Before this commit, when the child image affected by CVE was rebuilt
and its parent image was not affected by the CVE, the parent image
was kept in the original NVR.
This is unfortunate behavior, because the original NVR of parent image
can contain CVE which is already fixed in latest released release of
the parent image.
In this commit, Freshmaker tries to find out the latest released
parent container image and use it instead of the original NVR.
It does it in very safe way which won't covert 100% of cases, but it
is good enough to be used as a first step to cover majority of cases.
The commit covers only following case:
The parent image must have the auto_rebuild_tags set in its container
repository. This is needed in order to find out the available tags
in container repository with multiple tags. In case the parent image
does not have auto_rebuild_tags set, the original parent NVR is used.
The latest parent image must have the same Name and Version as
the original parent NVR. This prevents upgrades for example from
python-2.7-1 parent container image to python-3.3-1 parent container image.
The latest parent image must appear in the same container repository as
the original parent image.
Before this commit, when the child image affected by CVE was rebuilt
and its parent image was not affected by the CVE, the parent image
was kept in the original NVR.
This is unfortunate behavior, because the original NVR of parent image
can contain CVE which is already fixed in latest released release of
the parent image.
In this commit, Freshmaker tries to find out the latest released
parent container image and use it instead of the original NVR.
It does it in very safe way which won't covert 100% of cases, but it
is good enough to be used as a first step to cover majority of cases.
The commit covers only following case:
auto_rebuild_tagsset in its containerrepository. This is needed in order to find out the available tags
in container repository with multiple tags. In case the parent image
does not have
auto_rebuild_tagsset, the original parent NVR is used.the original parent NVR. This prevents upgrades for example from
python-2.7-1 parent container image to python-3.3-1 parent container image.
the original parent image.