feat: support "Pro" archives #167
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In chisel.yaml, archive definitions can now use the "pro" value to specify Ubuntu Pro archives. The `archives.<archive>.pro` value currently accepts the following values: "fips", "fips-updates", "apps" and "infra". Any other values are ignored. By default, Chisel will look for credentials in the `/etc/apt/auth.conf.d/` directory, unless the environment variable `CHISEL_AUTH_DIR` is set. In which case, it will look for configuration files in that directory. The configuration files may only have the ".conf" extensions or no extensions, the format is described in https://manpages.debian.org/testing/apt/apt_auth.conf.5.en.html.
niemeyer
requested changes
Nov 11, 2024
cjdcordeiro
requested changes
Nov 12, 2024
cjdcordeiro
requested changes
Nov 13, 2024
.github/workflows/pro_tests.yaml
Outdated
There was a problem hiding this comment.
Thanks for this @letFunny .
I'd propose something different here, just to avoid leaking the real Pro token.
Atm, you're attaching multiple times - 1 for the real-archive-tests job, within the GH runner; and the 1+ within the spread tasks.
An oversight or injection of malicious tests could compromise this token.
Instead, since Chisel only needs the APT creds, I'd propose the following flow:
- have an initial job that sets up the Pro subscription
- save the APT creds as a GitHub output
- share that output with the
real-archive-testsjob - share that same output with the spread job too
You may raise the point: "you might still leak the APT creds". True. I'm not sure if those bearer tokens ever expire, but in any case, with the Pro token you can also get them, plus more.
niemeyer
approved these changes
Nov 15, 2024
| }, | ||
| } | ||
|
|
||
| func archiveURL(pro, arch string) (string, *credentials, error) { |
There was a problem hiding this comment.
Function looks good now, thanks.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In chisel.yaml, archive definitions can now use the "pro" value to specify Ubuntu Pro archives. The
archives.<archive>.provalue currently accepts the following values: "fips", "fips-updates", "apps" and "infra". Any other values are ignored.By default, Chisel will look for credentials in the
/etc/apt/auth.conf.d/directory, unless the environment variableCHISEL_AUTH_DIRis set. In which case, it will look for configuration files in that directory. The configuration files may only have the ".conf" extensions or no extensions, the format is described in https://manpages.debian.org/testing/apt/apt_auth.conf.5.en.html.