Add PNC prebuild task based upon git-clone-oci-ta #1819
Conversation
| - prepare | ||
| - --build-tool-version=$(params.BUILD_TOOL_VERSION) | ||
| - --java-version=$(params.JAVA_VERSION) | ||
| - --recipe-image=$(params.RECIPE_IMAGE) | ||
| - --tooling-image=$(params.PNC_KONFLUX_TOOLING_IMAGE) | ||
| - --type=$(params.BUILD_TOOL) | ||
| - /var/workdir/source |
There was a problem hiding this comment.
This is a very opaque command. It isn'y clear what this actually does to the source especially since it is running with full access to the internet. I don't know how we would be able to qualify/verify our trust in the changes made here.
There was a problem hiding this comment.
Admittedly this command does not need network access and is similar to what we would need if KONFLUX-4903 was available. It runs java code to preprocess the source to ensure its possible to build it inside a container from https://github.com/project-ncl/konflux-tooling and is only meant to be used by middleware/pnc. Is one of the main concerns because the language is not in shell scripting?
There was a problem hiding this comment.
If the concern is full internet access we can probably run it within "unshare" but I believe it's a matter of trusting the application, that it rally does what it should?
There was a problem hiding this comment.
If it doesn't need internet access, I'd restrict it.
There was a problem hiding this comment.
@mmorhun Are you saying this is your only objection before approval? That tooling image does not currently have unshare installed so we would have to modify the image I suppose.
As middleware (PNC) need to preprocess the source in order to prepare it for building within a container an extra step is required for the PNC custom pipeline