diff options
| author | Michal Arbet <michal.arbet@ultimum.io> | 2025-02-19 23:22:07 +0100 |
|---|---|---|
| committer | Michal Arbet <michal.arbet@ultimum.io> | 2025-02-19 23:43:19 +0100 |
| commit | 405f95019354b9be45a750e246127bd9c68d2508 (patch) | |
| tree | e3dd0595dbc4f772ca9d5f174af4acb0a6461f4c | |
| parent | 6d44736756e857e7893e572d5f62a5f7f91c4e86 (diff) | |
| download | kolla-405f95019354b9be45a750e246127bd9c68d2508.tar.gz kolla-405f95019354b9be45a750e246127bd9c68d2508.zip | |
Remove Git remote origin after cloning sources
When kolla is cloning a Git repository during the build
process, the `.git/config` file retains the remote
origin URL, which may expose sensitive credentials if
authentication tokens are embedded in the URL.
This fix ensures that the remote is removed after cloning
to prevent unintended exposure of credentials.
Closes-Bug: #2098904
Change-Id: Iec21fc2363e03133ec77326da7392bc25b40132a
| -rw-r--r-- | kolla/image/tasks.py | 1 | ||||
| -rw-r--r-- | releasenotes/notes/bug-2098904-4c5670049a7e1a66.yaml | 5 |
2 files changed, 6 insertions, 0 deletions
diff --git a/kolla/image/tasks.py b/kolla/image/tasks.py index a36ba5cea..28af3d52d 100644 --- a/kolla/image/tasks.py +++ b/kolla/image/tasks.py @@ -232,6 +232,7 @@ class BuildTask(EngineTask): git.Git().clone(source['source'], clone_dir) git.Git(clone_dir).checkout(source['reference']) reference_sha = git.Git(clone_dir).rev_parse('HEAD') + git.Git(clone_dir).remote("remove", "origin") self.logger.debug("Git checkout by reference %s (%s)", source['reference'], reference_sha) except Exception as e: diff --git a/releasenotes/notes/bug-2098904-4c5670049a7e1a66.yaml b/releasenotes/notes/bug-2098904-4c5670049a7e1a66.yaml new file mode 100644 index 000000000..7d8e3dafb --- /dev/null +++ b/releasenotes/notes/bug-2098904-4c5670049a7e1a66.yaml @@ -0,0 +1,5 @@ +--- +fixes: + - | + Removes Git remote URLs after cloning to prevent credential exposure. + `LP#2098904 <https://bugs.launchpad.net/kolla/+bug/2098904>`__ |