|
When building images for binary type, it is expected to not install
executables from untrusted sources, and gem, sensu-install, npm or
pip packages for instance should come from the distro itself.
This commit adds a `validate-binary-build.sh` script that checks for
forbidden commands in the rendered Dockerfile templates for the binary
type builds and hooks this script with the pep8 CI job.
The output is just informative for now until we've fixed the culprit
Dockerfiles, then we'll make the script return an error code and with
the ability to fail the pep8 CI check. This should prevent unwanted
commands from entering binary type Dockerfiles.
Change-Id: I66e54bd18f4256cdca6c0c50626de4f975c246b8
|
