From 04a4acda602a525e9865a8c016ea49a4ad17ff80 Mon Sep 17 00:00:00 2001
From: Francois Andrieu <naolwen@gmail.com>
Date: Dec 17 2020 22:24:14 +0000
Subject: [PATCH 1/4] use non-root user


---

diff --git a/Dockerfile b/Dockerfile
index aa5815f..c7704a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,8 +5,11 @@ RUN dnf -y install \
         findutils \
         python3-pyyaml \
         "perl(YAML::Tiny)"
+RUN useradd --uid 1000 build
+
 ENV HOME /workspace
 COPY . /workspace
-RUN chmod -R g+w /workspace
+RUN chown -R build:root /workspace
 WORKDIR /workspace
+USER 1000
 ENTRYPOINT ["python3", "entrypoint.py"]

From d03b4cd1e65a6309f89bca5d2bef6f069a3b2ae6 Mon Sep 17 00:00:00 2001
From: Francois Andrieu <naolwen@gmail.com>
Date: Dec 18 2020 07:20:20 +0000
Subject: [PATCH 2/4] use nss wrapper to support ocp arbitrary uid


---

diff --git a/Dockerfile b/Dockerfile
index c7704a5..99332a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,12 +4,15 @@ RUN dnf -y install \
         git \
         findutils \
         python3-pyyaml \
-        "perl(YAML::Tiny)"
-RUN useradd --uid 1000 build
+        "perl(YAML::Tiny)" \
+        nss_wrapper \
+        gettext
+
+RUN useradd --uid 1000 --gid 0 build
 
 ENV HOME /workspace
 COPY . /workspace
-RUN chown -R build:root /workspace
+RUN chown -R build:root /workspace && chmod -R g+rwX /workspace
 WORKDIR /workspace
 USER 1000
 ENTRYPOINT ["python3", "entrypoint.py"]
diff --git a/entrypoint.py b/entrypoint.py
index b0a79f6..8309447 100644
--- a/entrypoint.py
+++ b/entrypoint.py
@@ -5,6 +5,7 @@ import sys
 import smtplib
 import configparser
 import subprocess
+import re
 from email.message  import EmailMessage
 
 
@@ -28,7 +29,24 @@ def send_mail(content):
     else:
       print("no mail config detected, ignoring")
 
+def rewrite_passwd():
+    user_rewrite = "build:x:%s:0:ocp user:/workspace:/bin/bash" % (os.getuid(),)
+    with open("/etc/passwd", 'r') as passwd_file:
+      passwd = passwd_file.readlines()
+    nss_passwd = [re.sub(r'^build:x:1000:.*$', user_rewrite, line) for line in passwd]
+    with open("/tmp/passwd", 'w') as nss_passwd_file:
+      nss_passwd_file.writelines(nss_passwd)
+
 if __name__ == '__main__':
+    if os.getuid() > 0:
+      # Use nss wrapper to override /etc/passwd file with current effective UID
+      # Correct UID lookup is required by OpenSSH (and needed for git push)
+      os.environ['LD_PRELOAD'] = "/usr/lib64/libnss_wrapper.so"
+      rewrite_passwd()
+      os.environ['NSS_WRAPPER_PASSWD'] = "/tmp/passwd"
+      os.environ['NSS_WRAPPER_GROUP'] = "/etc/group"
+    # Validate pagure ssh connection
+    subprocess.run(["ssh", "-Tv", "git@pagure.io"])
     print("running: %s" % (" ".join(sys.argv)), flush=True)
     run = subprocess.run(['./build.py', ] + sys.argv[1::], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
     print("done", flush=True)

From eeb35525fffbd5c05ca793a616f9a0473eb665df Mon Sep 17 00:00:00 2001
From: Francois Andrieu <naolwen@gmail.com>
Date: Dec 18 2020 07:20:25 +0000
Subject: [PATCH 3/4] print stdout as it goes


---

diff --git a/entrypoint.py b/entrypoint.py
index 8309447..4d17fb5 100644
--- a/entrypoint.py
+++ b/entrypoint.py
@@ -48,10 +48,20 @@ if __name__ == '__main__':
     # Validate pagure ssh connection
     subprocess.run(["ssh", "-Tv", "git@pagure.io"])
     print("running: %s" % (" ".join(sys.argv)), flush=True)
-    run = subprocess.run(['./build.py', ] + sys.argv[1::], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    stdout = ""
+    run = subprocess.Popen(['./build.py', ] + sys.argv[1::], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    while True:
+      buff = run.stdout.readline().decode('utf8')
+      sys.stdout.write(buff)
+      sys.stdout.flush()
+      stdout += buff
+      returncode = run.poll()
+      if returncode != None:
+        buff = "".join(run.stdout.readlines())
+        sys.stdout.write(buff)
+        stdout += buff
+        break
     print("done", flush=True)
-    if run.stdout:
-      print(run.stdout.decode('utf8'), flush=True)
-    if run.returncode:
-      send_mail(run.stdout)
+    if returncode:
+      send_mail(stdout.encode('utf8'))
 

From b03dd4cb58a0734e26f4b28dee4ec5472fd3eb50 Mon Sep 17 00:00:00 2001
From: Francois Andrieu <naolwen@gmail.com>
Date: Dec 18 2020 07:20:25 +0000
Subject: [PATCH 4/4] fix script name in print message


---

diff --git a/entrypoint.py b/entrypoint.py
index 4d17fb5..9ecb989 100644
--- a/entrypoint.py
+++ b/entrypoint.py
@@ -47,7 +47,7 @@ if __name__ == '__main__':
       os.environ['NSS_WRAPPER_GROUP'] = "/etc/group"
     # Validate pagure ssh connection
     subprocess.run(["ssh", "-Tv", "git@pagure.io"])
-    print("running: %s" % (" ".join(sys.argv)), flush=True)
+    print("running: build.py %s" % (" ".join(sys.argv[1::])), flush=True)
     stdout = ""
     run = subprocess.Popen(['./build.py', ] + sys.argv[1::], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
     while True: