Description
repro_hermetic_build checks build files and Dockerfiles for non-hermetic network download commands, but its pattern list only covers pip, npm, yarn, apt-get, brew, curl, and wget. It misses other major language package managers such as Go, Cargo, and Ruby. This supplements the hermeticity roadmap discussed in #227.
What We Did
- Audited a Dockerfile containing:
RUN go install github.com/gittuf/gittuf@v0.7.0
- Ran
darnit audit . --framework reproducibility --show-all.
What It Was Supposed To Do
The handler should detect that go install downloads packages from the public internet during the container build step and flag a suspicious pattern violation.
What We Got
The check reported 0 violations found and marked the build file as clean:
"No suspicious patterns found in 1 scanned file(s)"
Proposed Fix
Add common language package manager install commands to _SUSPICIOUS_PATTERNS in handlers.py:
go install , go get cargo install , cargo binstall gem install pipx install pnpm add , pnpm install
Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/README.md#issue-3-hermeticity-gap-repro_hermetic_build-misses-language-native-package-managers-go-install-cargo-install
Description
repro_hermetic_buildchecks build files and Dockerfiles for non-hermetic network download commands, but its pattern list only coverspip,npm,yarn,apt-get,brew,curl, andwget. It misses other major language package managers such as Go, Cargo, and Ruby. This supplements the hermeticity roadmap discussed in #227.What We Did
RUN go install github.com/gittuf/gittuf@v0.7.0darnit audit . --framework reproducibility --show-all.What It Was Supposed To Do
The handler should detect that
go installdownloads packages from the public internet during the container build step and flag a suspicious pattern violation.What We Got
The check reported 0 violations found and marked the build file as clean:
Proposed Fix
Add common language package manager install commands to
_SUSPICIOUS_PATTERNSinhandlers.py:go install,go getcargo install,cargo binstallgem installpipx installpnpm add,pnpm installReference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/README.md#issue-3-hermeticity-gap-repro_hermetic_build-misses-language-native-package-managers-go-install-cargo-install