peridot/apollo/workflow/workflow.go

453 lines
16 KiB
Go
Raw Normal View History

2022-07-07 20:11:50 +00:00
// Copyright (c) All respective contributors to the Peridot Project. All rights reserved.
// Copyright (c) 2021-2022 Rocky Enterprise Software Foundation, Inc. All rights reserved.
// Copyright (c) 2021-2022 Ctrl IQ, Inc. All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice,
// this list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
// this list of conditions and the following disclaimer in the documentation
// and/or other materials provided with the distribution.
//
// 3. Neither the name of the copyright holder nor the names of its contributors
// may be used to endorse or promote products derived from this software without
// specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
2022-10-30 01:59:25 +00:00
package workflow
2022-07-07 20:11:50 +00:00
import (
"database/sql"
"fmt"
"github.com/gobwas/glob"
"github.com/sirupsen/logrus"
"github.com/spf13/viper"
2022-10-30 01:59:25 +00:00
"go.temporal.io/sdk/client"
apollodb "peridot.resf.org/apollo/db"
apollopb "peridot.resf.org/apollo/pb"
"peridot.resf.org/apollo/rherrata"
"peridot.resf.org/apollo/rhsecurity"
"peridot.resf.org/apollo/rpmutils"
2022-07-07 20:11:50 +00:00
"peridot.resf.org/koji"
2022-10-30 01:59:25 +00:00
"peridot.resf.org/utils"
2022-07-07 20:11:50 +00:00
"strconv"
"strings"
)
2022-10-30 01:59:25 +00:00
var forceKoji koji.API
type Controller struct {
log *logrus.Logger
temporal client.Client
db apollodb.Access
mainQueue string
errata rherrata.APIService
security rhsecurity.DefaultApi
vendor string
2022-07-07 20:11:50 +00:00
}
2022-10-30 01:59:25 +00:00
type Koji struct {
Endpoint string
Compose string
ModuleCompose string
}
2022-07-07 20:11:50 +00:00
2022-10-30 01:59:25 +00:00
type NewControllerInput struct {
Temporal client.Client
Database apollodb.Access
MainQueue string
}
type Option func(c *Controller)
2022-07-07 20:11:50 +00:00
2022-10-30 01:59:25 +00:00
func WithSecurityAPI(api rhsecurity.DefaultApi) Option {
return func(c *Controller) {
c.security = api
2022-07-07 20:11:50 +00:00
}
2022-10-30 01:59:25 +00:00
}
2022-07-07 20:11:50 +00:00
2022-10-30 01:59:25 +00:00
func WithErrataAPI(api rherrata.APIService) Option {
return func(c *Controller) {
c.errata = api
}
}
// NewController returns a new workflow controller. It is the entry point for the Temporal worker.
// Usually each project share a common controller with different workflows and activities enabled
// in the `cmd` package.
func NewController(input *NewControllerInput, opts ...Option) (*Controller, error) {
c := &Controller{
log: logrus.New(),
temporal: input.Temporal,
db: input.Database,
mainQueue: input.MainQueue,
vendor: viper.GetString("vendor"),
}
for _, opt := range opts {
opt(c)
2022-07-07 20:11:50 +00:00
}
2022-10-30 01:59:25 +00:00
return c, nil
2022-07-07 20:11:50 +00:00
}
// productName simply appends major version to `Red Hat Enterprise Linux`
func productName(majorVersion int32) string {
return fmt.Sprintf("Red Hat Enterprise Linux %d", majorVersion)
}
// affectedProductNameForArchAndVersion creates appropriate upstream product names for arch and version
// This is then used to parse affected packages
func affectedProductNameForArchAndVersion(arch string, majorVersion int32) string {
var archString string
switch arch {
case "x86_64":
archString = "x86_64"
break
case "aarch64":
archString = "ARM 64"
break
case "ppc64le":
archString = "Power, little endian"
break
case "s390x":
archString = "IBM z Systems"
break
default:
archString = "UnknownBreakOnPurpose"
break
}
return fmt.Sprintf("Red Hat Enterprise Linux for %s 8", archString)
}
// productState returns appropriate proto type for string states
2022-10-30 01:59:25 +00:00
func productState(state string) apollopb.AffectedProduct_State {
2022-07-07 20:11:50 +00:00
switch state {
case "Under investigation":
2022-10-30 01:59:25 +00:00
return apollopb.AffectedProduct_STATE_UNDER_INVESTIGATION_UPSTREAM
2022-07-07 20:11:50 +00:00
case "Not affected":
2022-10-30 01:59:25 +00:00
return apollopb.AffectedProduct_STATE_UNKNOWN
2022-07-07 20:11:50 +00:00
case "Will not fix":
2022-10-30 01:59:25 +00:00
return apollopb.AffectedProduct_STATE_WILL_NOT_FIX_UPSTREAM
2022-07-07 20:11:50 +00:00
case "Out of support scope":
2022-10-30 01:59:25 +00:00
return apollopb.AffectedProduct_STATE_OUT_OF_SUPPORT_SCOPE
2022-07-07 20:11:50 +00:00
case "Affected":
2022-10-30 01:59:25 +00:00
return apollopb.AffectedProduct_STATE_AFFECTED_UPSTREAM
2022-07-07 20:11:50 +00:00
default:
2022-10-30 01:59:25 +00:00
return apollopb.AffectedProduct_STATE_UNDER_INVESTIGATION_UPSTREAM
2022-07-07 20:11:50 +00:00
}
}
// checkProduct is used to check and validate CVE package states and releases
2022-10-30 01:59:25 +00:00
func (c *Controller) checkProduct(tx apollodb.Access, cve *apollodb.CVE, shortCode *apollodb.ShortCode, product *apollodb.Product, productState apollopb.AffectedProduct_State, packageName string, advisory *string) bool {
2022-07-07 20:11:50 +00:00
// Re-create a valid product name using the short code prefix and major version.
