zhangyiss/spack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix security issue in CI (#17545)

Browse Source 
The `spack-build-env.txt` file may contains many secrets, but the obvious one is the private signing key in `SPACK_SIGNING_KEY`. This file is nonetheless uploaded as a build artifact to gitlab. For anyone running CI on a public version of Gitlab this is a major security problem. Even for private Gitlab instances it can be very problematic.

Co-authored-by: Scott Wittenburg <scott.wittenburg@kitware.com>
This commit is contained in:
Harmen Stoppels 2020-07-17 02:27:37 +02:00 committed by Gregory Becker
parent e4265d3135
commit 24dff9cf20
2 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/spack/spack/ci.py
View File

@ -1043,17 +1043,10 @@ def copy_stage_logs_to_artifacts(job_spec, job_log_dir):
tty.debug('job package: {0}'.format(job_pkg)) tty.debug('job package: {0}'.format(job_pkg))
stage_dir = job_pkg.stage.path stage_dir = job_pkg.stage.path
tty.debug('stage dir: {0}'.format(stage_dir)) tty.debug('stage dir: {0}'.format(stage_dir))
build_env_src = os.path.join(stage_dir, 'spack-build-env.txt')
build_out_src = os.path.join(stage_dir, 'spack-build-out.txt') build_out_src = os.path.join(stage_dir, 'spack-build-out.txt')
build_env_dst = os.path.join(
job_log_dir, 'spack-build-env.txt')
build_out_dst = os.path.join( build_out_dst = os.path.join(
job_log_dir, 'spack-build-out.txt') job_log_dir, 'spack-build-out.txt')
tty.debug('Copying logs to artifacts:') tty.debug('Copying build log ({0}) to artifacts ({1})'.format(
tty.debug(' 1: {0} -> {1}'.format(
build_env_src, build_env_dst))
shutil.copyfile(build_env_src, build_env_dst)
tty.debug(' 2: {0} -> {1}'.format(
build_out_src, build_out_dst)) build_out_src, build_out_dst))
shutil.copyfile(build_out_src, build_out_dst) shutil.copyfile(build_out_src, build_out_dst)
except Exception as inst: except Exception as inst:

1
lib/spack/spack/test/cmd/ci.py
View File

@ -751,7 +751,6 @@ def test_push_mirror_contents(tmpdir, mutable_mock_env_path, env_deactivate,
logs_dir_list = os.listdir(logs_dir.strpath) logs_dir_list = os.listdir(logs_dir.strpath)
assert('spack-build-env.txt' in logs_dir_list)
assert('spack-build-out.txt' in logs_dir_list) assert('spack-build-out.txt' in logs_dir_list)
# Also just make sure that if something goes wrong with the # Also just make sure that if something goes wrong with the