Sandbox/rebase/3.0.20250822 3.0 v3#479
Closed
cheeyanglee wants to merge 245 commits intoopen-edge-platform:3.0from
Closed
Sandbox/rebase/3.0.20250822 3.0 v3#479cheeyanglee wants to merge 245 commits intoopen-edge-platform:3.0from
cheeyanglee wants to merge 245 commits intoopen-edge-platform:3.0from
Conversation
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
…I rubygem-introspection rubygem-metaclass) (#13849)
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
…dev (#13887) Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>
Co-authored-by: kavyasree <kkaitepalli@microsoft.com>
…645) Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com> Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
…ase nb (#13921) Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>
CVE-2024-49761 - branch 3.0-dev (#13908) Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
…- branch 3.0-dev (#13909) Signed-off-by: Mayank Singh <mayansingh@microsoft.com> Co-authored-by: mayankfz <mayankfz@gmail.com> Co-authored-by: Mayank Singh <mayansingh@microsoft.com> Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
…nd) (#13898) Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>
…dev (#13929) Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>
…y (#13466) Co-authored-by: Andrew Phelps <anphel@microsoft.com> Co-authored-by: Andrew Phelps <anphel31@users.noreply.github.com>
…[HIGH] - branch 3.0-dev (#14495) Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kevin Lockwood <57274670+kevin-b-lockwood@users.noreply.github.com> Co-authored-by: Kevin Lockwood <v-klockwood@microsoft.com>
We will have multiple flavors of OS Guard, each with minor tweaks. To easily support this, define a common base OS Guard yaml template and a delta yaml template that does minor adjustments to the base template. Additionally introduce a python script to merge arbitrary image customizer yamls together. This python script also adds a header to the final output yaml to indicate the file was autogenerated and provides the input source files. Finally, introduce a bash script to specifically generate the OS Guard final yaml configs. Signed-off-by: Chris Co <chrco@microsoft.com>
Fix warning from %post and %postun in sdbus-cpp.spec install: Installing/Updating: sdbus-cpp-1.3.0-1.azl3.x86_64 /var/tmp/rpm-tmp.XgB0E8: line 1: -p: command not found warning: %post(sdbus-cpp-1.3.0-1.azl3.x86_64) scriptlet failed, exit status 127 package sdbus-cpp-1.3.0-1.azl3.x86_64: script warning in %postin uninstall: Removing: sdbus-cpp-1.3.0-1.azl3.x86_64 /var/tmp/rpm-tmp.nFgDZW: line 1: -p: command not found warning: %postun(sdbus-cpp-1.3.0-1.azl3.x86_64) scriptlet failed, exit status 127 package sdbus-cpp-1.3.0-1.azl3.x86_64: script warning in %postun remove newlines to allow -p /sbin/ldconfig to work as intended for %post and %postun
Internal Microsoft policy requires us to not use NewDefaultAzureCredential when logging into Azure. In all cases where we used the default method in our builds we relied on Azure CLI credentials, thus the switch to NewAzureCLICredential. For more information see the AzureCLICredential docs. The change also has minor Go linting clean-up.
