Corrupted cache #16

joeybrown-sf · 2024-07-02T20:38:39Z

Summary

LOW-2: Denial-of-Service (DoS) provoked by removing build cache tarballs or altering the OCI image manifest

This PR addresses the security concern by skipping the cache restore if the tarball is not present.

A user will see the a similar warning as the following. The restore no longer hard fails.

Warning: Layer with SHA 'sha256:5a1185b2a8f6e19dfbd7db44d1cd31e67873798bc2a38eb3c3df5bba733d0eb4' not found, skipping restore

Release notes

Restorer no longer fails when missing cache artifacts are referenced in the cache metadata.

Context

Signed-off-by: Natalie Arellano <narellano@vmware.com>

…ot, (#1348) consider it not a match Signed-off-by: Natalie Arellano <narellano@vmware.com>

… labels (#1347) * Read `/etc/os-release` file when distro information is not present in labels Signed-off-by: Pavel Busko <pavel.busko@sap.com> * fix unit tests Signed-off-by: Pavel Busko <pavel.busko@sap.com> * Update phase/generator_test.go Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Pavel Busko <busko.pavel@gmail.com> * Update phase/generator_test.go Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Pavel Busko <busko.pavel@gmail.com> --------- Signed-off-by: Pavel Busko <pavel.busko@sap.com> Signed-off-by: Pavel Busko <busko.pavel@gmail.com> Co-authored-by: Natalie Arellano <narellano@vmware.com>

Bumps the go-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/GoogleContainerTools/kaniko](https://github.com/GoogleContainerTools/kaniko) | `1.21.1` | `1.22.0` | | [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.14` | `1.7.16` | | [github.com/docker/docker](https://github.com/docker/docker) | `26.0.1+incompatible` | `26.1.0+incompatible` | | [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.13.1` | `0.13.2` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.18.0` | `0.19.0` | Updates `github.com/GoogleContainerTools/kaniko` from 1.21.1 to 1.22.0 - [Release notes](https://github.com/GoogleContainerTools/kaniko/releases) - [Changelog](https://github.com/GoogleContainerTools/kaniko/blob/main/CHANGELOG.md) - [Commits](GoogleContainerTools/kaniko@v1.21.1...v1.22.0) Updates `github.com/containerd/containerd` from 1.7.14 to 1.7.16 - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.14...v1.7.16) Updates `github.com/docker/docker` from 26.0.1+incompatible to 26.1.0+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v26.0.1...v26.1.0) Updates `github.com/moby/buildkit` from 0.13.1 to 0.13.2 - [Release notes](https://github.com/moby/buildkit/releases) - [Commits](moby/buildkit@v0.13.1...v0.13.2) Updates `golang.org/x/sys` from 0.18.0 to 0.19.0 - [Commits](golang/sys@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: github.com/GoogleContainerTools/kaniko dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/containerd/containerd dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/moby/buildkit dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: golang.org/x/sys dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Natalie Arellano <narellano@vmware.com>

Bumps the go-dependencies group with 2 updates: [github.com/docker/docker](https://github.com/docker/docker) and [golang.org/x/sys](https://github.com/golang/sys). Updates `github.com/docker/docker` from 26.1.0+incompatible to 26.1.1+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v26.1.0...v26.1.1) Updates `golang.org/x/sys` from 0.19.0 to 0.20.0 - [Commits](golang/sys@v0.19.0...v0.20.0) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: golang.org/x/sys dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…t compat (#1352) * Reorder functions in file Signed-off-by: Natalie Arellano <narellano@vmware.com> * Also read distro information from /etc/os-release when checking target compat buildpacks/lifecycle#1347 reads the file when providing target env vars to buildpacks during detect, but we also need to consider this info when deciding whether or not to run detect for the buildpack Signed-off-by: Natalie Arellano <narellano@vmware.com> * Error if we don't find run image OS during analyze And remove checks for missing OS later in the build, as it should always be there Signed-off-by: Natalie Arellano <narellano@vmware.com> --------- Signed-off-by: Natalie Arellano <narellano@vmware.com>

* fix: instance create issue for GH actions Signed-off-by: Dilip Gowda Bhagavan <dilip.bhagavan@ibm.com> * fix: ibm cloud instance creation issue Signed-off-by: Dilip Gowda Bhagavan <dilip.bhagavan@ibm.com> --------- Signed-off-by: Dilip Gowda Bhagavan <dilip.bhagavan@ibm.com>

