ci, make: allow to build release as root user

[tklauser]

In local environments we usually want to keep the current behavior (i.e. release artifacts owned by the uid/gid of the user invoking make release). However in GitHub actions, the command recently started failing with:

addgroup: gid '123' in use

(see https://github.com/cilium/cilium-cli/actions/runs/3572725726/jobs/6006032172)

In GitHub actions, the ownership of the release artifacts shouldn't matter since they're ephemeral anyway. We can now use the following command in the release action:

RELEASE_UID=0 RELEASE_GID=0 RELEASER_USER= RELEASER_GROUP= make

[gandro]

In the past, we've had problems with the release artifacts owned by root, so they couldn't be deleted anymore without sudo. But maybe that only applies to local-release which does a rm on them?

[tklauser]

In the past, we've had problems with the release artifacts owned by root, so they couldn't be deleted anymore without sudo. But maybe that only applies to local-release which does a rm on them?

I think this only applies to make local-release. It worked on a test tag I pushed on this PR's branch: https://github.com/cilium/cilium-cli/actions/runs/3574633584

[gandro]

In the past, we've had problems with the release artifacts owned by root, so they couldn't be deleted anymore without sudo. But maybe that only applies to local-release which does a rm on them?

I think this only applies to make local-release. It worked on a test tag I pushed on this PR's branch: https://github.com/cilium/cilium-cli/actions/runs/3574633584

Yes, I just double checked as well, the problem only exists if the user changes between the first and second call to make release (which isn't an issue on GHActions, and generally is rather rare).

However, I don't fully understand how building as root is not triggering the protection against CVE-2022-24765, which was the whole reason we added the release user in the first place 🤔

[gandro]

However, I don't fully understand how building as root is not triggering the protection against CVE-2022-24765, which was the whole reason we added the release user in the first place thinking

Ah! I guess because you added -buildvcs=false to go build. That explains it.

[tklauser]

However, I don't fully understand how building as root is not triggering the protection against CVE-2022-24765, which was the whole reason we added the release user in the first place thinking

Ah! I guess because you added -buildvcs=false to go build. That explains it.

Yeah, that's the downside to it 😞 I couldn't find another way unfortunately.

[gandro]

Alternative solution: cilium/hubble#821

[tklauser]

Alternative solution: cilium/hubble#821

Nice, thanks! TIL about setpriv. I'll adjust cilium-cli to that solution as well.

[tklauser]

Alternative solution: cilium/hubble#821

Nice, thanks! TIL about setpriv. I'll adjust cilium-cli to that solution as well.

Addressed in #1244