fix synk security errors

ocp-build-data-validator/validator/__main__.py

@@ -1,6 +1,7 @@
 import argparse
 import atexit
 import sys
+import shlex
 from multiprocessing import Pool, cpu_count
 
 from . import format, support, schema, github, distgit, cgit
@@ -81,6 +82,7 @@ def main():
                         action='store_true',
                         help='Only run schema validations')
     args = parser.parse_args()
+    args = {k: shlex.quote(v) if isinstance(v, str) else v for k, v in vars(args).items()}
     print(f"Validating {len(args.files)} file(s)...")
     if args.single_thread:
         for f in args.files:

pyartcd/pyartcd/pipelines/operator_sdk_sync.py

@@ -14,6 +14,8 @@
 from pyartcd.cli import cli, click_coroutine, pass_runtime
 from pyartcd.runtime import Runtime
 
+ARCHES = ["x86_64", "s390x", "ppc64le", "aarch64"]
+
 
 class OperatorSDKPipeline:
     def __init__(self, runtime: Runtime, group: str, assembly: str, nvr: str, prerelease: bool, updatelatest: bool, arches: str) -> None:
@@ -64,6 +66,8 @@ async def run(self):
         sdkVersion = self._get_sdkversion(build)
         self._logger.info(sdkVersion)
         for arch in self.arches.split(','):
+            if arch not in ARCHES:
+                raise Exception(f"Unsupported arch: {arch}")
             self._extract_binaries(arch, sdkVersion, build['extra']['image']['index']['pull'][0])
         if self.assembly:
             self._jira_client.complete_subtask(self.parent_jira_key, "operator-sdk", f"operator_sdk_sync job: {jenkins.get_build_url()}")
@@ -86,10 +90,16 @@ def _extract_binaries(self, arch, sdkVersion, build):
         rarch = brew_arch_for_go_arch(arch)
         tarballFilename = f"{self.sdk}-{sdkVersion}-linux-{rarch}.tar.gz"
 
-        cmd = f"rm -rf ./{rarch} && mkdir ./{rarch}" + \
-              f" && oc image extract {pullspec} --path /usr/local/bin/{self.sdk}:./{rarch}/ --confirm" + \
-              f" && chmod +x ./{rarch}/{self.sdk} && tar -c -z -v --file ./{rarch}/{tarballFilename} ./{rarch}/{self.sdk}" + \
-              f" && ln -s {tarballFilename} ./{rarch}/{self.sdk}-linux-{rarch}.tar.gz && rm -f ./{rarch}/{self.sdk}"
+        cmd = [
+            f"rm -rf ./{rarch} &&",
+            f"mkdir ./{rarch} &&",
+            f"oc image extract {pullspec} --path /usr/local/bin/{self.sdk}:./{rarch}/ --confirm &&",
+            f"chmod +x ./{rarch}/{self.sdk} &&",
+            f"tar -c -z -v --file ./{rarch}/{tarballFilename} ./{rarch}/{self.sdk} &&",
+            f"ln -s {tarballFilename} ./{rarch}/{self.sdk}-linux-{rarch}.tar.gz &&",
+            f"rm -f ./{rarch}/{self.sdk}"
+        ]
+
         self.exec_cmd(cmd)
         if arch == 'amd64' or arch == 'arm64':
             tarballFilename = f"{self.sdk}-{sdkVersion}-darwin-{rarch}.tar.gz"

pyartcd/pyartcd/pipelines/rebuild.py

@@ -57,7 +57,7 @@ def __init__(self, runtime: Runtime, group: str, assembly: str, plashet_remote:
 
         # sets environment variables for Doozer
         self._doozer_env_vars = os.environ.copy()
-        self._doozer_env_vars["DOOZER_WORKING_DIR"] = str(self.runtime.working_dir / "doozer-working")
+        self._doozer_working_dir = str(self.runtime.working_dir / "doozer-working")
 
         if not ocp_build_data_url:
             ocp_build_data_url = self.runtime.config.get("build_config", {}).get("ocp_build_data_url",
@@ -385,7 +385,7 @@ async def _build_plashets(self, timestamp: str, el_version: int, group_config: D
 
     def _generate_repo_file_for_image(self, file: TextIOWrapper, plashets: Iterable[PlashetBuildResult], arches):
         # Copy content of .oit/signed.repo in the distgit repo
-        source_path = Path(self._doozer_env_vars["DOOZER_WORKING_DIR"]) / f"distgits/containers/{self.dg_key}/.oit/signed.repo"
+        source_path = Path(self._doozer_working_dir) / f"distgits/containers/{self.dg_key}/.oit/signed.repo"
         repo_content = source_path.read_text()
 
         yum_repos = ConfigParser()
@@ -500,7 +500,7 @@ async def _build_image(self, repo_url: str) -> List[str]:
         if self.runtime.dry_run:
             return []
         # parse record.log
-        with open(Path(self._doozer_env_vars["DOOZER_WORKING_DIR"]) / "record.log", "r") as file:
+        with open(Path(self._doozer_working_dir) / "record.log", "r") as file:
             record_log = parse_record_log(file)
             return record_log["build"][-1]["nvrs"].split(",")
 
@@ -528,7 +528,7 @@ async def _rebase_and_build_rpm(self, release: str) -> List[str]:
             return []
 
         # parse record.log
-        with open(Path(self._doozer_env_vars["DOOZER_WORKING_DIR"]) / "record.log", "r") as file:
+        with open(Path(self._doozer_working_dir) / "record.log", "r") as file:
             record_log = parse_record_log(file)
             return record_log["build_rpm"][-1]["nvrs"].split(",")