* More fixes for target compat checking during detect - If a buildpack fails to specify os/arch (but specifies distro) still check targets - If the run image fails to specify os/arch (this should not happen actually as we will fail during analyze) still check targets - Fix typo in buildpack descriptor struct so that we actually get stack information - If we get distro information from /etc/os-release, persist this information to later invocations to that the log message printed when errors are encountered will be accurate - Don't override inner `i` in loop (this should not actually affect the outer loop but is confusing) Signed-off-by: Natalie Arellano <narellano@vmware.com> * When stack is "any", don't infer empty target as it is not needed Missing targets is sufficient for wildcard match Signed-off-by: Natalie Arellano <narellano@vmware.com> * Remove backwards compatible glue that actually causes fewer builds to succeed Fixes buildpacks/lifecycle#1355 Signed-off-by: Natalie Arellano <narellano@vmware.com> * Remove exit (this was added for debugging purposes) Signed-off-by: Natalie Arellano <narellano@vmware.com> --------- Signed-off-by: Natalie Arellano <narellano@vmware.com>

Bumps [azure/docker-login](https://github.com/azure/docker-login) from 1 to 2. - [Release notes](https://github.com/azure/docker-login/releases) - [Commits](Azure/docker-login@v1...v2) --- updated-dependencies: - dependency-name: azure/docker-login dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Natalie Arellano <narellano@vmware.com>

* Bump the go-dependencies group across 1 directory with 5 updates Bumps the go-dependencies group with 3 updates in the / directory: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml), [github.com/GoogleContainerTools/kaniko](https://github.com/GoogleContainerTools/kaniko) and [github.com/containerd/containerd](https://github.com/containerd/containerd). Updates `github.com/BurntSushi/toml` from 1.3.2 to 1.4.0 - [Release notes](https://github.com/BurntSushi/toml/releases) - [Commits](BurntSushi/toml@v1.3.2...v1.4.0) Updates `github.com/GoogleContainerTools/kaniko` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/GoogleContainerTools/kaniko/releases) - [Changelog](https://github.com/GoogleContainerTools/kaniko/blob/main/CHANGELOG.md) - [Commits](GoogleContainerTools/kaniko@v1.22.0...v1.23.0) Updates `github.com/awslabs/amazon-ecr-credential-helper/ecr-login` from 0.0.0-20231213181459-b0fcec718dc6 to 0.0.0-20240419161514-af205d85bb44 - [Release notes](https://github.com/awslabs/amazon-ecr-credential-helper/releases) - [Changelog](https://github.com/awslabs/amazon-ecr-credential-helper/blob/main/CHANGELOG.md) - [Commits](https://github.com/awslabs/amazon-ecr-credential-helper/commits) Updates `github.com/containerd/containerd` from 1.7.16 to 1.7.17 - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.16...v1.7.17) Updates `github.com/docker/docker` from 26.1.1+incompatible to 26.1.2+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v26.1.1...v26.1.2) --- updated-dependencies: - dependency-name: github.com/BurntSushi/toml dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/GoogleContainerTools/kaniko dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/awslabs/amazon-ecr-credential-helper/ecr-login dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/containerd/containerd dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Fix unit Signed-off-by: Natalie Arellano <narellano@vmware.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Natalie Arellano <narellano@vmware.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Natalie Arellano <narellano@vmware.com>

Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

* Ensure read access to the run image selected by extensions Co-authored-by: Nicolas Bender <nicolas.bender@sap.com> Signed-off-by: Pavel Busko <pavel.busko@sap.com> Co-authored-by: Pavel Busko <pavel.busko@sap.com> * move read access check to the restorer cmd Signed-off-by: Pavel Busko <pavel.busko@sap.com> * guard behind platform version check Signed-off-by: Pavel Busko <pavel.busko@sap.com> --------- Signed-off-by: Pavel Busko <pavel.busko@sap.com> Co-authored-by: Nicolas Bender <nicolas.bender@sap.com>

