Skip to content

Releases: openshift/check-payload

0.3.2

25 Oct 17:11
@rphillips rphillips
0.3.2
da4f77e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
0.3.2 Latest
Latest

What's Changed

Read more

Contributors

rphillips, sdodson, and 20 other contributors
Assets 2
Loading

0.3.1

04 Aug 20:14
@rphillips rphillips
0.3.1
3e9a54b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
0.3.1

Features

  • Config de-duplication (moved some rules into the main config.toml)
  • Improve config validation for [[ignores]] sections
  • Add 4.14 configuration.
  • Add semver sort of stored config versions
  • Add --walk-scan flag to node scan. If set, the scan is using the same
    algorithm as scan payload (walk the directory tree and scan all files).
    Note that per-payload and per-tag configuration entries are still ignored
    because neither tag nor component is set.
  • Add --rpm-scan flag to payload and image scan. If set, the scan is using
    the same algorithm and rules as scan node (only scan files belonging to RPM
    packages, and ignore per-payload and per-tag configuration entries).

Bug fixes

  • Fix error text in message when logging scan node failure/warning
  • Fix checking for duplicates in config validation logic
Assets 2
Loading

0.3.0

01 Aug 19:22
@rphillips rphillips
0.3.0
8e1ad24
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
0.3.0

[0.3.0] - 2023-08-01

This is a major release, which allows more fine-grained exceptions
configuration. Instead of merely excluding some files from being checked,
it is now possible to ignore specific well known errors for some specific
files or directories in a specific RPM packages, or components, or tags.

In addition, per-rpm configuration rules ([rpm.xxx], previously known as
[node.xxx]) are now applicable to payload and image scans, alleviating the need
to duplicate the exclusions.

The exceptions printing (-p) now prints exceptions in the new format (per-error,
also per-rpm, if possible, or per-component, or per-tag), making it easier to
maintain configurations.

Another notable feature is that a versioned configuration is not merged into
the main one, rather that replacing it, allowing to specify exclusions common
to multiple OpenShift versions to a main configuration file.

The configurations were rewritten mostly using the new rules. Due to this,
some previously added exceptions might be lost and need to be re-added.

Some validations of configuration were added, and invalid configurations might
be rejected now (or warned about, depening on the severity). An example of such
bad configuration is a non-canonical (non-clean or not absolute) file name.

A bunch of performance optimizations has been made, and the tool no longer
requires "file" and "go" binaries to be present on the system.

Features

  • Ensure the configuration is fully parsed
  • Remove dependency on go binary
  • Rename node ignores to rpm ignores in configs
  • Use rpm name only (not name-version-release.arch) in configs
  • Report rpm name in image/payload scan results
  • Use per-rpm config filters in image/payload scans
  • Add tag and rpm support to displayExceptions
  • Show component, tag, rpm in log
  • Unify node and payload/image reports
  • Add known errors
  • Add ability to ignore specific known errors for specific files/dirs
  • Display exceptions in the new per-error format
  • Major config facelift using (mostly) per-error exclusions
  • Make the versioned config (e.g. -V 4.12) added to the main one,
    implement config merging with duplicate checks
  • Add configuration validation (absolute/clean URLs, etc)

Bug fixes

  • Node scan: use dbpath in all rpm calls for node
  • Add warning where there are no build tags in Golang binary
  • Fix "Successful run" message when there are warnings
  • Log the entire configuration, not a part of it
  • Check for and report errors from isGoExecutable
  • node scan: report warnings as such
  • Hide "found operator" messages under increased verbosity level
  • Do not ignore rpm -qa errors from node scan
  • Add/use getTag, getImage, getComponent to avoid potential nil dereferences
  • Report, do not lose error from filepath.WalkDir
  • Log inner path in node scan
  • scan payload: require either --url or -- file

Performance

  • Store semver in baton
  • Instantiate go semver constraint only once
  • Instantiate go tag mapsets only once
  • Optimize validateGoVersion, add a benchmark
  • Improve regexp use in validateGoTags, add a benchmark
  • validateGoTags: simplify and speedup
  • validateStringsOpenssl: simplify and speedup
  • ReadTable: do not build a map
  • Skip all files with no x bit set
  • Use debug/elf (rather than spawning file tool) to detect static binaries

Code cleanups

  • Removal unused code and variables
  • Unify loop in scanBinary
  • ExpectedSyms: document, refactor, return bool
  • Simplify displayExceptions
  • Remove tag argument from validation functions
  • Move rpm-related functionality to a separate package
  • Simplify file mode check in RunNodeScan
  • Simplify returns from validateTag
  • Simplify return from RunOperatorScan
  • Remove tag and component arguments from ScanBinary

Miscellaneous

  • Add OWNERS file
  • CI: add golangci-lint timeout
  • GH: add dependabot configuration
  • GH: add ok-to-test label to dependabot
  • Add vendor directory
  • CI: add make test
  • CI: test that embedded configs are sane
  • CI: tests for config merge
Assets 2
Loading

0.2.19

11 Jul 20:29
@rphillips rphillips
0.2.19
89cfcda
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
0.2.19

[0.2.19] - 2023-07-11

Bug Fixes

  • Fix remove container create/rm step
  • Remove obsoleted requirements
  • Use RPM name in node scan
  • perf: validaetGoSymbols and skip early
  • perf: compile regexes only once
  • perf: isGoExecutable do not use regexp

Features

  • Add node ignores
  • Add 4.9, 4.10, 4.11, 4.12, 4.13 config files
  • Add warning support and ---fail-on-warnings
Assets 2
Loading

0.2.17

30 Jun 21:52
@kolyshkin kolyshkin
0.2.17
36cf0a0
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
0.2.17

[0.2.17] - 2023-06-30

Bug fixes

  • Fixes to -p output

Features

  • Add support for per-tag ignores
  • Add config file for 4.12
Assets 2
Loading

0.2.16

30 Jun 18:42
@rphillips rphillips
0.2.16
994fbac
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
0.2.16

[0.2.16] - 2023-06-30

Bug fixes

  • Cleanup Go symbols error message
  • Fix PIE executables detection
  • GHA-related fixes to CI
  • Add LICENSE

Features

  • Add support for per-payload image ignores
  • Add exception printer (-p) option
  • Configuration: add more exceptions

Documentation

  • CHANGELOG: cleanup
  • README: add prereqiusites
Assets 2
Loading