// Example: Red Hat Enterprise Linux 8 translates to Rocky Linux 8 for the short code `RL`.
2022-10-30 01:59:25 +00:00
// Check `//apollo:seed.sql` for more info
mirrorProductName := fmt.Sprintf("%s %d", product.RedHatProductPrefix.String, product.RedHatMajorVersion.Int32)
2022-07-07 20:11:50 +00:00
// Get the affected product if exists
affectedProduct, err := tx.GetAffectedProductByCVEAndPackage(cve.ID, packageName)
if err != nil {
// The affected product does not exist, so we can mark this product as affected if this product exists
if err == sql.ErrNoRows {
// Check if the current package name matches an NVR and if we have a non-NVR variant
skipCreate := false
2022-10-30 01:59:25 +00:00
epochlessPackage := rpmutils.Epoch().ReplaceAllString(packageName, "")
if rpmutils.NVR().MatchString(epochlessPackage) {
nvr := rpmutils.NVR().FindStringSubmatch(epochlessPackage)
2022-07-07 20:11:50 +00:00
affectedProduct, err = tx.GetAffectedProductByCVEAndPackage(cve.ID, nvr[1])
if err == nil {
skipCreate = true
}
}
if !skipCreate {
// Get the mirrored product name product if exists (this should exist if supported)
// Example: Rocky Linux only supports 8 so we will only have `Rocky Linux 8` in our supported products
// In the future, when we support 8 and 9 at the same time, we only need to add `Rocky Linux 9` to start
// mirroring errata for el9 packages
product, err := tx.GetProductByNameAndShortCode(mirrorProductName, shortCode.Code)
if err != nil {
// Product isn't supported so skip
if err == sql.ErrNoRows {
logrus.Infof("Product %s not supported", mirrorProductName)
return true
} else {
logrus.Errorf("could not get product: %v", err)
return true
}
}
// If product state isn't set to unknown (usually when product isn't affected)
// create a new affected product entry for the CVE
2022-10-30 01:59:25 +00:00
if productState != apollopb.AffectedProduct_STATE_UNKNOWN {
2022-07-07 20:11:50 +00:00
affectedProduct, err = tx.CreateAffectedProduct(product.ID, cve.ID, int(productState), product.CurrentFullVersion, packageName, advisory)
if err != nil {
logrus.Errorf("could not create affected product: %v", err)
return true
}
logrus.Infof("Added product %s (%s) to %s with state %s", mirrorProductName, packageName, cve.ID, productState.String())
}
}
} else {
logrus.Errorf("could not get affected product: %v", err)
return true
}
}
// We don't use else because this may change if a non-NVR variant is found
if err == nil {
// If the state isn't set to unknown (it is then usually queued for deletion)
2022-10-30 01:59:25 +00:00
if productState != apollopb.AffectedProduct_STATE_UNKNOWN {
2022-07-07 20:11:50 +00:00
// If it's already in that state, skip
if int(productState) == affectedProduct.State {
return true
}
// If the affected product is set to FixedDownstream and we're trying to set it to FixedUpstream, skip
2022-10-30 01:59:25 +00:00
if affectedProduct.State == int(apollopb.AffectedProduct_STATE_FIXED_DOWNSTREAM) && productState == apollopb.AffectedProduct_STATE_FIXED_UPSTREAM {
2022-07-07 20:11:50 +00:00
return true
}
err := tx.UpdateAffectedProductStateAndPackageAndAdvisory(affectedProduct.ID, int(productState), packageName, advisory)
if err != nil {
logrus.Errorf("could not update affected product state: %v", err)
return true
}
logrus.Infof("Updated product %s (%s) on %s with state %s", mirrorProductName, packageName, cve.ID, productState.String())
} else {
// Delete affected product if state is set to Unknown
// That means that the product is set as NotAffected
err = tx.DeleteAffectedProduct(affectedProduct.ID)
if err != nil {
logrus.Errorf("could not delete unaffected product: %v", err)
return true
}
logrus.Infof("Product %s (%s) not affected by %s", mirrorProductName, packageName, cve.ID)
}
}
return false
}
2022-10-30 01:59:25 +00:00
func (c *Controller) isNvrIdentical(build *koji.Build, nvr []string) bool {
2022-07-07 20:11:50 +00:00
// Join all release bits and remove the dist tag (because sometimes downstream forks do not match the upstream dist tag)
