Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

By default enforce check of clone image via allow-list by image name and tag #4056

Closed
wants to merge 34 commits into from
Closed

By default enforce check of clone image via allow-list by image name and tag #4056

Changes from 33 commits
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
a8fa090
Extend utils.MatchImage by add utils.MatchImageDynamic and utils.Matc…
6543 Aug 25, 2024
9a59c5b
allow-list trusted- and escalated-plugins by exact match
6543 Aug 26, 2024
553b095
document one change
6543 Aug 26, 2024
95f8b6d
document MatchImageDynamic usage for secret plugin filer
6543 Aug 26, 2024
fa83a29
update privilged plugins to allow list
6543 Aug 26, 2024
5dfed30
lint against clone steps with untrusted images
6543 Aug 26, 2024
1d490b7
could be more
6543 Aug 26, 2024
bcea359
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Aug 26, 2024
6f60814
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Aug 29, 2024
689f7f8
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Aug 31, 2024
0e08318
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Aug 31, 2024
82d2103
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Aug 31, 2024
b95281b
Apply suggestions from code review
6543 Aug 31, 2024
9336afb
clean
6543 Aug 31, 2024
f81a86e
clean
6543 Aug 31, 2024
9fc5be8
Revert "clean"
6543 Aug 31, 2024
c29a416
clean fix
6543 Aug 31, 2024
1bf9001
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Sep 1, 2024
0b357ea
Merge branch 'main' into allow-trusted-and-privileged-plugins-to-be-f…
6543 Sep 1, 2024
8b39ef1
make no-tag mach as of now
6543 Sep 1, 2024
68560af
rename
6543 Sep 1, 2024
184a13b
make trustedClonePlugins an setting for admins
6543 Sep 1, 2024
4501f88
cli lint respect custom trusted clone plugins
6543 Sep 1, 2024
b8a62d8
Update docs/docs/30-administration/10-server-config.md
6543 Sep 1, 2024
bd6aff7
pipeline compiler: init defaultClonePlugin the same and respect 0 if …
6543 Sep 1, 2024
052668a
clean: all about trusted clone
6543 Sep 1, 2024
53a9a3f
clean docs
6543 Sep 1, 2024
c90b4de
clean docs (2)
6543 Sep 1, 2024
1710cb6
add one more info
6543 Sep 1, 2024
54f9d0a
add test
6543 Sep 1, 2024
3d76ba8
Merge branch 'allow-trusted-and-privileged-plugins-to-be-filtered-via…
6543 Sep 1, 2024
d769bc3
Merge branch 'main' into plugin-secret-exact-filter-if-tag-set
6543 Sep 1, 2024
f954bcb
do
6543 Sep 1, 2024
1422752
Update shared/constant/constant.go
6543 Sep 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 37 additions & 3 deletions shared/constant/constant.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,42 @@ const (
)

// TrustedClonePlugins can be changed by 'WOODPECKER_PLUGINS_TRUSTED_CLONE' at runtime.
var TrustedClonePlugins = []string{
var TrustedCloneImages = []string{
6543 marked this conversation as resolved.
Show resolved Hide resolved
6543 marked this conversation as resolved.
Show resolved Hide resolved
// we should trust to inject netrc to the clone step image we assign ourselves
DefaultClonePlugin,
"docker.io/woodpeckerci/plugin-git",
"quay.io/woodpeckerci/plugin-git",
// we should trust the latest versions of our clone plugin(s)
"docker.io/woodpeckerci/plugin-git:latest",
"quay.io/woodpeckerci/plugin-git:latest",
// alternate valid trusted images
// renovate: datasource=docker depName=quay.io/woodpeckerci/plugin-git
"quay.io/woodpeckerci/plugin-git:2.5.2",

// allow the dev image
"docker.io/woodpeckerci/plugin-git:next",

// old version witch we know have no problem (e.g. allow-list)
"docker.io/woodpeckerci/plugin-git:2.5.2",
"quay.io/woodpeckerci/plugin-git:2.5.2",
"docker.io/woodpeckerci/plugin-git:2.5.1",
"quay.io/woodpeckerci/plugin-git:2.5.1",
"docker.io/woodpeckerci/plugin-git:2.5.0",
"quay.io/woodpeckerci/plugin-git:2.5.0",
"docker.io/woodpeckerci/plugin-git:2.4.0",
"quay.io/woodpeckerci/plugin-git:2.4.0",
"docker.io/woodpeckerci/plugin-git:2.3.1",
"quay.io/woodpeckerci/plugin-git:2.3.1",
"docker.io/woodpeckerci/plugin-git:2.3.0",
"quay.io/woodpeckerci/plugin-git:2.3.0",
"docker.io/woodpeckerci/plugin-git:2.2.0",
"quay.io/woodpeckerci/plugin-git:2.2.0",
"docker.io/woodpeckerci/plugin-git:2.1.2",
"quay.io/woodpeckerci/plugin-git:2.1.2",
"docker.io/woodpeckerci/plugin-git:2.1.0",
"quay.io/woodpeckerci/plugin-git:2.1.0",
"docker.io/woodpeckerci/plugin-git:2.0.3",
"quay.io/woodpeckerci/plugin-git:2.0.3",
"docker.io/woodpeckerci/plugin-git:2.0.2",
"quay.io/woodpeckerci/plugin-git:2.0.2",
"docker.io/woodpeckerci/plugin-git:2.0.1",
"quay.io/woodpeckerci/plugin-git:2.0.1",
}