-
Notifications
You must be signed in to change notification settings - Fork 7
Add stale backend build check #549
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
toddtreece
wants to merge
3
commits into
main
Choose a base branch
from
toddtreece/check-build
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,299 @@ | ||
| package gobuildinfo | ||
|
|
||
| import ( | ||
| "debug/buildinfo" | ||
| "encoding/json" | ||
| "fmt" | ||
| "os" | ||
| "path/filepath" | ||
| "runtime/debug" | ||
| "strings" | ||
|
|
||
| "github.com/bmatcuk/doublestar/v4" | ||
| "golang.org/x/mod/modfile" | ||
|
|
||
| "github.com/grafana/plugin-validator/pkg/analysis" | ||
| "github.com/grafana/plugin-validator/pkg/analysis/passes/archive" | ||
| "github.com/grafana/plugin-validator/pkg/analysis/passes/nestedmetadata" | ||
| "github.com/grafana/plugin-validator/pkg/analysis/passes/sourcecode" | ||
| "github.com/grafana/plugin-validator/pkg/logme" | ||
| ) | ||
|
|
||
| var ( | ||
| binaryNoBuildInfo = &analysis.Rule{ | ||
| Name: "binary-no-build-info", | ||
| Severity: analysis.Error, | ||
| } | ||
| binaryDirtyBuild = &analysis.Rule{ | ||
| Name: "binary-dirty-build", | ||
| Severity: analysis.Error, | ||
| } | ||
| binaryPluginIDMismatch = &analysis.Rule{ | ||
| Name: "binary-plugin-id-mismatch", | ||
| Severity: analysis.Error, | ||
| } | ||
| binaryCGOEnabled = &analysis.Rule{ | ||
| Name: "binary-cgo-enabled", | ||
| Severity: analysis.Error, | ||
| } | ||
| // binary-build-info-json-plugin-id-mismatch: the pluginID field in the SDK's | ||
| // embedded buildInfoJSON does not match the plugin.json ID. | ||
| binaryBuildInfoJSONPluginIDMismatch = &analysis.Rule{ | ||
| Name: "binary-build-info-json-plugin-id-mismatch", | ||
| Severity: analysis.Error, | ||
| } | ||
| // binary-build-info-json-version-mismatch: the version field in the SDK's | ||
| // embedded buildInfoJSON does not match the plugin.json version. | ||
| binaryBuildInfoJSONVersionMismatch = &analysis.Rule{ | ||
| Name: "binary-build-info-json-version-mismatch", | ||
| Severity: analysis.Error, | ||
| } | ||
| // binary-dep-not-in-gomod: a dependency compiled into the binary has no | ||
| // entry in the submitted go.mod. | ||
| binaryDepNotInGoMod = &analysis.Rule{ | ||
| Name: "binary-dep-not-in-gomod", | ||
| Severity: analysis.Error, | ||
| } | ||
| // binary-dep-gomod-version-mismatch: a dependency compiled into the binary | ||
| // is at a different version than declared in the submitted go.mod. | ||
| binaryDepGoModVersionMismatch = &analysis.Rule{ | ||
| Name: "binary-dep-gomod-version-mismatch", | ||
| Severity: analysis.Error, | ||
| } | ||
| ) | ||
|
|
||
| var Analyzer = &analysis.Analyzer{ | ||
| Name: "gobuildinfo", | ||
| Requires: []*analysis.Analyzer{archive.Analyzer, nestedmetadata.Analyzer, sourcecode.Analyzer}, | ||
| Run: run, | ||
| Rules: []*analysis.Rule{ | ||
| binaryNoBuildInfo, | ||
| binaryDirtyBuild, | ||
| binaryPluginIDMismatch, | ||
| binaryCGOEnabled, | ||
| binaryBuildInfoJSONPluginIDMismatch, | ||
| binaryBuildInfoJSONVersionMismatch, | ||
| binaryDepNotInGoMod, | ||
| binaryDepGoModVersionMismatch, | ||
| }, | ||
| ReadmeInfo: analysis.ReadmeInfo{ | ||
| Name: "Go Build Info", | ||
| Description: "Validates embedded Go build metadata in backend plugin binaries.", | ||
| }, | ||
| } | ||
|
|
||
| // sdkBuildInfo represents the JSON struct embedded via -ldflags by the Grafana | ||
| // plugin SDK. Older SDK versions include additional fields (repo, branch, hash, | ||
| // build) that are not present in newer versions. | ||
| type sdkBuildInfo struct { | ||
| PluginID string `json:"pluginID"` | ||
| Version string `json:"version"` | ||
| } | ||
|
|
||
| func run(pass *analysis.Pass) (interface{}, error) { | ||
| archiveDir, ok := pass.ResultOf[archive.Analyzer].(string) | ||
| if !ok { | ||
| return nil, nil | ||
| } | ||
