You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
depot_tools/cipd_manifest.txt

77 lines
3.2 KiB
Plaintext

# Copyright 2017 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# This file contains version pins of a few infrastructure tools.
# If a tool is broken, revert a recent CL touching this file.
# Note that Chromium has its own depot_tools pin, so if in a rush, revert the
# depot_tools roll as well: https://chromium-review.googlesource.com/q/project:chromium/src+file:DEPS+depot_tools
# or just wait for the autoroller to auto-roll your revert to Chromium.
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
# Pin resolved versions in the repo, to reduce trust in the CIPD backend.
#
# Most of these tools are generated via builders at
# https://ci.chromium.org/p/infra/g/infra/console
#
# For these, the git revision is the one of
# https://chromium.googlesource.com/infra/infra.git.
#
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
5 years ago
# For goma client, generated via builders at
# https://ci.chromium.org/p/infra-internal/g/goma-client/console
# the git revision is the one of
# https://chromium.googlesource.com/infra/goma/client.git
#
# To regenerate them (after modifying this file):
# cipd ensure-file-resolve -ensure-file cipd_manifest.txt
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
$ResolvedVersions cipd_manifest.versions
# Fully supported platforms.
$VerifiedPlatform linux-amd64 linux-arm64 mac-amd64 mac-arm64 windows-amd64
# Platform with best-effort support: we have some binaries cross-compiled for
# them, but we do not test they work. They also may not have all necessary
# vpython packages.
$VerifiedPlatform linux-386 linux-ppc64 linux-ppc64le linux-s390x
$VerifiedPlatform linux-armv6l linux-mips64 linux-mips64le linux-mipsle
# vpython.
New vpython to depot_tools. This release contains commits: e74f8f68337ee619d400e0b6607cbe9df37f78ee Fix so that Python inherits file handles again on Windows. 059bcab0fb866cf8b9bc25b5845beeb8ee90fe3d Bundle the python interpreter on Mac. e2552b1a6ebed6651aceb5a7ab4639c0d69c0c0e Resolve symlinks when finding the vpython executable. d5fc7bca58e458258f8c3b8a25ecd070c77581ac Roll infra/go/src/go.chromium.org/luci/ ee2c632ce..82d549a81 (1 commit) 5d9b6ecf87cdfb928e1112d2838d26bc7ede2b48 Roll infra/go/src/go.chromium.org/luci/ 0480658b5..0535bf685 (5 commits) 3076679301d2b9b040bce2c871a63ddc49273c41 [environ] Rename Get => Lookup, GetEmpty => Get. 37f02f9f91aa3918b195931fbcf02750290d0571 Search bundled python paths before looking in PATH. a4136aa4d9e8c359bcf234fcd6ae026fb5b92925 [go] Format all files. 8349853d4517895a2c5838a00aea3e368ce3f865 [vpython] Make TestLoadForScript pass on OSX when running locally. d94b5704d8ad151a0306974a1a949d8057c44a18 Revert "Add support for bootstrapping the Python interpreter package." 6dacee57fbe6b5bc5a2fca23b5b7d8ccfea54ee7 Revert "Pass packages to vpython to bootstrap." 03e0afedc841bad5fed8024c4b7fd38d332701ad Pass packages to vpython to bootstrap. fa3d6effe8906e93944bf54ea6978adcd022f75c go generate all b5eee61d0153295f3efb2e67b319066c2306ac5b Add support for bootstrapping the Python interpreter package. cc5fb5e4934445a0a5206bfc324ca486c1285415 [vpython] Skip flaky test. c04b64ca743703ebbfc064ec5b5c35d3bc378fa4 Add vpython3-only cipd packages. f14d61370f1d7302a797feb2adc3a2f2449130d1 Remove the VENVOmitUseWheel field now that nothing uses it. 7c739ae11aa23bc37601e6923add677600ae1329 Remove support for old pip versions in pep425 tag probing. 51e3f0a01454d2e18b36de28c7e0ca2f6127ea2b Stop setting the unused VENVOmitUseWheel option. e0e35a4e2227fb3429f3483c4719b6370eca7e1e Hardcode the venv OmitUseWheel option to true. Bug: 1318617, 1340653 Change-Id: Ifb94c81492edfa98e1b59fc82e6d43678b82d776 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/3756933 Reviewed-by: Gavin Mak <gavinmak@google.com> Commit-Queue: Brian Ryner <bryner@google.com>
