpinestages..dockerignorealone isn't enough: CI and the release build withdocker/build-push-action's default Git context, and BuildKit doesn't apply.dockerignoreto a Git context.--excludeneeds dockerfile frontend 1.19 or later, so the first line is# syntax=docker/dockerfile:1.19, pinned by digest..dockerignore: the same pattern, for local builds.tests.yml: both E2E jobs fail if any*.pemis under/opal/packagesin the client or server image. The check first confirms it can see the test modules, so it can't pass by seeing nothing.The fixture stays in git, so the test still finds it.
Verification
.pemin any of the four images, the other test files still copied, and/opal/check_trust_store.pypasses. As a control, the published0.9.10-rc.2images still contain the fixture..pemin all four images.DOCKER_BUILDKIT=0 docker build --target commonstill builds and leaves the fixture out.Check List (Check all the applicable boxes)
🤖 Generated with Claude Code