|
|
||
| metadatamap, ok := pass.ResultOf[nestedmetadata.Analyzer].(nestedmetadata.Metadatamap) | ||
| if !ok { | ||
| return nil, nil | ||
| } | ||
|
|
||
| sourceCodeDir, ok := pass.ResultOf[sourcecode.Analyzer].(string) | ||
|
|
||
| if !ok || sourceCodeDir == "" { | ||
| return nil, nil | ||
| } | ||
|
|
||
| goMod := parseGoMod(filepath.Join(sourceCodeDir, "go.mod")) | ||
|
|
||
| for pluginJSONPath, data := range metadatamap { | ||
| if !data.Backend || data.Executable == "" { | ||
| continue | ||
| } | ||
|
|
||
| pluginRootDir := filepath.Join(archiveDir, filepath.Dir(pluginJSONPath)) | ||
| executableParentDir := filepath.Join(pluginRootDir, filepath.Dir(data.Executable)) | ||
|
|
||
| binaries, err := doublestar.FilepathGlob( | ||
| executableParentDir + "/" + filepath.Base(data.Executable) + "*", | ||
| ) | ||
| if err != nil { | ||
| logme.Debugln("gobuildinfo: error finding binaries:", err) | ||
| continue | ||
| } | ||
|
|
||
| for _, binary := range binaries { | ||
| checkBinary(pass, binary, data.ID, data.Info.Version, goMod) | ||
| } | ||
| } | ||
|
|
||
| return nil, nil | ||
| } | ||
|
|
||
| func checkBinary(pass *analysis.Pass, binaryPath, pluginID, pluginVersion string, goMod *modfile.File) { | ||
| info, err := buildinfo.ReadFile(binaryPath) | ||
| if err != nil { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryNoBuildInfo, | ||
| fmt.Sprintf("could not read build info from %s", filepath.Base(binaryPath)), | ||
| "The binary may have been stripped of Go build information. Ensure binaries are built without stripping build metadata.", | ||
| ) | ||
| return | ||
| } | ||
|
|
||
| binaryName := filepath.Base(binaryPath) | ||
|
|
||
| for _, setting := range info.Settings { | ||
| switch setting.Key { | ||
| case "vcs.modified": | ||
| if setting.Value == "true" { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryDirtyBuild, | ||
| fmt.Sprintf("%s: built from a dirty working tree", binaryName), | ||
| "The binary was built with uncommitted changes (vcs.modified=true). Binaries submitted for signing must be built from a clean git working tree. See https://grafana.com/developers/plugin-tools/publish-a-plugin/build-automation for more information.", | ||
| ) | ||
| } | ||
| case "CGO_ENABLED": | ||
| if setting.Value == "1" { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryCGOEnabled, | ||
| fmt.Sprintf("%s: built with CGO_ENABLED=1", binaryName), | ||
| "Grafana plugins must be built with CGO_ENABLED=0. CGO is not supported in the plugin runtime environment.", | ||
| ) | ||
| } | ||
| case "-ldflags": | ||
| checkPluginIDInLDFlags(pass, binaryName, setting.Value, pluginID) | ||
| checkBuildInfoJSON(pass, binaryName, setting.Value, pluginID, pluginVersion) | ||
| } | ||
| } | ||
|
|
||
| if goMod != nil { | ||
| required := make(map[string]string, len(goMod.Require)) | ||
| for _, r := range goMod.Require { | ||
| required[r.Mod.Path] = r.Mod.Version | ||
| } | ||
| for _, dep := range info.Deps { | ||
| checkDepGoMod(pass, binaryName, dep, required) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func checkPluginIDInLDFlags(pass *analysis.Pass, binaryName, ldflags, expectedID string) { | ||
| _, after, ok := strings.Cut(ldflags, "main.pluginID=") | ||
| if !ok { | ||
| return | ||
| } | ||
| after = strings.TrimPrefix(after, "'") | ||
| if end := strings.IndexAny(after, "' \t"); end >= 0 { | ||
| after = after[:end] | ||
| } | ||
| embeddedID := after | ||
| if embeddedID != expectedID { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryPluginIDMismatch, | ||
| fmt.Sprintf("%s: embedded plugin ID %q does not match plugin.json ID %q", binaryName, embeddedID, expectedID), | ||
| "The plugin ID embedded in the binary at build time does not match the plugin.json ID. Ensure the binary was built for this plugin.", | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| // extractBuildInfoJSON extracts the SDK buildInfoJSON value from ldflags. | ||
