Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-64683

[v2] oc-mirror sets unintended executable flag on some synchronized files.

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Low
    • None
    • None
    • None
    • CLID Sprint 279
    • 1
    • Proposed
    • Bug Fix
    • Hide
      Before this update, during the mirror operation, `oc-mirror` inadvertently set the executable flag on some synchronized files that did not contain executable code or scripts, potentially causing unexpected execution. With this release, unintended executable flags have been removed from the synchronized files. As a result, correct file permissions are set, preventing unintended execution of synchronized files. (link:https://issues.redhat.com/browse/OCPBUGS-64683[OCPBUGS-64683])
      Show
      Before this update, during the mirror operation, `oc-mirror` inadvertently set the executable flag on some synchronized files that did not contain executable code or scripts, potentially causing unexpected execution. With this release, unintended executable flags have been removed from the synchronized files. As a result, correct file permissions are set, preventing unintended execution of synchronized files. (link: https://issues.redhat.com/browse/OCPBUGS-64683 [ OCPBUGS-64683 ])
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-63030. The following is the description of the original issue:

      This is a clone of issue OCPBUGS-55489. The following is the description of the original issue:

      Description of problem:

      oc-mirror sets unintended executable flag on some synchronized files.

      Version-Release number of selected component (if applicable):

       ~]$ ./oc-mirror version
      W0429 17:11:59.854601   30754 mirror.go:102]⚠️  oc-mirror v1 is deprecated (starting in 4.18 release) and will be removed in a future release - please migrate to oc-mirror --v2WARNING: This version information is deprecated and will be replaced with the output from --short. Use --output=yaml|json to get the full version.
      Client Version: version.Info{Major:"", Minor:"", GitVersion:"4.18.0-202504151633.p0.geafda94.assembly.stream.el9-eafda94", GitCommit:"eafda94b0dfae255df38d41749912dd0c0988cf3", GitTreeState:"clean", BuildDate:"2025-04-15T20:04:31Z", GoVersion:"go1.22.12 (Red Hat 1.22.12-2.el8_10) X:strictfipsruntime", Compiler:"gc", Platform:"linux/amd64"}
      

      How reproducible:

      1. Create ImagesetConfigFile
      
       ~]$ cat isc.yaml
      kind: ImageSetConfiguration
      apiVersion: mirror.openshift.io/v2alpha1
      mirror: 
        operators: 
        - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17       
          packages:
          - name: "local-storage-operator"
      
      
      2. Do Mirror to Mirror
      
      ~]$ ./oc-mirror --v2  --config isc.yaml --workspace file://docker-sync/ws --cache-dir docker-sync/cache  docker://mirror-registry.lab.domain.com:8443/ocp-docker-local 
       
      2025/04/29 16:27:29  [INFO]   : 👋 Hello, welcome to oc-mirror
      2025/04/29 16:27:29  [INFO]   : ⚙️  setting up the environment for you...
      2025/04/29 16:27:29  [INFO]   : 🔀 workflow mode: mirrorToMirror
      <<snip>>
      2025/04/29 16:53:48  [INFO]   : === Results ===
      2025/04/29 16:53:48  [INFO]   :  ✓  7 / 7 operator images mirrored successfully
      
      
      3. See the generated files:
      
      ~]$ find docker-sync/ -type f -executable -exec ls {} +
      
      docker-sync/ws/working-dir/operator-catalogs/redhat-operator-index/ef45a7eee141b2415445a819d463885141d0ba91c96b1c759d8c311ae3846c60/filtered-catalogs/00627c2e1b0b94ce9f43bbf0cf8aef0a/digest
      docker-sync/ws/working-dir/operator-catalogs/redhat-operator-index/ef45a7eee141b2415445a819d463885141d0ba91c96b1c759d8c311ae3846c60/filtered-catalogs/00627c2e1b0b94ce9f43bbf0cf8aef0a/filtered-catalog-image/blobs/sha256/6e23d3d90ee7581cb37dc7b5e35dcc15e2386c10afc2d5b83dc4480de7bb72fe
      
      
      Same thing after deleting images:
      ~~~
       ~]$ cat delete-isc.yaml
      kind: DeleteImageSetConfiguration
      apiVersion: mirror.openshift.io/v2alpha1
      delete:
       operators:
       - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17
         packages:
         - name: "local-storage-operator"
      
      ~]$ ./oc-mirror --v2 --workspace file://docker-sync/ws --cache-dir docker-sync/cache --authfile ~/.config/podman/combined.json delete docker://vm-235-224.vmware.gsslab.pnq2.redhat.com:8443/ocp-docker-local --config delete-isc.yaml --generate --delete-id AUTO
      
      
       ~]$ ll docker-sync/ws/working-dir/delete/
      total 8
      -rwxr-xr-x. 1 quickcluster quickcluster 2018 Apr 29 17:33 delete-images-AUTO.yaml
      -rwxr-xr-x. 1 quickcluster quickcluster  238 Apr 29 17:33 delete-imageset-config-AUTO.yaml
      

      Actual results:

      oc-mirror sets unintended executable flag on some synchronized files.

      Expected results:

      No generated file has the execution flag set unless that file contains executable code or scripts. (Which doesn't appear to be the case for any file observed)

      Additional info:

          

              rh-ee-aguidi Alex Guidi
              rhn-support-duge Dushyant Uge
              Nidan Gavali
              None
              Nidan Gavali Nidan Gavali
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: