mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-25 00:02:25 +02:00
fix(security): refresh client trust and publish validated SearXNG images
Repair SearXNG system and certifi stores, validate native amd64/arm64 runtime images through Compose, and publish the exact verified artifacts through a trusted CI job. Adopt released Python, certifi, grpcio, uv and Docker CLI trust fixes, with strict controls for all fourteen public incident chains. Part of #6784 and #6790. Co-authored-by: Léo <leograndcontact@gmail.com>
This commit is contained in:
RaresKeY
@@ -0,0 +1,118 @@
|
||||
"""Describe a validated sidecar release without executing image or repository code."""
|
||||
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path
|
||||
import re
|
||||
|
||||
|
||||
IMAGE = "ghcr.io/odysseus-dev/odysseus-searxng"
|
||||
REPOSITORY = "odysseus-dev/odysseus"
|
||||
SOURCE_FILES = (
|
||||
"docker/searxng/Dockerfile",
|
||||
"docker/searxng/repair_trust.py",
|
||||
"docker/searxng/blocked-certificates.json",
|
||||
"docker/searxng/validate_image.py",
|
||||
"tests/fixtures/ca-trust/incident.json",
|
||||
)
|
||||
|
||||
|
||||
def revision(value):
|
||||
if not re.fullmatch(r"[0-9a-f]{40}", value):
|
||||
raise ValueError("invalid source revision")
|
||||
return value
|
||||
|
||||
|
||||
def digest(value):
|
||||
if not isinstance(value, str) or not re.fullmatch(r"sha256:[0-9a-f]{64}", value):
|
||||
raise ValueError("invalid image digest")
|
||||
return value
|
||||
|
||||
|
||||
def source_snapshot(root, source_revision, repository):
|
||||
revision(source_revision)
|
||||
if not re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", repository):
|
||||
raise ValueError("invalid source repository")
|
||||
dockerfile = (root / SOURCE_FILES[0]).read_text()
|
||||
match = re.search(r"^FROM (\S+) AS base$", dockerfile, re.M)
|
||||
if not match or not re.fullmatch(r"docker\.io/searxng/searxng:[^\s@]+@sha256:[0-9a-f]{64}", match[1]):
|
||||
raise ValueError("SearXNG base must have an immutable upstream digest")
|
||||
return {
|
||||
"schema_version": 1,
|
||||
"repository": repository,
|
||||
"source_revision": source_revision,
|
||||
"upstream_image": match[1],
|
||||
"source_inputs": {name: hashlib.sha256((root / name).read_bytes()).hexdigest() for name in SOURCE_FILES},
|
||||
}
|
||||
|
||||
|
||||
def release_descriptor(amd64, arm64, manifest, source_revision, run_id, tag, arch_digests):
|
||||
revision(source_revision)
|
||||
if amd64 != arm64:
|
||||
raise ValueError("native architecture builds used different source inputs")
|
||||
if amd64.get("repository") != REPOSITORY or amd64.get("source_revision") != source_revision:
|
||||
raise ValueError("release source does not match the canonical workflow revision")
|
||||
if amd64.get("schema_version") != 1 or set(amd64.get("source_inputs", {})) != set(SOURCE_FILES):
|
||||
raise ValueError("incomplete source inventory")
|
||||
if any(not isinstance(value, str) or not re.fullmatch(r"[0-9a-f]{64}", value) for value in amd64["source_inputs"].values()):
|
||||
raise ValueError("invalid source checksum")
|
||||
if not str(run_id).isdigit() or not re.fullmatch(r"[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}", tag):
|
||||
raise ValueError("invalid workflow identity or image tag")
|
||||
if manifest.get("mediaType") not in (
|
||||
"application/vnd.oci.image.index.v1+json",
|
||||
"application/vnd.docker.distribution.manifest.list.v2+json",
|
||||
):
|
||||
raise ValueError("release is not a multiarch image index")
|
||||
children = manifest.get("manifests", [])
|
||||
platforms = sorted(f"{entry.get('platform', {}).get('os')}/{entry.get('platform', {}).get('architecture')}" for entry in children)
|
||||
if platforms != ["linux/amd64", "linux/arm64"]:
|
||||
raise ValueError("release must contain exactly the two validated Linux architectures")
|
||||
if len({digest(entry.get("digest")) for entry in children}) != 2:
|
||||
raise ValueError("architecture digests must be distinct")
|
||||
expected = {arch: digest(value) for arch, value in arch_digests.items()}
|
||||
actual = {entry["platform"]["architecture"]: entry["digest"] for entry in children}
|
||||
if actual != expected:
|
||||
raise ValueError("index does not reference the exact validated architecture images")
|
||||
return {
|
||||
**amd64,
|
||||
"image": f"{IMAGE}@{digest(manifest.get('digest'))}",
|
||||
"tag": tag,
|
||||
"platforms": platforms,
|
||||
"architecture_digests": actual,
|
||||
"workflow_run": f"https://github.com/{REPOSITORY}/actions/runs/{run_id}",
|
||||
}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
sub = parser.add_subparsers(dest="command", required=True)
|
||||
inputs = sub.add_parser("inputs")
|
||||
inputs.add_argument("--root", type=Path, default=Path(__file__).resolve().parents[2])
|
||||
inputs.add_argument("--revision", required=True)
|
||||
inputs.add_argument("--repository", required=True)
|
||||
inputs.add_argument("--output", type=Path, required=True)
|
||||
release = sub.add_parser("release")
|
||||
release.add_argument("--amd64", type=Path, required=True)
|
||||
release.add_argument("--arm64", type=Path, required=True)
|
||||
release.add_argument("--manifest", type=Path, required=True)
|
||||
release.add_argument("--amd64-digest", required=True)
|
||||
release.add_argument("--arm64-digest", required=True)
|
||||
release.add_argument("--revision", required=True)
|
||||
release.add_argument("--run-id", required=True)
|
||||
release.add_argument("--tag", required=True)
|
||||
release.add_argument("--output", type=Path, required=True)
|
||||
args = parser.parse_args()
|
||||
if args.command == "inputs":
|
||||
value = source_snapshot(args.root, args.revision, args.repository)
|
||||
else:
|
||||
value = release_descriptor(
|
||||
json.loads(args.amd64.read_text()), json.loads(args.arm64.read_text()),
|
||||
json.loads(args.manifest.read_text()), args.revision, args.run_id, args.tag,
|
||||
{"amd64": args.amd64_digest, "arm64": args.arm64_digest},
|
||||
)
|
||||
args.output.write_text(json.dumps(value, indent=2) + "\n")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,57 @@
