#350 [audit] Whitelist allowed koji tags
Closed: Fixed 7 years ago Opened 7 years ago by puiterwijk.

The way the tag makes it from the packagers' commit to the actual GenericBuilder is via a long path, but the actual GenericBuilder should check that the tag name is something "sane".
As an example, maybe add a whitelist 'module-*' or something.
That would prevent any chances of tags getting set to 'f26' or the likes via some weird ways.


The whitelist should be configurable, so if we set it to whitelite to 'module-*' today, we can change it two years from now if we need to name module tags differently then.

I agree that it should be configurable. And perhaps a list of prefixes/wildcard strings, e.g.:
['module-*', 'yet-another-module-*'] ?

Metadata Update from @fivaldi:
- Issue assigned to fivaldi

7 years ago

Metadata Update from @fivaldi:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

7 years ago

Login to comment on this ticket.

Metadata