3 years ago
infra/tools/luci/vpython/${platform} git_revision:b91f9144cceb6508d98c5f0ecb8a31f59d277929
# LUCI editor
infra/tools/luci/led/${platform} git_revision:339fc51de1f75fe88e35f02781649ca27c2b6977
# LUCI config generator
infra/tools/luci/lucicfg/${platform} git_revision:57a48c69a6c860d4bd686be4a4b0a7c2bd031e35
# Mac toolchain installer
infra/tools/mac_toolchain/${os=mac}-${arch} git_revision:723fc1a6c8cdf2631a57851f5610e598db0c1de1
# LUCI rpc command line tool
infra/tools/prpc/${platform} git_revision:5a038afb97f6b77e0fcefe1185317da216fced1f
# LUCI authentication command line tool
infra/tools/luci-auth/${platform} git_revision:297491c0babda68d84d8240c9d4504be671bc804
# LUCI Buildbucket CLI
infra/tools/bb/${platform} git_revision:0e7a6d8b67bee60fc983e6a4bd14a828654a1ce3
# LUCI ResultDB CLI
infra/tools/rdb/${platform} git_revision:4047a98ee73a91e5f8acdb377437a6ebda171c3c
# CHROMEOS Buildjobs CLI
chromiumos/infra/crosjobs/${platform=linux-amd64} git_revision:ed616d595eb7241d39d34907050d2949121d6ae8
Reland "put goma client in depot_tools" This reverts commit a0aed87f71211aff48e3c06802d173cdf21328cf. Reason for revert: install goma client without update_hook update_hook would disrupt current users, so start without update_hook, which means goma cient in depot_tools user might need to restart compiler_proxy manually when updated. https://docs.google.com/document/d/1pnwfkU6Rd9dRtQC0sg2vATmyRbkYWhnNUTD5k1PddC0/edit# Original change's description: > Revert "put goma client in depot_tools" > > This reverts commit 77780358011f8e20c68ba10aa1282f1f9f65734f. > > Reason for revert: AttributeError: 'GomaEnvPosix' object has no attribute 'RestartCompilerProxy' > > Original change's description: > > put goma client in depot_tools > > > > install goma client cipd package in depot_tools. > > > > should not use $MYPATH/goma_ctl in cipd_bin_setup > > since $MYPATH/goma_ctl uses cipd_bin_setup in itself, > > so causing recursive calls. > > invoke python to run .cipd/goma_ctl.py in cipd_bin_setup > > instead. > > > > Bug: b/77663154 > > Change-Id: I9f82c766a886a2acfb899e3594e5f05a7b7bc75a > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1866350 > > Reviewed-by: Edward Lesmes <ehmaldonado@chromium.org> > > Reviewed-by: Dirk Pranke <dpranke@chromium.org> > > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> > > TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com > > Change-Id: Ie050dfb524dd885634c31be829d733613e80aece > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: b/77663154 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1872129 > Reviewed-by: Fumitoshi Ukai <ukai@chromium.org> > Commit-Queue: Fumitoshi Ukai <ukai@chromium.org> TBR=sque@chromium.org,ukai@chromium.org,yyanagisawa@google.com,vadimsh@chromium.org,dpranke@chromium.org,tikuta@chromium.org,ehmaldonado@chromium.org,yekuang@google.com Bug: b/77663154 Change-Id: I8bb51631e4418ff63953099814bdb464128eb279 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/1875982 Reviewed-by: Dirk Pranke <dpranke@chromium.org> Commit-Queue: Fumitoshi Ukai <ukai@chromium.org>
5 years ago
# goma client
infra/goma/client/${os=linux,windows}-${arch=amd64} git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
infra/goma/client/${os=mac}-${arch} git_revision:07a4e71760fa04f271c55755211d8e4eb15e52e5
# ninja
infra/3pp/tools/ninja/${os=linux,windows}-${arch=amd64} version:2@1.8.2.chromium.3
infra/3pp/tools/ninja/${os=mac}-${arch} version:2@1.8.2.chromium.3
# dirmd, a tool to work with DIR_METADATA files
infra/tools/dirmd/${platform} git_revision:cf12f0eb202545a65f9a6e7d34f21b6aa12474e0
# Pinpoint CLI
infra/chromeperf/pinpoint/${platform} git_revision:53d72e5099bc6f080370ae5f23560383027b947f