eclipse-tractusx / eclipse-tractusx/sig-release
TRG-4-04 check is not accepting ARG defined USER
- Dominant language
- Go
- Stars
- 12
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
## Description
currently the check TRG-4-04 is broken for Tractusx-EDC also if all of our `Dockerfile` define a non-root user.
looking at the code, it's caused by this regex:
https://github.com/eclipse-tractusx/sig-release/blob/8793eeea97cb6582190d0e54c650ec3c3f5c5ddd/release-automation/internal/container/non_root_container_check.go#L30C28-L30C132
This because we have the USER passed as an ARG:
https://github.com/eclipse-tractusx/tractusx-edc/blob/c2e9506c15f303e50d15bbd745ef1661609b14c6/edc-controlplane/edc-runtime-memory/src/main/docker/Dockerfile#L42
I would suggest to avoid the regex check and verify that there's at least one `USER` call, and none of them are called with `root` argument, because that's what the TRG is requiring, and regex can become easily unmanageable.
## Impact
## Additional information
- [ ] I'm willing to contribute to this feature
Contributor guide
Research direction
Start in release-automation/internal/container/non_root_container_check.go at the linked regex and compare it with the Dockerfile example that passes USER through an ARG. Update the check so this valid non-root form is accepted while USER root remains rejected, then verify the TRG-4-04 behavior against both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- dockerfile, go
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100