Add cache validation#625
Conversation
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
cert-manager-prow
Bot
added
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: inteon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
cert-manager-prow
Bot
added
the
approved
| ## restore in CI environments where the cache write-side is not fully trusted | ||
| ## (e.g. node-local hostPath shared with low-trust presubmit jobs). | ||
| ## @category [shared] Tools | ||
| verify-cache: |
There was a problem hiding this comment.
Does it mean we need to run make verify-cache in every single Prow job? I imagine that's not a big downside, but I wish it was a bit more automatic
There was a problem hiding this comment.
Yes, I'll update the prowjob definitions to first call make verify-cache.
|
at first, I didn't believe it as I thought that the inode modification timestamp mismatch would prevent the attack. And I thought that the report was wrong as it mentioned poisonning I realized that I was wrong. $ echo $'#!/bin/bash\necho I GOT YOU>&2'> ~/.cache/makefile-modules/downloaded/tools/kind@v0.31.0_darwin_arm64 && chmod +x ~/.cache/makefile-modules/downloaded/tools/kind@v0.31.0_darwin_arm64
$ make _bin/tools/kind
$ _bin/tools/kind
I GOT YOUI'm surprised that we aren't verifying the hash when creating the symlink. Right now, we verify after downloading and then never verify again. And since some artifacts are large tarballs, we would need check their tarballs' hash and untar them just before creating the symlink. My recommendation would be exactly this: instead of uncompressing + checking hash on download, I'd uncompress + check hash upon creating the symlink. This would 100% mitigate the issue IMO. |
2 participants
Add verify-cache command that validates the cache, preventing cache poisoning.