* Restore cached launch layers not found in appLayers Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com> Signed-off-by: Pavel Busko <pavel.busko@sap.com> * add platform api guard Signed-off-by: Pavel Busko <pavel.busko@sap.com> --------- Signed-off-by: Pavel Busko <pavel.busko@sap.com> Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

phase/restorer.go

phase/cache.go

phase/exporter.go

cache/image_cache.go

cache/volume_cache.go

cache/image_cache.go

cache/volume_cache.go

natalieparellano · 2024-07-08T17:09:56Z

Thank you for this @joeybrown-sf! I left a few nits and a few questions

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

* Target data: populate os/arch as well as distro information Fixes buildpacks/lifecycle#1371 Signed-off-by: Natalie Arellano <narellano@vmware.com> * Only os and arch are truly required Signed-off-by: Natalie Arellano <narellano@vmware.com> * Fix one more unit Signed-off-by: Natalie Arellano <narellano@vmware.com> * Fix even more units Signed-off-by: Natalie Arellano <narellano@vmware.com> --------- Signed-off-by: Natalie Arellano <narellano@vmware.com>

* Bump the go-dependencies group across 1 directory with 6 updates Bumps the go-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/GoogleContainerTools/kaniko](https://github.com/GoogleContainerTools/kaniko) | `1.23.0` | `1.23.1` | | [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.17` | `1.7.19` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.19.1` | `0.20.0` | | [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.13.2` | `0.14.1` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.20.0` | `0.22.0` | Updates `github.com/GoogleContainerTools/kaniko` from 1.23.0 to 1.23.1 - [Release notes](https://github.com/GoogleContainerTools/kaniko/releases) - [Changelog](https://github.com/GoogleContainerTools/kaniko/blob/main/CHANGELOG.md) - [Commits](GoogleContainerTools/kaniko@v1.23.0...v1.23.1) Updates `github.com/containerd/containerd` from 1.7.17 to 1.7.19 - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.17...v1.7.19) Updates `github.com/docker/docker` from 26.1.2+incompatible to 26.1.3+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v26.1.2...v26.1.3) Updates `github.com/google/go-containerregistry` from 0.19.1 to 0.20.0 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](google/go-containerregistry@v0.19.1...v0.20.0) Updates `github.com/moby/buildkit` from 0.13.2 to 0.14.1 - [Release notes](https://github.com/moby/buildkit/releases) - [Commits](moby/buildkit@v0.13.2...v0.14.1) Updates `golang.org/x/sys` from 0.20.0 to 0.22.0 - [Commits](golang/sys@v0.20.0...v0.22.0) --- updated-dependencies: - dependency-name: github.com/GoogleContainerTools/kaniko dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/containerd/containerd dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/docker/docker dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/moby/buildkit dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/sys dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * Stay on the same version of buildkit as kaniko Signed-off-by: Natalie Arellano <narellano@vmware.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Natalie Arellano <narellano@vmware.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Natalie Arellano <narellano@vmware.com>

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.64.0 to 1.64.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.64.0...v1.64.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Surface registry error instead of logging it as debug When permissions issues are encountered, it can be hard to determine the root cause without the error returned from the registry Signed-off-by: Natalie Arellano <narellano@vmware.com> * Fix test expectation Signed-off-by: Natalie Arellano <narellano@vmware.com> --------- Signed-off-by: Natalie Arellano <narellano@vmware.com>

Image utils should fail with a Layer Not found in both ReuseLayer & GetLayer. For GetLayer, when there is a missing blob, it's return an unexpected EOF error. For ReuseLayer, when there is a missing blob, it's not returning an error but it should.

cache/volume_cache.go

natalieparellano · 2024-07-16T17:10:22Z

Looks like these units are failing:

=== CONT  TestImageCache/ImageCache/#Commit/with_#ReuseLayer/reuse_without_commit/retrieve_returns_the_previous_layer
    image_cache_test.go:278: Expected nil: failed to reuse cache layer with SHA 'sha256:797bb0abff798d7200af7685dca7901edffc52bf2[650](https://github.com/buildpacks/lifecycle-private/actions/runs/9958919901/job/27514455016?pr=16#step:6:651)0d5bd97282658ee24152'
=== CONT  TestImageCache/ImageCache/#Commit/with_#ReuseLayer/reuse_then_commit/returns_the_reused_layer
    image_cache_test.go:252: Expected nil: failed to reuse cache layer with SHA 'sha256:797bb0abff798d7200af7685dca7901edffc52bf26500d5bd97282658ee24152'

joeybrown-sf · 2024-07-16T19:22:17Z

oops I introduced a regression. Thanks for that call out!

