Bug 1109960
| Summary: | RPM by `make bkradd` does not correspond to the git tag | ||
|---|---|---|---|
| Product: | [Retired] Beaker | Reporter: | Alois Mahdal <amahdal> |
| Component: | command line | Assignee: | Dan Callaghan <dcallagh> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | tools-bugs <tools-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 0.17 | CC: | aigao, asaha, dcallagh, rmancy, xma |
| Target Milestone: | 0.18 | Keywords: | FutureFeature |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Enhancement | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-08-27 06:52:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Relatvely easy and non-intrusive (unless the test repo is huge, I guess) workaround could be:
Before starting to build RPM, clone the current repository to a temporary
dir (note that you can use local path to `git clone` command) and cd to
that path before collecting anything.
On Gerrit: http://gerrit.beaker-project.org/3235 Slightly less intrusive steps to reproduce (doesn't require committing and tagging): 1. Clone a task repo, for example http://git.beaker-project.org/cgit/beaker-core-tasks 2. Modify Makefile, for example change a Requires field to have some wrong value 3. Build the task RPM: make rpm 4. Check the contents of testinfo.desc inside the built RPM: rpm2cpio ./beaker-distribution-install-1.12-1.noarch.rpm | cpio --extract --to-stdout ./mnt/tests/distribution/install/testinfo.desc Expected results: Output should *not* show the uncommitted modifications. Actual results: Output shows uncommitted modifications. rhts 4.64 has been released. |
Description: `make bkradd` creates RPM based on what is currently in the working tree, instead of what has been committed / pushed / tagged in the Git repo. This means that if you have local changes in the working tree (perhaps because you use slightly different paths / timing values / credentials etc. for local debugging), the final RPM will contain them, despite that these changes never existed in any repo and were never supposed to leave your machine. Consequentially, this can lead to security risk: the "changes" could be something that shows up in the log, one hat you incidentally decided to publish in a bug report. So in worst-case scenario, this could lead to leakage outside Red Hat(!). And it is counter-intuitive enough: Even in above scenario, in good faith, you might double-check that you did not push the "secret" to repo, but would you double-check that git ~ rpm, i.e. the mytest-1.0.1.rpm ~ mytest-1.0.1 tag? Version-Release number of selected component (if applicable): rhts-test-env-4.61-1.fc19.noarch How reproducible: Always Steps to Reproduce: 1. Clone a test repo 2. Make a change, e.g. add a line to runtest.sh: rlLog "secret" 3. `make tag; git push --tags; make bkradd` 4. Deploy the RPM 5. Compare the modified file with its tagged counterpart in git repo Actual results: The file is different, i.e. contains the "secret" Expected results: The file should be the same, i.e. not contain the "secret" Additional info: