You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
depot_tools/cipd_manifest.txt

70 lines
2.9 KiB
Plaintext

# Copyright 2017 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# This file contains version pins of a few infrastructure tools.
# If a tool is broken, revert a recent CL touching this file.
# Note that Chromium has its own depot_tools pin, so if in a rush, revert the
# depot_tools roll as well: https://chromium-review.googlesource.com/q/project:chromium/src+file:DEPS+depot_tools
# or just wait for the autoroller to auto-roll your revert to Chromium.
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
# Pin resolved versions in the repo, to reduce trust in the CIPD backend.
#
# Most of these tools are generated via builders at
# https://ci.chromium.org/p/infra/g/infra/console
#
# For these, the git revision is the one of
# https://chromium.googlesource.com/infra/infra.git.
#
# To regenerate them (after modifying this file):
# cipd ensure-file-resolve -ensure-file cipd_manifest.txt
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
$ResolvedVersions cipd_manifest.versions
# Fully supported platforms.
$VerifiedPlatform linux-amd64 linux-arm64 mac-amd64 mac-arm64 windows-amd64
# Platform with best-effort support: we have some binaries cross-compiled for
# them, but we do not test they work. They also may not have all necessary
# vpython packages.
$VerifiedPlatform linux-386 linux-ppc64 linux-ppc64le linux-riscv64 linux-s390x
$VerifiedPlatform linux-armv6l linux-mips64 linux-mips64le linux-mipsle
$VerifiedPlatform windows-arm64
# vpython.
infra/tools/luci/vpython3/${platform} git_revision:ad0c4b622c7d4cee870f57eed8170c059ca42ed3
# LUCI editor
infra/tools/luci/led/${platform} git_revision:372f149ec007edd1a02c7c6ce1a6e6c75cc52597
# LUCI config generator
infra/tools/luci/lucicfg/${platform} git_revision:edacaa9ffe572276dd37ce20ae76ab388e77a032
# Mac toolchain installer
infra/tools/mac_toolchain/${os=mac}-${arch} git_revision:59b5b4b5a506dc23eae31ef0f5b168281c6521da
# LUCI rpc command line tool
[depot_tools] Roll everything. To ensure https://chromium-review.googlesource.com/c/infra/luci/luci-go/+/5834682 is included via https://chromium.googlesource.com/infra/infra.git/+/b1f414539ac10cc67a0250890a38712cc06cf102. N.B. it is possible some of these don't include luci-auth code, I didn't check. Diffs: vpython: https://chromium.googlesource.com/infra/infra.git/+log/f7fecd758a887260d403361b70d6b9e83e0c84b0..b1f414539ac10cc67a0250890a38712cc06cf102 led, prpc, luci-auth, git-credential-luci, bb, rdb: https://chromium.googlesource.com/infra/infra.git/+log/165155b778d099eae08fef14896e11140306c32b..b1f414539ac10cc67a0250890a38712cc06cf102 lucicfg: https://chromium.googlesource.com/infra/infra.git/+log/1fdeb2c6cc9a65c02570616b8619699cef40d07c..b1f414539ac10cc67a0250890a38712cc06cf102 mac_toolchain: https://chromium.googlesource.com/infra/infra.git/+log/05fe195bf77656743f3daa99d463a794260b429b..b1f414539ac10cc67a0250890a38712cc06cf102 dirmd: https://chromium.googlesource.com/infra/infra.git/+log/9558e2c2dc002209753b8e61b83c4a2c81361fbc..b1f414539ac10cc67a0250890a38712cc06cf102 pinpoint: https://chromium.googlesource.com/infra/infra.git/+log/fc7aae42258c8c0d0e38a72989cacbd36de98cc7..b1f414539ac10cc67a0250890a38712cc06cf102 BUG=b:349254870 Change-Id: I1a1c9fd7942d02f0fa07b1ba9d1a4dca77ad5219 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5856168 Commit-Queue: Patrick Meiring <meiring@google.com> Reviewed-by: Vadim Shtayura <vadimsh@chromium.org>
6 months ago
infra/tools/prpc/${platform} git_revision:b1f414539ac10cc67a0250890a38712cc06cf102
# LUCI authentication command line tool
infra/tools/luci-auth/${platform} git_revision:78b3b3ca47e64b3280a5dd5b83c23ce89f04d328
# LUCI Git credential helper
infra/tools/luci/git-credential-luci/${platform} git_revision:5f7dad779fb1dac21084fbc9610285ba9dc943ad
# LUCI Buildbucket CLI
[depot_tools] Roll everything. To ensure https://chromium-review.googlesource.com/c/infra/luci/luci-go/+/5834682 is included via https://chromium.googlesource.com/infra/infra.git/+/b1f414539ac10cc67a0250890a38712cc06cf102. N.B. it is possible some of these don't include luci-auth code, I didn't check. Diffs: vpython: https://chromium.googlesource.com/infra/infra.git/+log/f7fecd758a887260d403361b70d6b9e83e0c84b0..b1f414539ac10cc67a0250890a38712cc06cf102 led, prpc, luci-auth, git-credential-luci, bb, rdb: https://chromium.googlesource.com/infra/infra.git/+log/165155b778d099eae08fef14896e11140306c32b..b1f414539ac10cc67a0250890a38712cc06cf102 lucicfg: https://chromium.googlesource.com/infra/infra.git/+log/1fdeb2c6cc9a65c02570616b8619699cef40d07c..b1f414539ac10cc67a0250890a38712cc06cf102 mac_toolchain: https://chromium.googlesource.com/infra/infra.git/+log/05fe195bf77656743f3daa99d463a794260b429b..b1f414539ac10cc67a0250890a38712cc06cf102 dirmd: https://chromium.googlesource.com/infra/infra.git/+log/9558e2c2dc002209753b8e61b83c4a2c81361fbc..b1f414539ac10cc67a0250890a38712cc06cf102 pinpoint: https://chromium.googlesource.com/infra/infra.git/+log/fc7aae42258c8c0d0e38a72989cacbd36de98cc7..b1f414539ac10cc67a0250890a38712cc06cf102 BUG=b:349254870 Change-Id: I1a1c9fd7942d02f0fa07b1ba9d1a4dca77ad5219 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5856168 Commit-Queue: Patrick Meiring <meiring@google.com> Reviewed-by: Vadim Shtayura <vadimsh@chromium.org>
6 months ago
infra/tools/bb/${platform} git_revision:b1f414539ac10cc67a0250890a38712cc06cf102
# LUCI ResultDB CLI
[depot_tools] Roll everything. To ensure https://chromium-review.googlesource.com/c/infra/luci/luci-go/+/5834682 is included via https://chromium.googlesource.com/infra/infra.git/+/b1f414539ac10cc67a0250890a38712cc06cf102. N.B. it is possible some of these don't include luci-auth code, I didn't check. Diffs: vpython: https://chromium.googlesource.com/infra/infra.git/+log/f7fecd758a887260d403361b70d6b9e83e0c84b0..b1f414539ac10cc67a0250890a38712cc06cf102 led, prpc, luci-auth, git-credential-luci, bb, rdb: https://chromium.googlesource.com/infra/infra.git/+log/165155b778d099eae08fef14896e11140306c32b..b1f414539ac10cc67a0250890a38712cc06cf102 lucicfg: https://chromium.googlesource.com/infra/infra.git/+log/1fdeb2c6cc9a65c02570616b8619699cef40d07c..b1f414539ac10cc67a0250890a38712cc06cf102 mac_toolchain: https://chromium.googlesource.com/infra/infra.git/+log/05fe195bf77656743f3daa99d463a794260b429b..b1f414539ac10cc67a0250890a38712cc06cf102 dirmd: https://chromium.googlesource.com/infra/infra.git/+log/9558e2c2dc002209753b8e61b83c4a2c81361fbc..b1f414539ac10cc67a0250890a38712cc06cf102 pinpoint: https://chromium.googlesource.com/infra/infra.git/+log/fc7aae42258c8c0d0e38a72989cacbd36de98cc7..b1f414539ac10cc67a0250890a38712cc06cf102 BUG=b:349254870 Change-Id: I1a1c9fd7942d02f0fa07b1ba9d1a4dca77ad5219 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5856168 Commit-Queue: Patrick Meiring <meiring@google.com> Reviewed-by: Vadim Shtayura <vadimsh@chromium.org>
6 months ago
infra/tools/rdb/${platform} git_revision:b1f414539ac10cc67a0250890a38712cc06cf102
# dirmd, a tool to work with DIR_METADATA files
[depot_tools] Roll everything. To ensure https://chromium-review.googlesource.com/c/infra/luci/luci-go/+/5834682 is included via https://chromium.googlesource.com/infra/infra.git/+/b1f414539ac10cc67a0250890a38712cc06cf102. N.B. it is possible some of these don't include luci-auth code, I didn't check. Diffs: vpython: https://chromium.googlesource.com/infra/infra.git/+log/f7fecd758a887260d403361b70d6b9e83e0c84b0..b1f414539ac10cc67a0250890a38712cc06cf102 led, prpc, luci-auth, git-credential-luci, bb, rdb: https://chromium.googlesource.com/infra/infra.git/+log/165155b778d099eae08fef14896e11140306c32b..b1f414539ac10cc67a0250890a38712cc06cf102 lucicfg: https://chromium.googlesource.com/infra/infra.git/+log/1fdeb2c6cc9a65c02570616b8619699cef40d07c..b1f414539ac10cc67a0250890a38712cc06cf102 mac_toolchain: https://chromium.googlesource.com/infra/infra.git/+log/05fe195bf77656743f3daa99d463a794260b429b..b1f414539ac10cc67a0250890a38712cc06cf102 dirmd: https://chromium.googlesource.com/infra/infra.git/+log/9558e2c2dc002209753b8e61b83c4a2c81361fbc..b1f414539ac10cc67a0250890a38712cc06cf102 pinpoint: https://chromium.googlesource.com/infra/infra.git/+log/fc7aae42258c8c0d0e38a72989cacbd36de98cc7..b1f414539ac10cc67a0250890a38712cc06cf102 BUG=b:349254870 Change-Id: I1a1c9fd7942d02f0fa07b1ba9d1a4dca77ad5219 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5856168 Commit-Queue: Patrick Meiring <meiring@google.com> Reviewed-by: Vadim Shtayura <vadimsh@chromium.org>
6 months ago
infra/tools/dirmd/${platform} git_revision:b1f414539ac10cc67a0250890a38712cc06cf102
# Pinpoint CLI
[depot_tools] Roll everything. To ensure https://chromium-review.googlesource.com/c/infra/luci/luci-go/+/5834682 is included via https://chromium.googlesource.com/infra/infra.git/+/b1f414539ac10cc67a0250890a38712cc06cf102. N.B. it is possible some of these don't include luci-auth code, I didn't check. Diffs: vpython: https://chromium.googlesource.com/infra/infra.git/+log/f7fecd758a887260d403361b70d6b9e83e0c84b0..b1f414539ac10cc67a0250890a38712cc06cf102 led, prpc, luci-auth, git-credential-luci, bb, rdb: https://chromium.googlesource.com/infra/infra.git/+log/165155b778d099eae08fef14896e11140306c32b..b1f414539ac10cc67a0250890a38712cc06cf102 lucicfg: https://chromium.googlesource.com/infra/infra.git/+log/1fdeb2c6cc9a65c02570616b8619699cef40d07c..b1f414539ac10cc67a0250890a38712cc06cf102 mac_toolchain: https://chromium.googlesource.com/infra/infra.git/+log/05fe195bf77656743f3daa99d463a794260b429b..b1f414539ac10cc67a0250890a38712cc06cf102 dirmd: https://chromium.googlesource.com/infra/infra.git/+log/9558e2c2dc002209753b8e61b83c4a2c81361fbc..b1f414539ac10cc67a0250890a38712cc06cf102 pinpoint: https://chromium.googlesource.com/infra/infra.git/+log/fc7aae42258c8c0d0e38a72989cacbd36de98cc7..b1f414539ac10cc67a0250890a38712cc06cf102 BUG=b:349254870 Change-Id: I1a1c9fd7942d02f0fa07b1ba9d1a4dca77ad5219 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5856168 Commit-Queue: Patrick Meiring <meiring@google.com> Reviewed-by: Vadim Shtayura <vadimsh@chromium.org>
6 months ago
infra/chromeperf/pinpoint/${platform} git_revision:b1f414539ac10cc67a0250890a38712cc06cf102
@Subdir reclient
# reclient, currently this is only for ChromeOS build.
# TODO(http://b/242680623): we may change how to distribute reclient.
infra/rbe/client/${platform=linux-amd64} re_client_version:0.124.1.13f78cc-gomaip