add a new flag in build db to protect deploy only happens from trusted artifact build
move new flag into EnvBean instead of BuildBean
correct buildBean and EnvBean settings
update test
update warning message to be more clear
MODIFY
deploy-service/common/src/main/java/com/pinterest/deployservice/bean/EnvironBean.java
deploy-service/common/src/main/java/com/pinterest/deployservice/bean/EnvironBean.java
@@ -61,7 +61,8 @@ import java.io.Serializable;
* schedule_id VARCHAR(22) DEFAULT NULL,
* deploy_constraint_id VARCHAR(22) DEFAULT NULL,
* external_id CHAR(36),
- * allow_private_build TINYINT(1) DEFAULT 0
+ * allow_private_build TINYINT(1) DEFAULT 0,
+ * ensure_trusted_build TINYINT(1) DEFAULT 0,
* <p>
* PRIMARY KEY (env_id)
* );
@@ -184,6 +185,9 @@ public class EnvironBean implements Updatable, Serializable {
@JsonProperty("allowPrivateBuild")
private Boolean allow_private_build;
+ @JsonProperty("ensureTrustedBuild")
+ private Boolean ensure_trusted_build;
+
public String getWebhooks_config_id() {
return webhooks_config_id;
}
@@ -488,6 +492,14 @@ public class EnvironBean implements Updatable, Serializable {
this.allow_private_build = allow_private_build;
}
+ public Boolean getEnsure_trusted_build() {
+ return ensure_trusted_build;
+ }
+
+ public void setEnsure_trusted_build(Boolean ensure_trusted_build) {
+ this.ensure_trusted_build = ensure_trusted_build;
+ }
+
@Override
public SetClause genSetClause() {
SetClause clause = new SetClause();
@@ -529,6 +541,7 @@ public class EnvironBean implements Updatable, Serializable {
clause.addColumn("deploy_constraint_id", deploy_constraint_id);
clause.addColumn("external_id", external_id);
clause.addColumn("allow_private_build", allow_private_build);
+ clause.addColumn("ensure_trusted_build", ensure_trusted_build);
return clause;
}

MODIFY
deploy-service/common/src/main/resources/sql/deploy.sql
deploy-service/common/src/main/resources/sql/deploy.sql
@@ -41,6 +41,7 @@ CREATE TABLE IF NOT EXISTS environs (
deploy_constraint_id VARCHAR(22),
external_id CHAR(36),
allow_private_build TINYINT(1) NOT NULL DEFAULT 0,
+ ensure_trusted_build TINYINT(1) NOT NULL DEFAULT 0,
PRIMARY KEY (env_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE UNIQUE INDEX env_name_stage_idx ON environs (env_name, stage_name);

MODIFY
deploy-service/common/src/test/java/com/pinterest/deployservice/db/DBDAOTest.java
deploy-service/common/src/test/java/com/pinterest/deployservice/db/DBDAOTest.java
@@ -1076,6 +1076,7 @@ public class DBDAOTest {
envBean.setMax_parallel_rp(1);
envBean.setOverride_policy(OverridePolicy.OVERRIDE);
envBean.setAllow_private_build(false);
+ envBean.setEnsure_trusted_build(false);
return envBean;
}

MODIFY
deploy-service/teletraanservice/src/main/java/com/pinterest/teletraan/resource/EnvDeploys.java
deploy-service/teletraanservice/src/main/java/com/pinterest/teletraan/resource/EnvDeploys.java
@@ -219,6 +219,11 @@ public class EnvDeploys {
throw new TeletaanInternalException(Response.Status.BAD_REQUEST, String.format("This stage does not allow deploying a private build. Please Contact #teletraan and #security-related to whitelist your stage for deploying private build"));
}
+ // check if the build is from a trusted artifact url
+ if(!buildBean.getArtifact_url().startsWith("https://soxrepo.pinadmin.com") && envBean.getEnsure_trusted_build()) {
+ throw new TeletaanInternalException(Response.Status.BAD_REQUEST, String.format("This build is not allowed to deploy. Please Contact #teletraan and #security-related to ensure the build artifact is published to a trusted url"));
+ }
+
String deployId = deployHandler.deploy(envBean, buildId, description, operator);
LOG.info("Successfully create deploy {} for env {}/{} by {}.", deployId, envName, stageName, operator);

ADD
tools/mysql/schema-update-6.sql
+-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+-- ALWAYS BACKUP YOUR DATA BEFORE EXECUTING THIS SCRIPT
+-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+# This script upgrade DB schema from version 5 to version 6
+
+ALTER TABLE environs ADD COLUMN ensure_trusted_build TINYINT(1) NOT NULL DEFAULT 0;
+
+-- make sure to update the schema version to 5
+UPDATE schema_versions SET version=6;
\ No newline at end of file

add a new flag in build db to protect deploy only happens from trusted artifact build (#693)

move new flag into EnvBean instead of BuildBean

correct buildBean and EnvBean settings

update test

update warning message to be more clear