ROX-26949: Address EC violations when retagging images#13309
Merged
ROX-26949: Address EC violations when retagging images#13309
Conversation
|
Skipping CI for Draft Pull Request. |
Contributor
|
Images are ready for the commit at fe73f67. To use with deploy scripts, first |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #13309 +/- ##
==========================================
+ Coverage 48.50% 48.53% +0.03%
==========================================
Files 2470 2470
Lines 178320 178403 +83
==========================================
+ Hits 86487 86592 +105
+ Misses 84900 84878 -22
Partials 6933 6933
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
790cc94 to
955fe15
Compare
Contributor
Author
|
/retest collector-slim-retag |
This comment was marked as outdated.
This comment was marked as outdated.
to stop messing up images
How does Konflux know we pushed something somewhere???????
Cos it's nice to see it in UI!
Contributor
Author
|
/retest central-db-on-push |
Contributor
Author
|
/retest main-on-push |
to check if we can build cleanly.
Contributor
Author
EC check resultstl;dr: all clean. The detected collector-fullcollector-slimscannerscanner-dbscanner-db-slimscanner-slim |
kylape
reviewed
Nov 15, 2024
kylape
approved these changes
Nov 15, 2024
tommartensen
approved these changes
Nov 18, 2024
mclasmeier
pushed a commit
that referenced
this pull request
Nov 21, 2024
mclasmeier
pushed a commit
that referenced
this pull request
Nov 22, 2024
mclasmeier
pushed a commit
that referenced
this pull request
Nov 22, 2024
ajheflin
pushed a commit
that referenced
this pull request
Jun 24, 2025
msugakov
added a commit
that referenced
this pull request
Jun 25, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Long intro
This change follows up #13079 to address new EC violations of this kind
My explanation is that the shape of the
retag-pipelineis recorded as one ofcosignartifacts during the build. At the later EC check, this pipeline is analyzed and found invalid. We simply cannot make this pipeline valid without completely changing the approach and I don't have an idea how.As I learned through a number of trials, this recording happens when either or both of the following are present:
retag-imagetask -IMAGE_DIGESTandIMAGE_URLresults are provided. It's even possible when these result names are substrings because there's some weird matching logic (I did not check the code of the corresponding controllers though).retag-pipeline-IMAGE_DIGESTandIMAGE_URLresults.The pipeline information overwrites the original one attached during builds in Collector and Scanner repos which passes EC checks, therefore we need to make the original pipeline information not overridden.
Unfortunately, this happens externally to the pipeline where we don't have control. I believe this is done by a Tekton Chains instance deployed in Konflux. https://tekton.dev/docs/chains/slsa-provenance/#image_url--image_digest
The solution I propose here is to just not produce these results in task and pipeline.
The negative consequence is that the pipelines without
IMAGE_DIGESTandIMAGE_URLresults and without Tekton Chains signing can't update Snapshots (this code looks relevant):No Snapshot updates means no following EC execution and no need in
-retaggedComponents. Therefore, the retag pipelines become Component-less.Recap
IMAGE_DIGESTandIMAGE_URLresults cause Tekton Chains signing.retagpipelines attachesretagpipeline info to image. That fails EC checks.IMAGE_DIGESTandIMAGE_URL.IMAGE_DIGESTandIMAGE_URL-> no Tekton Chains signing -> no Snapshot updates -> no need in-retaggedComponents.Consequences
See here: https://docs.google.com/document/d/1GDmhs4hHRXoNBXt8Wzu5YyLPPhDFfKMbJmH5deNm_xI/edit?tab=t.0#heading=h.hwb5423ut62k
User-facing documentation
Testing and quality
Automated testing
No change there.
How I validated my change
Verified resulting images with
eccli.Note that was done for images retagged with modified
COLLECTOR_VERSIONandSCANNER_VERSION. The reason is that I messed up the original ones during my experiments and they are unrepairably failing EC checks. That'll resolve onceCOLLECTOR_VERSIONandSCANNER_VERSIONget updated in stackroxmaster.