This PR updates systemd to build systemd-ukify and systemd-boot for both ARM64 architecture as well as the original x86_64 architecture It also includes pyflakes to resolve ukify test error during package testing. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> Co-authored-by: Chris Co <chrco@microsoft.com>
Since we are now generating osguard configurations from templates, there is a possibility the template changes get out-of-sync with what is committed. Add github action check to verify osguard config generation from templates always match the config present in the default location, otherwise fail to block PR. Signed-off-by: Chris Co <chrco@microsoft.com>
Remove duplicate veritysetup entry. Remove commented-out packages. Create an selinux-ci-uki.semanage in osguard files and reference file from new location. Signed-off-by: Chris Co <chrco@microsoft.com>
…H] - branch 3.0-dev (#14523) Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: kgodara912 <kshigodara@outlook.com> Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
…VE-2025-8714, CVE-2025-8715, CVE-2025-8713 - branch 3.0-dev (#14538)
…ux and IPE lockout module (#14546) tardev-snapshotter is not present or used in our linuxguard / osguard images. So remove SELinux label for it. Also enable azureci_prod SELinux module to prevent tampering with SELinux and IPE settings at runtime. Signed-off-by: Chris Co <chrco@microsoft.com>
Add new image configuration definition for OS Guard that enables code integrity enhancements. To enable code integrity checking for containers, this image activates the containerd erofs-snapshotter with an updated /etc/containerd/config.toml configuration, and also configures cni appropriately for pod networking. Additionally this image enables SELinux in enforcing mode for another important security layer. Finally, update the OS Guard generation script to handle generating OS Guard image configurations using different delta files, and simplify the process of adding new delta configurations by creating the GEN_JOBS array, where each entry follows the schema: <base-template>|<delta-template>|<output> Also update the test function to check all entries of GEN_JOBS for diffs. Signed-off-by: Chris Co <chrco@microsoft.com>
Co-authored-by: kgodara912 <kshigodara@outlook.com>
Co-authored-by: kgodara912 <kshigodara@outlook.com>
Co-authored-by: kgodara912 <kshigodara@outlook.com>
build tag "3.0.20250822-3.0" Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+15
to
+140
| name: Check Disallowed Files | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
|
|
||
| - name: Check out code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Get base commit for PRs | ||
| if: ${{ github.event_name == 'pull_request' }} | ||
| run: | | ||
| git fetch origin ${{ github.base_ref }} | ||
| echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> $GITHUB_ENV | ||
| echo "Merging ${{ github.sha }} into ${{ github.base_ref }}" | ||
|
|
||
| - name: Get base commit for Pushes | ||
| if: ${{ github.event_name == 'push' }} | ||
| run: | | ||
| git fetch origin ${{ github.event.before }} | ||
| echo "base_sha=${{ github.event.before }}" >> $GITHUB_ENV | ||
| echo "Merging ${{ github.sha }} into ${{ github.event.before }}" | ||
|
|
||
| - name: Get the changed files | ||
| run: | | ||
| echo "Files changed: '$(git diff-tree --no-commit-id --name-only -r ${{ env.base_sha }} ${{ github.sha }})'" | ||
| changed_files=$(git diff-tree --diff-filter=AM --no-commit-id --name-only -r ${{ env.base_sha }} ${{ github.sha }}) | ||
| echo "Files to validate: '${changed_files}'" | ||
| echo "changed-files<<EOF" >> $GITHUB_ENV | ||
| echo "${changed_files}" >> $GITHUB_ENV | ||
| echo "EOF" >> $GITHUB_ENV | ||
|
|
||
| - name: Check for disallowed file types | ||
| run: | | ||
| if [[ -z "${{ env.changed-files }}" ]]; then | ||
| echo "No files to validate. Exiting." | ||
| exit 0 | ||
| fi | ||
|
|
||
| echo "Checking files..." | ||
| error_found=0 | ||
|
|
||
| # Read disallowed extensions from the configuration file | ||
| if [[ ! -f ".github/workflows/disallowed-extensions.txt" ]]; then | ||
| echo "Configuration file '.github/workflows/disallowed-extensions.txt' not found. Skipping check." | ||
| exit 0 | ||
| fi | ||
|
|
||
| # Create array of disallowed extensions | ||
| mapfile -t disallowed_extensions < .github/workflows/disallowed-extensions.txt | ||
| if [[ $? -ne 0 ]]; then | ||
