eclipse-tractusx / eclipse-tractusx/sig-release

TRG-4-04 check is not accepting ARG defined USER

Open
#798 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
12
Forks
10
PR merge metrics
No merged PRs in 30d

Description

## Description
currently the check TRG-4-04 is broken for Tractusx-EDC also if all of our `Dockerfile` define a non-root user.

looking at the code, it's caused by this regex:
https://github.com/eclipse-tractusx/sig-release/blob/8793eeea97cb6582190d0e54c650ec3c3f5c5ddd/release-automation/internal/container/non_root_container_check.go#L30C28-L30C132

This because we have the USER passed as an ARG:
https://github.com/eclipse-tractusx/tractusx-edc/blob/c2e9506c15f303e50d15bbd745ef1661609b14c6/edc-controlplane/edc-runtime-memory/src/main/docker/Dockerfile#L42

I would suggest to avoid the regex check and verify that there's at least one `USER` call, and none of them are called with `root` argument, because that's what the TRG is requiring, and regex can become easily unmanageable.

## Impact

## Additional information

- [ ] I'm willing to contribute to this feature

Contributor guide

Open the contributing guide

Research direction

Start in release-automation/internal/container/non_root_container_check.go at the linked regex and compare it with the Dockerfile example that passes USER through an ARG. Update the check so this valid non-root form is accepted while USER root remains rejected, then verify the TRG-4-04 behavior against both cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
dockerfile, go
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.