Skip to content

Fix container-related misconfigurations in release build tasks #201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 13, 2024
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Configure repository for compatibility with modern Git versions in re…
…lease build containers

`DistTasks.yml` contains the tasks used to produce the release builds of the project for each of the host targets. The
builds are produced in Docker containers.

A regression was introduced in several of the tasks at the time the project's Go version was bumped to 1.21.5. As a
security measure (see CVE-2022-24765), starting from 2.30.3 Git requires the repository folder to be owned by the
operating system user's account. Due to it having been checked out outside the container, the repository does not meet
this requirement inside the container. An older version of Git was installed in the Go 1.18.3 Docker image, so this was
not a problem before the bump, but a newer version is used in the Go 1.21.5 containers, which causes some tasks to fail:

```
error obtaining VCS status: exit status 128
  Use -buildvcs=false to disable VCS stamping.
Error: failed building for linux/armv6: exit status 1
failed building for linux/armv6: exit status 1
task: Failed to run task "dist:Linux_ARMv6": exit status 1
```

The solution is to configure Git to allow the use of the repository, despite the "dubious ownership" of its folder. This
is done via the `safe.directory` Git configuration variable.
  • Loading branch information
per1234 committed Nov 12, 2024
commit a14dd9390f3f16c92472a9fd2f7de427392d05cc
9 changes: 6 additions & 3 deletions DistTasks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -131,11 +131,12 @@ tasks:
desc: Builds Linux ARMv6 binaries
dir: "{{.DIST_DIR}}"
cmds:
# "git config safe.directory" is required until this is fixed https://github.com/elastic/golang-crossbuild/issues/232
- |
docker run -v `pwd`/..:/home/build -w /home/build \
-e CGO_ENABLED=1 \
{{.CONTAINER}}:{{.CONTAINER_TAG}} \
--build-cmd "{{.BUILD_COMMAND}}" \
--build-cmd "git config --global --add safe.directory /home/build && {{.BUILD_COMMAND}}" \
-p "{{.BUILD_PLATFORM}}"

tar cz -C {{.PLATFORM_DIR}} {{.PROJECT_NAME}} -C ../.. LICENSE.txt -f {{.PACKAGE_NAME}}
Expand Down Expand Up @@ -201,11 +202,12 @@ tasks:
desc: Builds Mac OS X 64 bit binaries
dir: "{{.DIST_DIR}}"
cmds:
# "git config safe.directory" is required until this is fixed https://github.com/elastic/golang-crossbuild/issues/232
- |
docker run -v `pwd`/..:/home/build -w /home/build \
-e CGO_ENABLED=1 \
{{.CONTAINER}}:{{.CONTAINER_TAG}} \
--build-cmd "{{.BUILD_COMMAND}}" \
--build-cmd "git config --global --add safe.directory /home/build && {{.BUILD_COMMAND}}" \
-p "{{.BUILD_PLATFORM}}"

tar cz -C {{.PLATFORM_DIR}} {{.PROJECT_NAME}} -C ../.. LICENSE.txt -f {{.PACKAGE_NAME}}
Expand Down Expand Up @@ -235,11 +237,12 @@ tasks:
desc: Builds Mac OS X ARM64 binaries
dir: "{{.DIST_DIR}}"
cmds:
# "git config safe.directory" is required until this is fixed https://github.com/elastic/golang-crossbuild/issues/232
- |
docker run -v `pwd`/..:/home/build -w /home/build \
-e CGO_ENABLED=1 \
{{.CONTAINER}}:{{.CONTAINER_TAG}} \
--build-cmd "{{.BUILD_COMMAND}}" \
--build-cmd "git config --global --add safe.directory /home/build && {{.BUILD_COMMAND}}" \
-p "{{.BUILD_PLATFORM}}"

tar cz -C {{.PLATFORM_DIR}} {{.PROJECT_NAME}} -C ../.. LICENSE.txt -f {{.PACKAGE_NAME}}
Expand Down