Skip to content

Improve security-proxy #319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ktf merged 1 commit into from
Aug 11, 2026
Merged

Improve security-proxy #319

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion security-proxy/packer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@
"variables": {
"REPO": "registry.cern.ch/alisw/security-proxy",
"TAG": "latest",
"ALI_BOT_REF": "master"
"_comment_ALI_BOT_REF": "Pinned commit, not a branch: the image holds the AC signing key at runtime, so what goes into it should be a deliberate choice rather than whatever master said at build time. Bump this to pick up ali-bot changes. Pass -var ALI_BOT_REF=master to float.",
"ALI_BOT_REF": "610f3d8836ad0665fd01a94af5638f99468b4d0c"
},
"builders": [
{
Expand Down
16 changes: 15 additions & 1 deletion security-proxy/provision.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,15 @@ apt-get update
apt-get install -y --no-install-recommends git ca-certificates

mkdir -p /etc/security-proxy "$PREFIX"
git clone --depth 1 --branch "$ALI_BOT_REF" https://github.com/alisw/ali-bot /tmp/ali-bot
# fetch-by-ref rather than `clone --branch`, which only accepts a branch or tag.
# This way ALI_BOT_REF can be a commit SHA, so the image is reproducible: what
# went in is recorded below and pinned in packer.json, rather than being whatever
# master happened to say at build time.
git init -q /tmp/ali-bot
git -C /tmp/ali-bot remote add origin https://github.com/alisw/ali-bot
git -C /tmp/ali-bot fetch -q --depth 1 origin "$ALI_BOT_REF"
git -C /tmp/ali-bot checkout -q FETCH_HEAD
echo "ali-bot at $(git -C /tmp/ali-bot rev-parse HEAD)"
cp /tmp/ali-bot/security-proxy/security_proxy.py \
/tmp/ali-bot/security-proxy/pyproject.toml \
"$PREFIX/"
Expand Down Expand Up @@ -74,6 +82,12 @@ else
echo "=== end resolved set ==="
fi

# No CA material is baked into this image on purpose. alivault.cern.ch is issued
# by the CERN Grid CA, which no public trust store carries, so a CA *is* needed --
# but the consuming job fetches it with a checksum-pinned Nomad `artifact` stanza
# instead. Keeping it out of the image means a CA change never requires rebuilding
# and republishing a container that holds the AC signing key.

# git was only needed to fetch the source. Leaving it in a credential broker's
# image is gratuitous reach for anything that gets code execution in here.
apt-get purge -y git
Expand Down