// Example: Rocky Linux 8.3 initial build did not tag updated RHEL packages as el8_3, but as el8
2022-10-30 01:59:25 +00:00
joinedRelease := rpmutils.Dist().ReplaceAllString(strings.TrimSuffix(strings.Join(nvr[2:], "."), "."), "")
2022-07-07 20:11:50 +00:00
// Remove all module release bits (to make it possible to actually match NVR)
2022-10-30 01:59:25 +00:00
joinedRelease = rpmutils.ModuleDist().ReplaceAllString(joinedRelease, "")
2022-07-07 20:11:50 +00:00
// Same operations for the build release
2022-10-30 01:59:25 +00:00
buildRelease := rpmutils.Dist().ReplaceAllString(build.Release, "")
buildRelease = rpmutils.ModuleDist().ReplaceAllString(buildRelease, "")
2022-07-07 20:11:50 +00:00
// Check if package name, version matches and that the release prefix matches
// The reason we're only checking for prefix in release is that downstream
// builds may append `.1` or something else
// Example: Rocky Linux appends `.rocky` to modified packages
if build.PackageName == nvr[0] && build.Version == nvr[1] && strings.HasPrefix(buildRelease, joinedRelease) {
return true
}
return false
}
2022-10-30 01:59:25 +00:00
func (c *Controller) checkForIgnoredPackage(ignoredPackages []string, packageName string) (bool, error) {
2022-07-07 20:11:50 +00:00
for _, ignoredPackage := range ignoredPackages {
g, err := glob.Compile(ignoredPackage)
if err != nil {
return false, err
}
if g.Match(packageName) {
return true, nil
}
}
return false, nil
}
2022-10-30 01:59:25 +00:00
func (c *Controller) checkForRebootSuggestedPackage(pkgs []string, packageName string) (bool, error) {
for _, p := range pkgs {
g, err := glob.Compile(p)
if err != nil {
return false, err
}
if g.Match(packageName) {
return true, nil
}
}
return false, nil
}
func (c *Controller) checkKojiForBuild(tx apollodb.Access, ignoredPackages []string, nvrOnly string, affectedProduct *apollodb.AffectedProduct, cve *apollodb.CVE) apollopb.BuildStatus {
product, err := tx.GetProductByID(affectedProduct.ProductID)
if err != nil {
c.log.Errorf("could not get product: %v", err)
return apollopb.BuildStatus_BUILD_STATUS_SKIP
}
if product.BuildSystem != "koji" {
return apollopb.BuildStatus_BUILD_STATUS_SKIP
}
var k koji.API
if forceKoji != nil {
k = forceKoji
} else {
k, err = koji.New(product.BuildSystemEndpoint)
if err != nil {
c.log.Errorf("could not create koji client: %v", err)
return apollopb.BuildStatus_BUILD_STATUS_SKIP
}
}
2022-07-07 20:11:50 +00:00
// Check if the submitted NVR is valid
2022-10-30 01:59:25 +00:00
nvr := rpmutils.NVR().FindStringSubmatch(nvrOnly)
2022-07-07 20:11:50 +00:00
if len(nvr) < 3 {
logrus.Errorf("Invalid NVR %s", nvrOnly)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
nvr = nvr[1:]
2022-10-30 01:59:25 +00:00
match, err := c.checkForIgnoredPackage(ignoredPackages, nvr[0])
2022-07-07 20:11:50 +00:00
if err != nil {
logrus.Errorf("Invalid glob: %v", err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
if match {
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_WILL_NOT_FIX
2022-07-07 20:11:50 +00:00
}
var tagged []*koji.Build
// If the package is part of a module, we have to check for valid builds
// rather than check in the compose tag
if strings.Contains(nvrOnly, ".module") {
// We need to find the package id
2022-10-30 01:59:25 +00:00
packageRes, err := k.GetPackage(&koji.GetPackageRequest{
2022-07-07 20:11:50 +00:00
PackageName: nvr[0],
})
if err != nil {
logrus.Errorf("Could not get package information from Koji: %v", err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
// Use package id to get builds
2022-10-30 01:59:25 +00:00
buildsRes, err := k.ListBuilds(&koji.ListBuildsRequest{
2022-07-07 20:11:50 +00:00
PackageID: packageRes.ID,
})
if err != nil {
logrus.Errorf("Could not get builds from Koji: %v", err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
tagged = buildsRes.Builds
} else {
// Non-module packages can be queried using the list tagged operation.
// We only check the compose tag
2022-10-30 01:59:25 +00:00
taggedRes, err := k.ListTagged(&koji.ListTaggedRequest{
Tag: product.KojiCompose.String,
2022-07-07 20:11:50 +00:00
Package: nvr[0],
})
if err != nil {
logrus.Errorf("Could not get tagged builds for package %s: %v", nvr[0], err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
tagged = taggedRes.Builds
}
// No valid builds found usually means that we don't ship that package
if len(tagged) <= 0 {
logrus.Errorf("No valid builds found for package %s", nvr[0])
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_NOT_FIXED
2022-07-07 20:11:50 +00:00
}
// Use a top-level fixed state to track if the NVR exists (at least once for modules)
fixed := false
for _, build := range tagged {
latestBuild := build
// Skip module contents (this is content inserted by module-build-service)
if latestBuild.Extra != nil && latestBuild.Extra.Typeinfo != nil {
continue
}
// Re-construct a valid NVR
kojiNvr := fmt.Sprintf("%s-%s-%s", latestBuild.PackageName, latestBuild.Version, latestBuild.Release)
// If the NVR is identical, that means that the fix has been built
2022-10-30 01:59:25 +00:00
if c.isNvrIdentical(latestBuild, nvr) {
2022-07-07 20:11:50 +00:00
logrus.Infof("%s has been fixed downstream with build %d (%s)", cve.ID, latestBuild.BuildId, kojiNvr)
2022-10-30 01:59:25 +00:00
err := tx.UpdateAffectedProductStateAndPackageAndAdvisory(affectedProduct.ID, int(apollopb.AffectedProduct_STATE_FIXED_DOWNSTREAM), affectedProduct.Package, &affectedProduct.Advisory.String)
2022-07-07 20:11:50 +00:00
if err != nil {
logrus.Errorf("Could not update affected product %d: %v", affectedProduct.ID, err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
// Get all RPMs for build
2022-10-30 01:59:25 +00:00
rpms, err := k.ListRPMs(&koji.ListRPMsRequest{
2022-07-07 20:11:50 +00:00
BuildID: latestBuild.BuildId,
})
if err != nil {
logrus.Errorf("Could not get RPMs from Koji: %v", err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
var srcRpm string
for _, rpm := range rpms.RPMs {
if rpm.Arch == "src" {
epochInt := 0
if rpm.Epoch != nil {
epochInt = *rpm.Epoch
}
srcRpm = fmt.Sprintf("%s-%d:%s-%s.%s.rpm", rpm.Name, epochInt, rpm.Version, rpm.Release, rpm.Arch)
break
}
}
// Add all RPMs as a build reference to the CVE
// This is the "Affected packages" section of an advisory
for _, rpm := range rpms.RPMs {
// Construct a valid rpm name (this is what the repos will contain)
2022-10-30 01:59:25 +00:00
rpmStr := fmt.Sprintf("%s-%d:%s-%s.%s.rpm", rpm.Name, utils.Default[int](rpm.Epoch), rpm.Version, rpm.Release, rpm.Arch)
_, err = tx.CreateBuildReference(affectedProduct.ID, rpmStr, srcRpm, cve.ID, "", utils.Pointer[string](strconv.Itoa(latestBuild.BuildId)), nil)
2022-07-07 20:11:50 +00:00
if err != nil {
logrus.Errorf("Could not create build reference: %v", err)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_SKIP
2022-07-07 20:11:50 +00:00
}
}
// We've seen at least one fix
fixed = true
// Since we've seen a fix, we don't have to keep looking
break
}
}
// No fix has been detected, will mark as FixedUpstream
if !fixed {
logrus.Errorf("%s has not been fixed for NVR %s", cve.ID, nvrOnly)
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_NOT_FIXED
2022-07-07 20:11:50 +00:00
}
2022-10-30 01:59:25 +00:00
return apollopb.BuildStatus_BUILD_STATUS_FIXED
2022-07-07 20:11:50 +00:00
}