Code

Fixes from security review#2217

Code

Merged

natalieparellano merged 23 commits intomainbuildpacks/pack:mainfrom security-fixesbuildpacks/pack:security-fixesCopy head branch name to clipboardJul 17, 2024

+625-83

Commits

Commits on May 1, 2024

• Run build containers with userns=host

  Show description for 5f24b01
  natalieparellano

  committed
  5f24b01

Commits on May 2, 2024

• Use the untrusted flow when buildpacks are added to a trusted builder

  Show description for 1ab72dd
  natalieparellano

  committed
  1ab72dd

• Warn if NOT --pull-policy=always in container

  Show description for 0d0a495
  natalieparellano

  committed
  0d0a495

• Also consider buildpacks that are added from project descriptor (but exclude inline buildpacks)

  Show description for b24c122
  natalieparellano

  committed
  b24c122

• Skip WCOW failing test

  Show description for 1e7aad8
  natalieparellano

  committed
  1e7aad8

Commits on Jun 27, 2024

• Initial implementation (still has TODOs)

  Show description for 1cc1cc8
  natalieparellano

  committed
  1cc1cc8

• Resolve some TODOs

  Show description for 8e0d859
  natalieparellano

  committed
  8e0d859

Commits on Jul 1, 2024

• Launch build containers in a separate ephemeral Docker bridge network

  Show description for 10aa579
  natalieparellano

  committed
  10aa579

Commits on Jul 10, 2024

• Run build containers with security-opt field set to no-new-privileges=true

  Show description for 2049ae2
  natalieparellano

  committed
  2049ae2

• Merge branch 'security-review' into fix/untrusted-flow

  Show description for 5dbbb52
  natalieparellano

  committed
  5dbbb52

• Merge branch 'security-review' into fix/warn-container-daemon

  Show description for 456342b
  natalieparellano

  committed
  456342b

• Fix macos by not requiring real docker client for lifecycle execution unit tests

  Show description for 25f454e
  natalieparellano

  committed
  25f454e

• Merge pull request #29 from buildpacks/fix/userns

  Show description for dded2a0
  natalieparellano

  authored
  dded2a0

• Merge pull request #30 from buildpacks/fix/untrusted-flow

  Show description for 16f4932
  natalieparellano

  authored
  16f4932

• Try to fix wcow

  Show description for 98ffc46
  natalieparellano

  committed
  98ffc46

Commits on Jul 11, 2024

• Validate build image name

  Show description for 1204934
  AidanDelaney

  committed
  1204934

• Merge branch 'security-review' into feat/validate-image-name-on-daemon

  AidanDelaney

  committed
  8c60837

• Merge pull request #47 from buildpacks/feat/validate-image-name-on-daemon

  Show description for 57c0368
  AidanDelaney

  authored
  57c0368

• Merge pull request #31 from buildpacks/fix/warn-container-daemon

  Show description for 72ffc75
  natalieparellano

  authored
  72ffc75

• Merge pull request #50 from buildpacks/ephemeral-network

  Show description for c1a1382
  natalieparellano

  authored
  c1a1382

Commits on Jul 15, 2024

• Merge branch 'main' into pack-volume-key

  natalieparellano

  committed
  ba4bee8

• Log a warning (once) when PACK_VOLUME_KEY is unset and running in a container

  Show description for 331ac6d
  natalieparellano

  committed
  331ac6d

Commits on Jul 16, 2024

• Merge pull request #48 from buildpacks/pack-volume-key

  Show description for 13ca537
  natalieparellano

  authored
  13ca537