hadolint 1.10.1 → 1.10.2
raw patch · 4 files changed
+19/−7 lines, 4 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- README.md +1/−1
- hadolint.cabal +2/−2
- src/Hadolint/Rules.hs +9/−4
- test/Spec.hs +7/−0
README.md view
@@ -169,7 +169,7 @@ | [DL3023](https://github.com/hadolint/hadolint/wiki/DL3023) | `COPY --from` cannot reference its own `FROM` alias | | [DL3024](https://github.com/hadolint/hadolint/wiki/DL3024) | `FROM` aliases (stage names) must be unique | | [DL3025](https://github.com/hadolint/hadolint/wiki/DL3025) | Use arguments JSON notation for CMD and ENTRYPOINT arguments |-| [DL3025](https://github.com/hadolint/hadolint/wiki/DL3026) | Use only an allowed registry in the FROM image |+| [DL3026](https://github.com/hadolint/hadolint/wiki/DL3026) | Use only an allowed registry in the FROM image | | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | MAINTAINER is deprecated. | | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Either use Wget or Curl but not both. | | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Multiple `CMD` instructions found. |
hadolint.cabal view
@@ -2,10 +2,10 @@ -- -- see: https://github.com/sol/hpack ----- hash: 1117d08fad1cb1f1cbc95bffaff37881c65142fe9772c00690c26a5e0070a4c6+-- hash: 5351a7553844e527dcb29c2614b2673edb7e340704ed1a69966d2dbe4f7ad3be name: hadolint-version: 1.10.1+version: 1.10.2 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development
src/Hadolint/Rules.hs view
@@ -773,14 +773,19 @@ ] registryIsAllowed :: Set.Set Registry -> Rule-registryIsAllowed allowed = instructionRule code severity message check+registryIsAllowed allowed = instructionRuleState code severity message check Set.empty where code = "DL3026" severity = ErrorC message = "Use only an allowed registry in the FROM image"- check (From (UntaggedImage img _)) = Set.null allowed || isAllowed img- check (From (TaggedImage img _ _)) = Set.null allowed || isAllowed img- check _ = True+ check st _ (From (UntaggedImage img alias)) = withState (Set.insert alias st) (doCheck st img)+ check st _ (From (TaggedImage img _ alias)) = withState (Set.insert alias st) (doCheck st img)+ check st _ _ = (st, True)+ -- |Transforms an Image into a Maybe ImageAlias by using the Image name+ toImageAlias = Just . ImageAlias . imageName+ -- | Returns True if the image being used is a previous aliased image+ -- or if the image registry is in the set of allowed registries+ doCheck st img = Set.member (toImageAlias img) st || Set.null allowed || isAllowed img isAllowed Image {registryName = Just registry} = Set.member registry allowed isAllowed Image {registryName = Nothing, imageName} = imageName == "scratch" ||
test/Spec.hs view
@@ -950,6 +950,13 @@ ] in ruleCatchesNot (registryIsAllowed ["docker.io"]) $ Text.unlines dockerFile + it "allows using previous stages" $+ let dockerFile =+ [ "FROM random.com/foo AS builder1"+ , "FROM builder1 AS builder2"+ ]+ in ruleCatchesNot (registryIsAllowed ["random.com"]) $ Text.unlines dockerFile+ assertChecks :: HasCallStack => Rule -> Text.Text -> ([RuleCheck] -> IO a) -> IO a assertChecks rule s makeAssertions = case parseText (s <> "\n") of