Issue #350: [audit] Whitelist allowed koji tags - fm-orchestrator

fm-orchestrator

#350 [audit] Whitelist allowed koji tags

Closed: Fixed Feb 28, 2017 Opened Feb 23, 2017 by puiterwijk.

The way the tag makes it from the packagers' commit to the actual GenericBuilder is via a long path, but the actual GenericBuilder should check that the tag name is something "sane".
As an example, maybe add a whitelist 'module-*' or something.
That would prevent any chances of tags getting set to 'f26' or the likes via some weird ways.

ralph commented Feb 23, 2017

/cc @mprahl /cc @fivaldi

ralph commented Feb 23, 2017

The whitelist should be configurable, so if we set it to whitelite to 'module-*' today, we can change it two years from now if we need to name module tags differently then.

fivaldi commented Feb 24, 2017

I agree that it should be configurable. And perhaps a list of prefixes/wildcard strings, e.g.:
['module-*', 'yet-another-module-*'] ?

ralph commented Feb 24, 2017

Yes, that looks great @fivaldi.

Metadata Update from @fivaldi:
- Issue assigned to fivaldi

Feb 24, 2017

ralph commented Feb 27, 2017

See #356.

fivaldi commented Feb 28, 2017

Commits a4366d9 and be3b05e fix this issue.

Metadata Update from @fivaldi:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Feb 28, 2017