9457 2016-04-13 13:52:38 +0000 patchtest: document deployment with isolation features 2017-12-06 16:52:48 +0000 1 1 6 Yocto Project Subprojects Patchwork/Patchtest Patchtest 2.1 x86 Multiple RESOLVED FIXED High enhancement 2.2 M4 1 leonardo.sandoval.gonzalez leonardo.sandoval.gonzalez anibal.limon bluelightning mariano.lopez sgw --- --- No (bug/feature does not impact docs) oldest_to_newest 61152 0 leonardo.sandoval.gonzalez 2016-04-13 13:52:38 +0000 patchtest can take malicious patches and in the testing/execution phase, these may do some damage on the system that patchtest is running. The framework should either work in isolation (container?) or find a way to detect malicious patches before processing. 62960 1 leonardo.sandoval.gonzalez 2016-06-14 14:07:57 +0000 This work is in progress and should be finished early 2.2M2. 63208 2 leonardo.sandoval.gonzalez 2016-06-21 16:59:47 +0000 Moving back to M1. Any change on milestone must be discussed previously with the CCB. 65392 3 leonardo.sandoval.gonzalez 2016-08-22 15:43:39 +0000 Current proposal is being reviewed internally, so moving the bug's status. 65640 4 leonardo.sandoval.gonzalez 2016-08-31 14:41:46 +0000 The approach suggested to isolate the patchtest execution was the following: a qemu machine as VM, launched with arguments indicating a common share folder (virtualized with virtFS) previously populated with all required data: repos and mboxes. Once launched, the machine will automatically execute patchtest and created a folder with results. Once all mboxes are tested, the machine will shutdown; host would parse the output folder and post results. Moving to In Progress Implementation because the qemu machine is not yet ready. What is missing is a custom layer containing two main things: a init script (to launch the execution and shutdown) and required recipes/packages for the final image. The above approach was considered secured enough so this allows to expose patchtest and patchtest-oe code **once** the qemu machine is ready. 66146 5 leonardo.sandoval.gonzalez 2016-09-14 16:14:56 +0000 Documentation/code being reviewed internally (security team) before it can go public. 66886 6 leonardo.sandoval.gonzalez 2016-10-04 19:26:18 +0000 The security team has fully approved the approach taken to isolate patchtest, so the source code (both patchtest and patchtest-oe) can go public.