Skip to content

Conversation

@thaJeztah
Copy link
Member

When building rpm (and deb) packages, binaries are built from a source tarball.
Source tarballs will only include the raw source code, but do not include the
git repository;

rpmbuild/SOURCES/scan-cli-plugin.tgz:
mkdir -p $(@D)
docker run --rm -w /v \
-v $(realpath $(CURDIR)/../src/github.com/docker/scan-cli-plugin):/scan-cli-plugin \
-v $(CURDIR)/$(@D):/v \
alpine \
tar -C / -c -z -f /v/scan-cli-plugin.tgz --exclude .git scan-cli-plugin

tar -C / -c -z -f /v/scan-cli-plugin.tgz --exclude .git scan-cli-plugin

Because of this, the makefile used to build the scan-cli-plugin binaries will
not be able to determine the "commit" (and version) to set as build-time variable
to include in the --version output; https://github.com/docker/scan-cli-plugin/blob/3eaac3e88412543fb18767feb697e11dca21d20f/builder.Makefile#L5-L19
resulting in both version and git commit to be empty in the version output:

docker scan --version
Version:
Git commit:
Provider:   Snyk (1.563.0 (standalone))

This patch updates the RPM spec to add variables for passing this information,
and collects the commit and version from the host to pass it to the build-
container in which the RPMs are built, similar to how they're passed for the
equivalent "deb" build-containers (which use env-vars for this);

-e SCAN_VERSION=$(DOCKER_SCAN_REF) \
-e SCAN_GITCOMMIT=$(SCAN_GITCOMMIT) \

Before:

docker scan --version
Version:
Git commit:
Provider:   Snyk (1.563.0 (standalone))

docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
  scan: Docker Scan (Docker Inc.)
...

After:

docker scan --version
Version:    v0.8.0
Git commit: 35651ca
Provider:   Snyk (1.563.0 (standalone))

docker info

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
  scan: Docker Scan (Docker Inc., v0.8.0)
...

When building rpm (and deb) packages, binaries are built from a source tarball.
Source tarballs will only include the raw source code, but do not include the
git repository; https://github.com/docker/docker-ce-packaging/blob/c4c2d89b4e22ff484b08f138ca05b6098077590c/rpm/Makefile#L110-L116

    tar -C / -c -z -f /v/scan-cli-plugin.tgz --exclude .git scan-cli-plugin

Because of this, the makefile used to build the scan-cli-plugin binaries will
not be able to determine the "commit" (and version) to set as build-time variable
to include in the `--version` output; https://github.com/docker/scan-cli-plugin/blob/3eaac3e88412543fb18767feb697e11dca21d20f/builder.Makefile#L5-L19
resulting in both `version` and `git commit` to be empty in the version output:

    docker scan --version
    Version:
    Git commit:
    Provider:   Snyk (1.563.0 (standalone))

This patch updates the RPM spec to add variables for passing this information,
and collects the commit and version from the host to pass it to the build-
container in which the RPMs are built, similar to how  they're passed for the
equivalent "deb" build-containers (which use env-vars for this);
https://github.com/docker/docker-ce-packaging/blob/c4c2d89b4e22ff484b08f138ca05b6098077590c/deb/Makefile#L36-L37

Before:

    docker scan --version
    Version:
    Git commit:
    Provider:   Snyk (1.563.0 (standalone))

    docker info
    Client:
     Context:    default
     Debug Mode: false
     Plugins:
      app: Docker App (Docker Inc., v0.9.1-beta3)
      buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
      scan: Docker Scan (Docker Inc.)
    ...

After:

    docker scan --version
    Version:    v0.8.0
    Git commit: 35651ca
    Provider:   Snyk (1.563.0 (standalone))

    docker info

    Client:
     Context:    default
     Debug Mode: false
     Plugins:
      app: Docker App (Docker Inc., v0.9.1-beta3)
      buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
      scan: Docker Scan (Docker Inc., v0.8.0)
    ...

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
Copy link
Member Author

@fredericdalleau @glours @StefanScherer ptal

also opened a backport for 20.10: #550

Copy link
Contributor

@glours glours left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LTGM
Thanks @thaJeztah 🙏

Copy link
Contributor

@fredericdalleau fredericdalleau left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Member

@StefanScherer StefanScherer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fredericdalleau fredericdalleau merged commit 3f7664e into docker:master Jun 2, 2021
@thaJeztah thaJeztah deleted the fix_scan_cli_version branch June 2, 2021 09:26
@thaJeztah thaJeztah changed the title rpm: scan-cli-plugin: fix build-time "version" and "commit" variables [master] rpm: scan-cli-plugin: fix build-time "version" and "commit" variables Jul 28, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants