CircleCI-Public / CircleCI-Public/docker-orb
`install_dockerize` overwrite project files with `dockerize` v0.11.0
- Dominant language
- Shell
- Stars
- 31
- Forks
- 61
- PR merge metrics
- No merged PRs in 30d
Description
### Orb version
3.0.1
### What happened
The `install_dockerize` command extracts the `dockerize` tarball in the current working directory (typically, the project root).
Starting with [`dockerize` v0.11.0](https://github.com/jwilder/dockerize/releases/tag/v0.11.0), the tarball includes `README.md` and `LICENSE` files in addition to the `dockerize` binary. This causes the project's own `README.md` and `LICENSE` to be silently overwritten during extraction.
```sh-session
$ curl -sL https://github.com/jwilder/dockerize/releases/download/v0.11.0/dockerize-linux-amd64-v0.11.0.tar.gz | tar tzf -
LICENSE
README.md
dockerize
```
The relevant code in `install_dockerize.sh`:
https://github.com/CircleCI-Public/docker-orb/blob/e8af393026568ffb18c5dfcdbbf756a431558801/src/scripts/install_dockerize.sh#L49-L53
This extracts all files into the current directory without any path restriction.
Previous `dockerize` releases only contained the `dockerize` binary, so this was not an issue before.
```sh-session
$ curl -sL https://github.com/jwilder/dockerize/releases/download/v0.10.0/dockerize-linux-amd64-v0.10.0.tar.gz | tar tzf -
dockerize
```
### Expected behavior
`install_dockerize` should not modify any project files.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in install_dockerize.sh at lines 49-53 and inspect how the v0.11.0 tarball is extracted in the current directory. Reproduce the command with the v0.11.0 archive, then verify that installation leaves the project's README.md and LICENSE unchanged while still installing the dockerize binary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100