1324414 - reference pre-built docker images by hash (image_builder in particular)

Status: RESOLVED FIXED

(Firefox Build System :: Task Configuration, task)

Description

[Jonas Finnemann Jensen (:jonasfj)]

This probably only relevant to image_builder, but we need to update all the
machinery...

Comment 1

[Jonas Finnemann Jensen (:jonasfj)]

Attachment: Bug 1324414 - Reference prebuilt docker images by HASH.

This adds a HASH file next to the VERSION file in the image
context folders for prebuilt docker images. And uses the
HASH for referencing the image in the tasks created by
the decision task.

This way docker will validate the image hash when pulling it
in production. Thus, attackers won't be able to inject code
by compromising the remote docker registries we use to store
prebuilt images. Further more, this makes validation of the
Chain-Of-Trust artifacts easier as this eliminates the need
for whitelists and hash validation.

Review commit: https://reviewboard.mozilla.org/r/99516/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/99516/

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8819873 [details]
Bug 1324414 - Reference prebuilt docker images by HASH.

https://reviewboard.mozilla.org/r/99516/#review99984

::: testing/docker/README.md:85
(Diff revision 1)
>  ***Deprecation Warning: Use of prebuilt images should only be used for base images (those that other images
>  will inherit from), or private images that must be stored in a private docker registry account.  Existing
>  public images will be converted to images that are built on push and any newly added image should
>  follow this pattern.***
>  
>  These are images that are intended to be pushed to a docker registry and used by specifying the

This isn't really accurate anymore either, is it?

::: testing/docker/README.md:93
(Diff revision 1)
>  
>  Example:
>    image: {#docker_image}builder{/docker_image}
>  
> -Each image has a version, given by its `VERSION` file.  This should be bumped when any changes are made that will be deployed into taskcluster.
> -Then, older tasks which were designed to run on an older version of the image can still be executed in taskcluster, while new tasks can use the new version.
> +Each image has a hash and a version, given by its `HASH` and `VERSION` files.
> +When rebuilding a prebuilt image the `VERSION` should be bumped. Once a new

Please define "prebuilt" here (I think you mean, an image that can't be built automatically)

Comment 3

[Jonas Finnemann Jensen (:jonasfj)]

Comment on attachment 8819873 [details]
Bug 1324414 - Reference prebuilt docker images by HASH.

https://reviewboard.mozilla.org/r/99516/#review99984

> This isn't really accurate anymore either, is it?

How is it not, the prebuilt images are intended to be pushed a docker registry and used by specifying the folder name.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Oh, I didn't see the lines above that (which also define prebuilt images).  Please ignore all of my comments :)

Comment 5

[Jonas Finnemann Jensen (:jonasfj)]

Yay, let's land... Arguably our docs could be better.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/65eba2a42004
Reference prebuilt docker images by HASH. r=dustin

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/65eba2a42004