#408 Use the latest published release of parent image in most cases.
Merged by jkaluza. Opened by jkaluza.
jkaluza/freshmaker depends  into  master

Download 408.patch

Before this commit, when the child image affected by CVE was rebuilt
and its parent image was not affected by the CVE, the parent image
was kept in the original NVR.

This is unfortunate behavior, because the original NVR of parent image
can contain CVE which is already fixed in latest released release of
the parent image.

In this commit, Freshmaker tries to find out the latest released
parent container image and use it instead of the original NVR.

It does it in very safe way which won't covert 100% of cases, but it
is good enough to be used as a first step to cover majority of cases.

The commit covers only following case:

  • The parent image must have the auto_rebuild_tags set in its container
    repository. This is needed in order to find out the available tags
    in container repository with multiple tags. In case the parent image
    does not have auto_rebuild_tags set, the original parent NVR is used.
  • The latest parent image must have the same Name and Version as
    the original parent NVR. This prevents upgrades for example from
    python-2.7-1 parent container image to python-3.3-1 parent container image.
  • The latest parent image must appear in the same container repository as
    the original parent image.

rebased onto f05bee9c0dc4e7404da0b81c87ed8a938aa9d18b

@jkalina, could you document this new behavior?
Also, can you list the use cases that are not covered?

It would be nice if find_parent_images_with_package actually explained these variables.

@lucarval you probably mean @jkaluza ;)

I do. Apologies for the noise!

It's quite long explanation which is already included elsewhere in the code. I can copy-paste it here, but it duplicates that info.

@lucarval, I will document that as part of another documentation PR I'm working on right now.

Commit db4c8135 fixes this pull-request

Pull-Request has been merged by jkaluza

Pull-Request has been merged by jkaluza

Metadata