| echo "Error occurred while reading disallowed extensions. Exiting." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Check each changed file | ||
| while IFS= read -r file; do | ||
| if [[ -z "$file" ]]; then | ||
| continue | ||
| fi | ||
|
|
||
| echo "Checking file: $file" | ||
|
|
||
| # Get file extension (convert to lowercase for comparison) | ||
| extension=$(echo "${file##*.}" | tr '[:upper:]' '[:lower:]') | ||
| filename=$(basename "$file") | ||
|
|
||
| # Check if file should be in blob store | ||
| should_be_in_blob_store=false | ||
|
|
||
| # Check against disallowed extensions | ||
| for disallowed_ext in "${disallowed_extensions[@]}"; do | ||
| # Remove any whitespace and comments | ||
| clean_ext=$(echo "$disallowed_ext" | sed 's/#.*//' | xargs) | ||
| if [[ -z "$clean_ext" ]]; then | ||
| continue | ||
| fi | ||
|
|
||
| if [[ "$extension" == "$clean_ext" ]]; then | ||
| should_be_in_blob_store=true | ||
| break | ||
| fi | ||
| done | ||
|
|
||
| # Additional checks for binary files and large files | ||
| if [[ -f "$file" ]]; then | ||
| # Check if file is binary (but allow .sh files even if executable) | ||
| if file "$file" | grep -q "binary\|archive\|compressed"; then | ||
| should_be_in_blob_store=true | ||
| fi | ||
|
|
||
| # Check file size (files > 1MB should be in blob store) | ||
| file_size=$(stat -f%z "$file" 2>/dev/null || stat -c%s "$file" 2>/dev/null || echo 0) | ||
| if [[ $file_size -gt 1048576 ]]; then # 1MB | ||
| should_be_in_blob_store=true | ||
| fi | ||
| fi | ||
|
|
||
| if [[ "$should_be_in_blob_store" == "true" ]]; then | ||
| 1>&2 echo "**** ERROR ****" | ||
| 1>&2 echo "File '$file' should be stored in blob store, not in git repository." | ||
| 1>&2 echo "Reason: Images, Large files, binaries, tarballs, and non-text files slow down git operations" | ||
| 1>&2 echo "and cannot be efficiently diffed. Please upload to blob store instead." | ||
| 1>&2 echo "**** ERROR ****" | ||
| error_found=1 | ||
| fi | ||
| done <<< "${{ env.changed-files }}" | ||
|
|
||
| if [[ $error_found -eq 1 ]]; then | ||
| echo "" | ||
| echo "==========================================" | ||
| echo "FILES THAT SHOULD BE IN BLOB STORE DETECTED" | ||
| echo "==========================================" | ||
| echo "The following file types should be stored in blob store:" | ||
| echo "- Source tarballs (.tar.gz, .tar.xz, .zip, etc.)" | ||
| echo "- Binary files (.bin, .exe, .so, .dll, etc.)" | ||
| echo "- Images (.gif, .bmp, etc.)" | ||
| echo "- Archives (.rar, .7z, .tar, etc.)" | ||
| echo "- Large files (> 1MB)" | ||
| echo "- Any non-text files that cannot be efficiently diffed" | ||
| echo "" | ||
| echo "Please upload these files to the blob store and reference them" | ||
| echo "in your spec files or configuration instead of checking them into git." | ||
| echo "==========================================" | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "All files are appropriate for git storage." No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Comment on lines
+33
to
+165
| name: ${{ matrix.check-name }} | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - check-name: "Simple package build succeeds" | ||
| package-type: "REGULAR_PKG" | ||
| extra-args: "" | ||
|
|
||
| - check-name: "Simple package build fails" | ||
| package-type: "REGULAR_PKG" | ||
| error-pattern: "Number of failed SRPMs:\\s+1\\s*$" | ||
| extra-args: "" | ||
| build-prep: | | ||
| # Adding an invalid command to the '%prep' section will cause the build to fail. | ||
| sed -i '/%prep/a this-command-should-fail-because-its-not-a-command-at-all' "$REGULAR_PKG_SPEC_PATH" | ||
|
|
||
| - check-name: "Toolchain package rebuild succeeds" | ||
| package-type: "TOOLCHAIN_PKG" | ||
| extra-args: "ALLOW_TOOLCHAIN_REBUILDS=y" | ||
|
|
||
| - check-name: "Toolchain package rebuild fails" | ||
| package-type: "TOOLCHAIN_PKG" | ||
| error-pattern: "Number of toolchain SRPM conflicts:\\s+1\\s*$" | ||
| extra-args: "ALLOW_TOOLCHAIN_REBUILDS=n" | ||
| build-prep: "" | ||
|
|
||
| - check-name: "None license check does not break the build" | ||
| package-type: "REGULAR_PKG" | ||
| extra-args: "LICENSE_CHECK_MODE=none" | ||
| build-prep: | | ||
| license_file_name=$(grep -oP '^%license\s+\K\S+' "$REGULAR_PKG_SPEC_PATH") | ||
| if [[ -z "$license_file_name" ]]; then | ||
| echo "ERROR: no license file found in the spec $REGULAR_PKG_SPEC_PATH" | ||
| exit 1 | ||
| fi | ||
