Network setup of builders

seth vidal skvidal at fedoraproject.org
Wed Jun 26 14:53:46 UTC 2013


On Wed, 26 Jun 2013 16:43:39 +0200
Miroslav Suchy <msuchy at redhat.com> wrote:

> Seth,
> is is possible to set up builders that the they will have very
> limited network connections? Probably just to copr-be or copr-fe?
> 
> I'm asking because currently you can do nearly everything on builder. 
> For example I made evil.spec, which have
> 
> %prep
> wget http://www.googl.com -O index.html
> cat index.html
> 
> Which is executed without problem:
> http://copr-be.cloud.fedoraproject.org/results/msuchy/copr/fedora-18-x86_64/evil-1-1.fc19/build.log
> 
> Of course instead wget I can e.g start my own ssh server or botnet.
> And I will own that machine until our timeout expire.
> 
> On Koji we do not have such problem because builders are configured
> to not allow any internet connections.
> 
> Right now we need internet connection on builders, because they need
> to download src.rpm. But this can be fixed that user will not provide
> url to src.rpm, but they will upload it to cloud-fe. This will be
> save, because we will store and behave to src.rpm just as binary file
> and only store it in some directory and not parse it.
> 
> Builder can then pick it up from copr-fe. Either by downloading from 
> some http export or via nfs read only share.
> 
> Opinions?
> \

Mirek, 
All of the above is on purpose and intentional.

Here's why:

1. remember that the user can add random repos to their mock configs in
addition to the urls for their own srpms. Those repos can be from
anywhere - not just from coprs. This is on purpose - so we can support
a wide variety of systems and packages - w/ buildreqs from all over.

2. uploading a 400-1GB pkg to cloud-fe will murder it. Fetching the file
and putting limits on the fetch are MUCH easier

3. the whole point of evil in the builder is that we don't care - the
builders are destroyed once they are used and they do not contain ANY
sensitive information. Furthermore, they are timed out if they are
hanging out for too long.

Remember coprs is not koji and koji is not coprs.  Coprs is not a koji
replacement. Coprs is for the space that Koji does not want to and
should not occupy - The untrusted build.

Koji is about creating trusted builds from trusted sources and trusted
contributors.

Coprs is about building pkgs from untrusted sources and
potentially untrusted contributors. This is why we don't touch the rpm
on any system AS an rpm. We only deal with it as files. 

So if we were to implement your suggestions we would eliminate:
 1. external repositories of any kind
 2. pkgs above a certain size
 3. pkgs requiring interesting network access to build.

That's not what we want, it's not what our scope or goal is, either.

Does that help explain?

-sv


More information about the copr-devel mailing list