I think we're good now. Please take a look at your convenience 😃

natalieparellano · 2024-07-16T20:49:35Z

Thank you for the PR @joeybrown-sf! This looks good to me.

natalieparellano and others added 12 commits April 22, 2024 15:06

Bump imgutil to pick up fix from buildpacks/imgutil#269 (#1343)

37d6985

Signed-off-by: Natalie Arellano <narellano@vmware.com>

Try to fix test-s390x workflow (#1339)

13d3691

Signed-off-by: Natalie Arellano <narellano@vmware.com>

When a buildpack declares distro information, but a base image does n…

44b7041

…ot, (#1348) consider it not a match Signed-off-by: Natalie Arellano <narellano@vmware.com>

Bump imgutil to pick up fixes for containerd and podman (#1361)

36c0af0

Signed-off-by: Natalie Arellano <narellano@vmware.com>

joeybrown-sf requested a review from a team as a code owner July 2, 2024 20:38

add failing test to restorer

9e19760

Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

joeybrown-sf force-pushed the corrupted-cache branch from 60fad2c to e505545 Compare July 2, 2024 20:40

joeybrown-sf added 2 commits July 2, 2024 15:41

restorer and exporter working as expected

376931a

Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

lint

1c4aefa

Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

joeybrown-sf force-pushed the corrupted-cache branch from e505545 to 1c4aefa Compare July 2, 2024 20:45

pbusko and others added 2 commits July 3, 2024 10:01

natalieparellano reviewed Jul 8, 2024

View reviewed changes

cache/volume_cache.go Outdated Show resolved Hide resolved

joeybrown-sf and others added 7 commits July 9, 2024 10:10

Update phase/restorer.go

0101e33

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Update phase/cache.go

3d30c91

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Update cache/image_cache.go

8570898

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Update cache/volume_cache.go

2c58c8d

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Update cache/volume_cache.go

55aa264

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Update cache/volume_cache.go

de0806a

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

Update cache/volume_cache.go

1c304d5

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

joeybrown-sf and others added 9 commits July 9, 2024 11:13

Update cache/volume_cache.go

80d089f

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

update based on feedback

6a2a590

Signed-off-by: Joey Brown <brown.joseph@salesforce.com>

fix log

dcea1b3

temp fix

dba6b9a

joeybrown-sf force-pushed the corrupted-cache branch from c9516cd to 67a8cf5 Compare July 12, 2024 16:13

natalieparellano reviewed Jul 15, 2024

View reviewed changes

cache/volume_cache.go Show resolved Hide resolved

natalieparellano reviewed Jul 15, 2024

View reviewed changes

cache/volume_cache.go Show resolved Hide resolved

joeybrown-sf added 2 commits July 15, 2024 16:29

add eof check

1b5aa7c

add not exist check

6a779e3

joeybrown-sf added 2 commits July 16, 2024 14:04

reuse layer test

ba02977

fix test regression

289442a

joeybrown-sf requested a review from natalieparellano July 16, 2024 19:22

natalieparellano approved these changes Jul 16, 2024

View reviewed changes

jabrown85 approved these changes Jul 16, 2024

View reviewed changes

Merge branch 'main' into corrupted-cache

39f37e7

natalieparellano mentioned this pull request Jul 17, 2024

Security review: recover corrupt caches buildpacks/lifecycle#1382

Open

joeybrown-sf merged commit 91f791c into main Jul 17, 2024
1 of 5 checks passed

natalieparellano mentioned this pull request Oct 22, 2024

Recover corrupted volume cache buildpacks/lifecycle#1410

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Corrupted cache #16

Corrupted cache #16

joeybrown-sf commented Jul 2, 2024

natalieparellano commented Jul 8, 2024

natalieparellano commented Jul 16, 2024

joeybrown-sf commented Jul 16, 2024

natalieparellano commented Jul 16, 2024

Corrupted cache #16

Corrupted cache #16

Conversation

joeybrown-sf commented Jul 2, 2024

Summary

Release notes

Related

Context

natalieparellano commented Jul 8, 2024

natalieparellano commented Jul 16, 2024

joeybrown-sf commented Jul 16, 2024

natalieparellano commented Jul 16, 2024