| # Tagging a license file as a documentation file will not fail the license check on the 'none' level. | ||
| sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH" | ||
|
|
||
| - check-name: "Warning-only license check does not break the build" | ||
| package-type: "REGULAR_PKG" | ||
| extra-args: "LICENSE_CHECK_MODE=warn" | ||
| build-prep: | | ||
| license_file_name=$(grep -oP '^%license\s+\K\S+' "$REGULAR_PKG_SPEC_PATH") | ||
| if [[ -z "$license_file_name" ]]; then | ||
| echo "ERROR: no license file found in the spec $REGULAR_PKG_SPEC_PATH" | ||
| exit 1 | ||
| fi | ||
| # Tagging a license file as a documentation file will not fail the license check on the 'warn' level. | ||
| sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH" | ||
|
|
||
| - check-name: "Fatal license check succeeds on duplicated license as documentation" | ||
| package-type: "REGULAR_PKG" | ||
| extra-args: "LICENSE_CHECK_MODE=fatal" | ||
| build-prep: | | ||
| license_file_name=$(grep -oP '^%license\s+\K\S+' "$REGULAR_PKG_SPEC_PATH") | ||
| if [[ -z "$license_file_name" ]]; then | ||
| echo "ERROR: no license file found in the spec $REGULAR_PKG_SPEC_PATH" | ||
| exit 1 | ||
| fi | ||
| # Tagging a license file as a documentation file will not fail the license check on the 'fatal' level. | ||
| sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH" | ||
|
|
||
| - check-name: "Fatal license check fails" | ||
| package-type: "REGULAR_PKG" | ||
| error-pattern: "Number of SRPMs with license errors:\\s+1\\s*$" | ||
| extra-args: "LICENSE_CHECK_MODE=fatal" | ||
| build-prep: | | ||
| if ! grep -q '^%license' "$REGULAR_PKG_SPEC_PATH"; then | ||
| echo "ERROR: no '%license' macro found in the spec $REGULAR_PKG_SPEC_PATH" | ||
| exit 1 | ||
| fi | ||
| # Tagging a license file as a documentation file will cause the license check to fail. | ||
| sed -i "s/^%license/%doc/" "$REGULAR_PKG_SPEC_PATH" | ||
|
|
||
| - check-name: "Pedantic license check fails" | ||
| package-type: "REGULAR_PKG" | ||
| error-pattern: "Number of SRPMs with license errors:\\s+1\\s*$" | ||
| extra-args: "LICENSE_CHECK_MODE=pedantic" | ||
| build-prep: | | ||
| license_file_name=$(grep -oP '^%license\s+\K\S+' "$REGULAR_PKG_SPEC_PATH") | ||
| if [[ -z "$license_file_name" ]]; then | ||
| echo "ERROR: no license file found in the spec $REGULAR_PKG_SPEC_PATH" | ||
| exit 1 | ||
| fi | ||
| sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH" | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Checkout a stable version of the specs | ||
| uses: ./.github/actions/checkout-with-stable-pkgs | ||
|
|
||
| - name: Prepare the build environment | ||
| if: ${{ matrix.build-prep != '' }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| ${{ matrix.build-prep }} | ||
|
|
||
| - name: Run the build | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| if sudo make -C toolkit -j$(nproc) build-packages \ | ||
| PACKAGE_REBUILD_LIST="${{ env[matrix.package-type] }}" \ | ||
| REBUILD_TOOLS=y \ | ||
| SRPM_PACK_LIST="${{ env[matrix.package-type] }}" \ | ||
| ${{ matrix.extra-args }} 2>&1 | tee build.log; then | ||
| touch build.succeeded | ||
| fi | ||
|
|
||
| - name: Check the results | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| if [[ -z "${{ matrix.error-pattern }}" ]]; then | ||
| if [[ ! -f build.succeeded ]]; then | ||
| echo "Build failed, but it was expected to succeed." | ||
| exit 1 | ||
| fi | ||
| else | ||
| if [[ -f build.succeeded ]]; then | ||
| echo "Build succeeded, but it was expected to fail." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! grep -qP '${{ matrix.error-pattern }}' build.log; then | ||
| echo "Build failed, but not with the expected error message." | ||
| exit 1 | ||
| fi | ||
| fi |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Comment on lines
+9
to
+29
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.x' | ||
|
|
||
| - name: Install Python dependencies for merge_yaml | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install pyyaml | ||
| - name: Run osguard imageconfigs test | ||
| working-directory: toolkit/scripts | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| ./generate-osguard-imageconfigs.sh test |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Contributor
Author
|
bump to newer tag |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge Checklist
All boxes should be checked before merging the PR
Description
Any Newly Introduced Dependencies
How Has This Been Tested?