|
||||
#!/usr/bin/env bash
|
||||
# Exercise an already-built image through the normal Compose startup path.
|
||||
set -euo pipefail
|
||||
|
||||
searxng_repo=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
|
||||
searxng_image=${1:?usage: validate-searxng-image.sh IMAGE}
|
||||
[[ "$searxng_image" =~ ^[a-zA-Z0-9_./:@+-]+$ ]] || {
|
||||
echo "Invalid image reference" >&2
|
||||
exit 2
|
||||
}
|
||||
searxng_checks=$(mktemp -d "${TMPDIR:-/tmp}/searxng-ci-XXXXXXXX")
|
||||
searxng_project=$(basename "$searxng_checks" | tr '[:upper:]' '[:lower:]')
|
||||
export SEARXNG_VALIDATION_IMAGE="$searxng_image"
|
||||
export SEARXNG_VALIDATION_CHECKS="$searxng_checks"
|
||||
export SEARXNG_VALIDATION_VOLUME="${searxng_project}-settings"
|
||||
# Never forward an operator's existing secret or load their .env for a CI probe.
|
||||
export SEARXNG_SECRET=searxng-ci-validation-only
|
||||
searxng_volume_created=0
|
||||
searxng_started=0
|
||||
searxng_compose=(docker compose --env-file /dev/null --project-name "$searxng_project"
|
||||
-f "$searxng_repo/docker-compose.yml"
|
||||
-f "$searxng_repo/.github/searxng-validation.compose.yml")
|
||||
|
||||
searxng_cleanup() {
|
||||
local searxng_exit=$?
|
||||
if [ "$searxng_started" = 1 ]; then
|
||||
"${searxng_compose[@]}" down --remove-orphans >/dev/null 2>&1 || true
|
||||
fi
|
||||
if [ "$searxng_volume_created" = 1 ]; then
|
||||
docker volume rm "$SEARXNG_VALIDATION_VOLUME" >/dev/null 2>&1 || true
|
||||
fi
|
||||
rm -rf -- "$searxng_checks"
|
||||
return "$searxng_exit"
|
||||
}
|
||||
trap searxng_cleanup EXIT
|
||||
|
||||
install -m 0644 "$searxng_repo/docker/searxng/repair_trust.py" \
|
||||
"$searxng_repo/docker/searxng/blocked-certificates.json" \
|
||||
"$searxng_repo/docker/searxng/validate_image.py" "$searxng_checks/"
|
||||
install -m 0644 "$searxng_repo/tests/fixtures/ca-trust/incident.json" "$searxng_checks/incident.json"
|
||||
install -m 0644 "$searxng_repo/config/searxng/settings.yml" "$searxng_checks/settings.yml"
|
||||
install -m 0644 "$searxng_repo/scripts/migrate_searxng_settings.py" "$searxng_checks/migrate_searxng_settings.py"
|
||||
if docker volume inspect "$SEARXNG_VALIDATION_VOLUME" >/dev/null 2>&1; then
|
||||
echo "Refusing to reuse an existing validation volume" >&2
|
||||
exit 1
|
||||
fi
|
||||
docker volume create --label "odysseus.searxng-validation=$searxng_project" \
|
||||
"$SEARXNG_VALIDATION_VOLUME" >/dev/null
|
||||
searxng_volume_created=1
|
||||
searxng_started=1
|
||||
if ! "${searxng_compose[@]}" up --detach --no-deps --no-build --pull never \
|
||||
--wait --wait-timeout 150 searxng; then
|
||||
"${searxng_compose[@]}" logs --no-color searxng >&2 || true
|
||||
exit 1
|
||||
fi
|
||||
"${searxng_compose[@]}" exec -T searxng /usr/local/searxng/.venv/bin/python \
|
||||
/opt/odysseus-checks/validate_image.py --running --live
|
||||
Reference in New Issue
Block a user