| // The package path changed between SDK versions: | ||
| // - old: github.com/grafana/grafana-plugin-sdk-go/build.buildInfoJSON | ||
| // - new: github.com/grafana/grafana-plugin-sdk-go/build/buildinfo.buildInfoJSON | ||
| func extractBuildInfoJSON(ldflags string) string { | ||
| for _, prefix := range []string{ | ||
| "github.com/grafana/grafana-plugin-sdk-go/build/buildinfo.buildInfoJSON=", | ||
| "github.com/grafana/grafana-plugin-sdk-go/build.buildInfoJSON=", | ||
| } { | ||
| _, after, ok := strings.Cut(ldflags, prefix) | ||
| if !ok { | ||
| continue | ||
| } | ||
| after = strings.TrimPrefix(after, "'") | ||
| if end := strings.IndexByte(after, '\''); end >= 0 { | ||
| return after[:end] | ||
| } | ||
| return after | ||
| } | ||
| return "" | ||
| } | ||
|
|
||
| func checkBuildInfoJSON(pass *analysis.Pass, binaryName, ldflags, expectedPluginID, expectedVersion string) { | ||
| raw := extractBuildInfoJSON(ldflags) | ||
| if raw == "" { | ||
| return | ||
| } | ||
| var info sdkBuildInfo | ||
| if err := json.Unmarshal([]byte(raw), &info); err != nil { | ||
| return | ||
| } | ||
| if info.PluginID != "" && info.PluginID != expectedPluginID { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryBuildInfoJSONPluginIDMismatch, | ||
| fmt.Sprintf("%s: buildInfoJSON plugin ID %q does not match plugin.json ID %q", binaryName, info.PluginID, expectedPluginID), | ||
| "The plugin ID embedded in the SDK build info JSON does not match the plugin.json ID. Ensure the binary was built for this plugin.", | ||
| ) | ||
| } | ||
| if info.Version != "" && expectedVersion != "" && info.Version != expectedVersion { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryBuildInfoJSONVersionMismatch, | ||
| fmt.Sprintf("%s: buildInfoJSON version %q does not match plugin.json version %q", binaryName, info.Version, expectedVersion), | ||
| fmt.Sprintf("The binary was built for version %q but plugin.json declares version %q. Rebuild the backend binary.", info.Version, expectedVersion), | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| // parseGoMod reads and parses a go.mod file. | ||
| func parseGoMod(path string) *modfile.File { | ||
| data, err := os.ReadFile(path) | ||
| if err != nil { | ||
| return nil | ||
| } | ||
| f, err := modfile.ParseLax(path, data, nil) | ||
| if err != nil { | ||
| return nil | ||
| } | ||
| return f | ||
| } | ||
|
|
||
| func checkDepGoMod(pass *analysis.Pass, binaryName string, dep *debug.Module, goMod map[string]string) { | ||
| if dep.Replace != nil { | ||
| dep = dep.Replace | ||
| } | ||
| modVersion, ok := goMod[dep.Path] | ||
| if !ok { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryDepNotInGoMod, | ||
| fmt.Sprintf("%s: dependency %s@%s is not in go.mod", binaryName, dep.Path, dep.Version), | ||
| fmt.Sprintf( | ||
| "The binary was compiled with %s but it is not declared in go.mod. "+ | ||
| "Rebuild the backend binary after updating go.mod.", | ||
| dep.Path, | ||
| ), | ||
| ) | ||
| return | ||
| } | ||
| if dep.Version != modVersion { | ||
| pass.ReportResult( | ||
| pass.AnalyzerName, | ||
| binaryDepGoModVersionMismatch, | ||
| fmt.Sprintf("%s: dependency %s version mismatch: binary has %s, go.mod requires %s", binaryName, dep.Path, dep.Version, modVersion), | ||
| fmt.Sprintf( | ||
| "The binary was compiled with %s@%s but go.mod requires %s. "+ | ||
| "Rebuild the backend binary.", | ||
| dep.Path, dep.Version, modVersion, | ||
| ), | ||
| ) | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do we have genuine cases where CGO_ENABLED=1 is a valid option? I had the idea we don't allow cgo in plugins. if that's the case we can turn this into an error.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i wasn't sure if it was allowed in some cases. i can change to error