378a16c357
When building images for binary type, it is expected to not install executables from untrusted sources, and gem, sensu-install, npm or pip packages for instance should come from the distro itself. This commit adds a `validate-binary-build.sh` script that checks for forbidden commands in the rendered Dockerfile templates for the binary type builds and hooks this script with the pep8 CI job. The output is just informative for now until we've fixed the culprit Dockerfiles, then we'll make the script return an error code and with the ability to fail the pep8 CI check. This should prevent unwanted commands from entering binary type Dockerfiles. Change-Id: I66e54bd18f4256cdca6c0c50626de4f975c246b8
20 lines
461 B
Bash
Executable File
20 lines
461 B
Bash
Executable File
#!/bin/bash
|
|
|
|
REAL_PATH=$(python -c "import os,sys;print(os.path.realpath('$0'))")
|
|
cd "$(dirname "$REAL_PATH")/.."
|
|
|
|
RES=0
|
|
|
|
find docker -name Dockerfile.j2 -print0 |
|
|
xargs -0 tools/validate-maintainer.sh || RES=1
|
|
|
|
find docker -name Dockerfile.j2 -print0 |
|
|
xargs -0 tools/validate-install-command.sh || RES=1
|
|
|
|
find docker -name Dockerfile.j2 -print0 |
|
|
xargs -0 tools/validate-indentation.sh || RES=1
|
|
|
|
tools/validate-binary-build.sh || RES=1
|
|
|
|
exit $RES
|