Repository navigation
fix: refuse an image built while its context changed - #733
Merged
Merged
Conversation
The cache key is hashed before `buildah build` starts, but buildah reads the context as each `COPY` runs. A file saved during an earlier `RUN` therefore landed in an image tagged with the key of the content from before the edit, and restoring that content later cache-hit and served the edited image. The key is now hashed again once buildah finishes and before anything is named, and compared with the caller's tag. On a mismatch the temporary image is discarded, nothing is tagged, and the build fails with the new OutrigError::BuildContextChanged. It is an error rather than a rebuild because the session record, `outrig build` and ensure_tagged_image_for all hold a tag computed up front, and the edited content can only hash to a different one. A rerun keys it, and buildah's layer cache keeps that short. build_image_for and ensure_tagged_image_for[_with_output] now expect the tag compute_tag_for gave for the same inputs, and refuse any other the same way once their build has run. Three fake-runtime tests and one e2e that handed a build a made-up tag now pass a computed one. Fixes #392
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The cache key is hashed before
buildah buildstarts, but buildah reads the context as eachCOPYruns. A file saved during an earlierRUNtherefore landed in an image tagged with the key of the content from before the edit, and restoring that content later cache-hit and served the edited image.The key is now hashed again once buildah finishes and before anything is named, and compared with the caller's tag. On a mismatch the temporary image is discarded, nothing is tagged, and the build fails with the new OutrigError::BuildContextChanged. It is an error rather than a rebuild because the session record,
outrig buildand ensure_tagged_image_for all hold a tag computed up front, and the edited content can only hash to a different one. A rerun keys it, and buildah's layer cache keeps that short.build_image_for and ensure_tagged_image_for[_with_output] now expect the tag compute_tag_for gave for the same inputs, and refuse any other the same way once their build has run. Three fake-runtime tests and one e2e that handed a build a made-up tag now pass a computed one.
Fixes #392
Summary
What does this change, and why?
Checklist
cargo fmt --all -- --checkpassescargo clippy --workspace --all-targets -- -D warningsis cleancargo test --workspacepassesdoc/updated if behavior changed (mdbook buildstill clean)Notes for reviewers
Anything worth calling out -- tricky bits, follow-ups, or intentionally out-of-scope items.