You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
depot_tools/cipd_manifest.txt

70 lines
2.9 KiB
Plaintext

# Copyright 2017 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# This file contains version pins of a few infrastructure tools.
# If a tool is broken, revert a recent CL touching this file.
# Note that Chromium has its own depot_tools pin, so if in a rush, revert the
# depot_tools roll as well: https://chromium-review.googlesource.com/q/project:chromium/src+file:DEPS+depot_tools
# or just wait for the autoroller to auto-roll your revert to Chromium.
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
# Pin resolved versions in the repo, to reduce trust in the CIPD backend.
#
# Most of these tools are generated via builders at
# https://ci.chromium.org/p/infra/g/infra/console
#
# For these, the git revision is the one of
# https://chromium.googlesource.com/infra/infra.git.
#
# To regenerate them (after modifying this file):
# cipd ensure-file-resolve -ensure-file cipd_manifest.txt
[cipd] Pin hashes of CIPD packages. Together with already committed cipd_client_version.digests file, this cryptographically binds contents of CIPD packages used by depot_tools with depot_tool's git revision (assuming the CIPD client pinned by cipd_client_version.digests is trusted too, which can presumably be verified when it is being pinned). This holds true even if the CIPD backend is compromised. The worst that can happen is a denial of service (e.g. if the backend refuses to serve packages at all). If a bad backend tries to serve a malicious (unexpected) CIPD client, 'cipd' bootstrap script (and its powershell counterpart) will detect a mismatch between SHA256 of the fetched binary and what's specified in cipd_client_version.digests, and will refuse to run the untrusted binary. Similarly, if the bad backend tries to serve some other unexpected package (in place of a package specified in cipd_manifest.txt), the CIPD client (already verified and trusted as this point) will detect a mismatch between what was fetched and what's pinned in cipd_manifest.versions, and will refuse to install untrusted files. cipd_manifest.versions was generated from cipd_manifest.txt by: $ cipd ensure-file-resolve -ensure-file cipd_manifest.txt This will have to be rerun each time cipd_manifest.txt is updated. There's a presubmit check that verifies *.versions file is up-to-date (it's part of 'cipd ensure-file-verify'). BUG=870166 R=nodir@chromium.org, iannucci@chromium.org, tandrii@chromium.org Change-Id: I25314adf0a9b05c69cd16e75aff01dbc79c87aa5 Reviewed-on: https://chromium-review.googlesource.com/1227435 Commit-Queue: Vadim Shtayura <vadimsh@chromium.org> Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
7 years ago
$ResolvedVersions cipd_manifest.versions
# Fully supported platforms.
$VerifiedPlatform linux-amd64 linux-arm64 mac-amd64 mac-arm64 windows-amd64
# Platform with best-effort support: we have some binaries cross-compiled for
# them, but we do not test they work. They also may not have all necessary
# vpython packages.
$VerifiedPlatform linux-386 linux-ppc64 linux-ppc64le linux-riscv64 linux-s390x
$VerifiedPlatform linux-armv6l linux-mips64 linux-mips64le linux-mipsle
$VerifiedPlatform windows-arm64
# vpython.
infra/tools/luci/vpython3/${platform} git_revision:4967d21f2b92546ac3747086cdcbb046b6db52fb
# LUCI editor
infra/tools/luci/led/${platform} git_revision:811f963c20b777889aa015f74352126ab3dfe06b
# LUCI config generator
infra/tools/luci/lucicfg/${platform} git_revision:156ef58d675d5d8db58cce7012bf3cdf8cca1054
# Mac toolchain installer
infra/tools/mac_toolchain/${os=mac}-${arch} git_revision:05fe195bf77656743f3daa99d463a794260b429b
# LUCI rpc command line tool
infra/tools/prpc/${platform} git_revision:bd3a982ae62b4820b71414b2340e86019a1fbd26
# LUCI authentication command line tool
infra/tools/luci-auth/${platform} git_revision:02ffe6e2b222aa1f56776b8e5385f49687451bb2
# LUCI Git credential helper
infra/tools/luci/git-credential-luci/${platform} git_revision:d41024b9e474be209a7975b2d57b175a84095d12
# LUCI Buildbucket CLI
infra/tools/bb/${platform} git_revision:b1ef34e3c86269b1261ccbc039ff2cfe3baaa961
# LUCI ResultDB CLI
infra/tools/rdb/${platform} git_revision:6dc7eeb1a5db99a04b6ee701fa3b369813528c20
# dirmd, a tool to work with DIR_METADATA files
infra/tools/dirmd/${platform} git_revision:9558e2c2dc002209753b8e61b83c4a2c81361fbc
# Pinpoint CLI
infra/chromeperf/pinpoint/${platform} git_revision:bd3a982ae62b4820b71414b2340e86019a1fbd26
@Subdir reclient
# reclient, currently this is only for ChromeOS build.
# TODO(http://b/242680623): we may change how to distribute reclient.
infra/rbe/client/${platform=linux-amd64} re_client_version:0.124.1.13f78cc-gomaip