NO-JIRA: Fix cryptoscan rootless podman config for microshift - #83098
Conversation
Make /etc/passwd and /etc/group group-writable so the crypto scan script can create a passwd entry for the arbitrary CI UID. Set BUILDAH_ISOLATION=chroot to avoid user-namespace issues inside CI pods. Without these, newuidmap fails with "Invalid argument" because the entrypoint cannot register the running user in /etc/subuid. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
WalkthroughThe ChangesMicroShift cryptoscan build
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse > |
|
@pacevedom: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse ? |
|
@pacevedom: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@pacevedom: job(s): > either don't exist or were not found to be affected, and cannot be rehearsed |
|
@pacevedom: job(s): ? either don't exist or were not found to be affected, and cannot be rehearsed |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh`:
- Around line 16-17: Update the MicroShift fetch in the rebase cryptoscan script
to use a reviewed, immutable commit SHA from a trusted remote instead of the
mutable fca/add-ushift-cbom branch, while preserving the subsequent FETCH_HEAD
checkout and existing secret-handling flow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 9b326753-26ec-4470-8d13-8382516c40b5
📒 Files selected for processing (2)
ci-operator/config/openshift/microshift/openshift-microshift-main.yamlci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
| git fetch https://github.com/fracappa/microshift.git fca/add-ushift-cbom | ||
| git checkout FETCH_HEAD |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 6 \
'import-secret|pull-secret|fca/add-ushift-cbom|git fetch|git checkout|fetch_tools\.sh|rebase_job_entrypoint\.sh' \
ci-operator/config/openshift/microshift/openshift-microshift-main.yaml \
ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh \
ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-ref.yamlRepository: openshift/release
Length of output: 4095
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== command script =="
cat -n ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
echo
echo "== ref yaml =="
cat -n ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-ref.yaml
echo
echo "== config references =="
rg -n -C 5 'openshift-microshift-rebase-cryptoscan|open_vault|cryptoscan|import-secret|pr-creds' ci-operator/config/openshift/microshift/openshift-microshift-main.yaml || true
echo
echo "== broader references to fork branch =="
rg -n 'fracappa|fca/add-ushift-cbom|add-ushift-cbom|microshift-rebase-cryptoscan' .Repository: openshift/release
Length of output: 5760
🌐 Web query:
GitHub fracappa/microshift fca/add-ushift-cbom branch
💡 Result:
There is no public GitHub repository or branch named "fracappa/microshift" containing a branch "fca/add-ushift-cbom". Research into the GitHub profile of Francesco Cappa (GitHub username @fracappa), a Red Hat contributor, confirms that while he actively contributes to OpenShift-related repositories, he does not have a public repository titled "microshift" [1]. Public activity associated with his account shows contributions to upstream OpenShift repositories such as openshift/origin [2] and openshift-eng/two-node-toolbox [3], as well as various testing and installer-related projects [1][4], but none match the query provided. The term "CBOM" is commonly used in security contexts to refer to a Cryptography Bill of Materials [5], which is distinct from standard software engineering workflows for MicroShift, an optimized distribution of OpenShift Kubernetes for edge computing [6][7]. No record of a branch named "add-ushift-cbom" exists in the official OpenShift MicroShift repository (openshift/microshift) [8][6] or other accessible community repositories [7].
Citations:
- 1: https://github.com/fracappa
- 2: OCPEDGE-2274: fix: change arbiter topology test to verify pods do not run on arbiter nodes origin#30737
- 3: openshift-eng/two-node-toolbox@337916e
- 4: https://github.com/fracappa/assisted-test-infra
- 5: https://github.com/thefinalmilkman/cbom-scan/blob/master/README.md
- 6: https://github.com/openshift/microshift
- 7: https://github.com/microshift-io/microshift
- 8: https://github.com/openshift/microshift/pulls
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import subprocess, urllib.request, json
print("curl availability:", subprocess.run(["command", "-v", "curl"], capture_output=True).returncode == 0)
try:
print(subprocess.run(["curl", "-sI", "https://github.com/fracappa/microshift.git"], capture_output=True, text=True).stdout.splitlines()[:8])
except Exception as e:
print("curl failed:", repr(e))
try:
print(subprocess.run(["curl", "-fsSL", "https://github.com/fracappa/microshift.git/info/refs?service=git-receive-pack"], timeout=15, capture_output=True, text=True).stdout[:2000])
except subprocess.TimeoutExpired:
print("curl info/refs timed out")
except Exception as e:
print("curl info/refs failed:", repr(e))
try:
req = urllib.request.Request(
"https://github.com/fracappa/microshift.git/info/refs?service=git-receive-pack",
headers={"User-Agent": "CodeRabbit verifier", "Host": "github.com", "Accept-Encoding": "identity"}
)
with urllib.request.urlopen(req, timeout=15) as resp:
print("urllib info/refs status", resp.status, "url", resp.geturl())
print(resp.read(2000).decode())
except Exception as e:
print("urllib info/refs failed:", repr(e))
PY
echo "== exact remote text =="
sed -n '1,35p' ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.shRepository: openshift/release
Length of output: 676
🌐 Web query:
GitHub raw commit SHA fracappa microshift fca/add-ushift-cbom
💡 Result:
A search of the openshift/microshift repository and relevant tooling indicates that there is no commit or pull request matching the specific identifier fca/add-ushift-cbom. It is possible that this reference is part of a private repository, a local branch, or a typo. While there are many commits in the openshift/microshift project related to CBOM (Cryptographic Bill of Materials) tools and general MicroShift development (e.g., [1]), none align with the requested string. If this is related to a specific development task, you may wish to verify the branch name or the repository where the commit was pushed.
Citations:
Pin the MicroShift checkout to a reviewed commit.
This script copies the pull secret into ${HOME}/.pull-secret.json before fetching github.com/fracappa/microshift.git fca/add-ushift-cbom and running scripts from that checkout. That branch should not remain mutable; pin the fetch to a reviewed commit from a trusted remote so reruns use the same source and secret-handling code path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh`
around lines 16 - 17, Update the MicroShift fetch in the rebase cryptoscan
script to use a reviewed, immutable commit SHA from a trusted remote instead of
the mutable fca/add-ushift-cbom branch, while preserving the subsequent
FETCH_HEAD checkout and existing secret-handling flow.
Source: Coding guidelines
|
/pj-rehearse pull-ci-openshift-microshift-main-test-rebase |
|
@pacevedom: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
b877806 to
75d68ff
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
pacevedom
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@pacevedom: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
[REHEARSALNOTIFIER]
A total of 39 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse ack |
|
@pacevedom: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@pacevedom: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fracappa, pacevedom The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Make /etc/passwd and /etc/group group-writable so the crypto scan script can create a passwd entry for the arbitrary CI UID. Set BUILDAH_ISOLATION=chroot to avoid user-namespace issues inside CI pods. Without these, newuidmap fails with "Invalid argument" because the entrypoint cannot register the running user in /etc/subuid. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
3 participants
Summary by CodeRabbit
rebase-cryptoscan-srcimage build./etc/passwdand/etc/groupgroup-readable.BUILDAH_ISOLATION=chrootfor the container build environment.