8000 Fix: do not override uid/git in buildpack builder by matejvasek · Pull Request #2819 · knative/func · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Fix: do not override uid/git in buildpack builder #2819

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 30, 2025

Conversation

matejvasek
Copy link
Contributor
@matejvasek matejvasek commented Apr 29, 2025

Zero value implies override (to root presumably),
we must set it to negative value.

I really dislike that zero value is not neutral here.

fixes: #2516

fix: error "failed to write group file" when using untrusted builder (#2516)

Zero value implies override (to root presumably),
we must set it to negative value.

Signed-off-by: Matej Vašek <mvasek@redhat.com>
@knative-prow knative-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 29, 2025
@knative-prow knative-prow bot requested review from jrangelramos and vyasgun April 29, 2025 18:23
@knative-prow knative-prow bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Apr 29, 2025
@matejvasek matejvasek requested review from matzew, gauron99 and lkingland and removed request for vyasgun April 29, 2025 18:24
@matejvasek
Copy link
Contributor Author

PTAL @lkingland @gauron99 @matzew

Copy link
codecov bot commented Apr 29, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 62.44%. Comparing base (d028013) to head (8fcf700).
Report is 25 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2819      +/-   ##
==========================================
+ Coverage   61.58%   62.44%   +0.86%     
==========================================
  Files         131      131              
  Lines       15793    15796       +3     
==========================================
+ Hits         9726     9864     +138     
+ Misses       5152     4993     -159     
- Partials      915      939      +24     
Flag Coverage Δ
e2e-test 35.36% <100.00%> (+0.02%) ⬆️
e2e-test-oncluster 33.83% <100.00%> (+1.53%) ⬆️
e2e-test-oncluster-runtime 28.15% <0.00%> (?)
e2e-test-runtime-go 25.74% <100.00%> (?)
e2e-test-runtime-node 25.10% <100.00%> (?)
e2e-test-runtime-quarkus 25.18% <100.00%> (?)
e2e-test-runtime-rust 24.69% <100.00%> (?)
e2e-test-runtime-springboot 24.73% <100.00%> (?)
e2e-test-runtime-typescript 25.18% <100.00%> (?)
integration-tests 48.63% <100.00%> (+1.82%) ⬆️
unit-tests 48.67% <100.00%> (?)
unit-tests-macos-latest ?
unit-tests-ubuntu-latest ?
unit-tests-windows-latest ?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@matejvasek
Copy link
Contributor Author

Great, so if I do this it breaks mounts.

Since we do not override uid/gid==0 we need to make mounted data less
readable to all.

Signed-off-by: Matej Vašek <mvasek@redhat.com>
Copy link
Member
@lkingland lkingland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting to a negative value seems correct here.

If we wanted to use the pointer method to have nil indicate "use the default", we could, but then we have an explosion of nil checks and airball variable declarations to deal with.

@knative-prow knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Apr 30, 2025
Copy link
knative-prow bot commented Apr 30, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lkingland, matejvasek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [lkingland,matejvasek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prow knative-prow bot merged commit 4166671 into knative:main Apr 30, 2025
40 checks passed
@gauron99
Copy link
Contributor

/cherry-pick release-1.18

@knative-prow-robot
Copy link

@gauron99: new pull request created: #2822

In response to this:

/cherry-pick release-1.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

func can't build with untrusted builder image
4 participants
0