Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for untrusted CNB builders

Browse Source 
A `trustBuilder` configuration option has been added to the Maven and
Gradle CNB integration image building goal and task. A known set of
builders published by Paketo, Heroku, and Google are trusted by default,
all other builders are untrusted by default.

Closes gh-41352
This commit is contained in:
Scott Frederick
2024-07-11 11:43:38 -05:00
parent c848a5e3ed
commit 224b06982e
62 changed files with 1654 additions and 207 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
spring-boot-system-tests/spring-boot-image-tests/src/systemTest/java/org/springframework/boot/image/paketo/PaketoBuilderTests.java
View File

@@ -48,7 +48,6 @@ import org.springframework.boot.image.junit.GradleBuildInjectionExtension;
import org.springframework.boot.testsupport.gradle.testkit.GradleBuild;
import org.springframework.boot.testsupport.gradle.testkit.GradleBuildExtension;
import org.springframework.boot.testsupport.gradle.testkit.GradleVersions;
import org.springframework.util.StringUtils;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.entry;
@@ -85,6 +84,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName);
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -116,6 +116,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName);
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withCommand("--server.port=9090");
container.withExposedPorts(9090);
@@ -133,6 +134,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName);
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -159,6 +161,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName, "assemble", "bootDistZip");
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -195,6 +198,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName, "assemble", "bootDistZip");
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -232,6 +236,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName);
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -264,6 +269,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName);
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -310,6 +316,7 @@ class PaketoBuilderTests {
ImageReference imageReference = ImageReference.of(ImageName.of(imageName));
BuildResult result = buildImage(imageName);
assertThat(result.task(":bootBuildImage").getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
assertThat(result.getOutput()).contains("Running creator");
try (GenericContainer<?> container = new GenericContainer<>(imageName)) {
container.withExposedPorts(8080);
container.waitingFor(Wait.forHttp("/test")).start();
@@ -333,9 +340,11 @@ class PaketoBuilderTests {
}
private BuildResult buildImage(String imageName, String... arguments) {
String[] buildImageArgs = { "bootBuildImage", "--imageName=" + imageName, "--pullPolicy=IF_NOT_PRESENT" };
String[] args = StringUtils.concatenateStringArrays(arguments, buildImageArgs);
return this.gradleBuild.build(args);
List<String> args = new ArrayList<>(List.of(arguments));
args.add("bootBuildImage");
args.add("--imageName=" + imageName);
args.add("--pullPolicy=IF_NOT_PRESENT");
return this.gradleBuild.build(args.toArray(new String[0]));
}
private void writeMainClass() throws IOException {