MartijnVisser commented on code in PR #21873:
URL: https://github.com/apache/flink/pull/21873#discussion_r1155717192
##########
tools/azure-pipelines/e2e-template.yml:
##########
@@ -98,6 +98,19 @@ jobs:
echo "Free up disk space"
./tools/azure-pipelines/free_disk_space.sh
+
+ # the APT mirrors access is based on a proposal from
https://github.com/actions/runner-images/issues/7048#issuecomment-1419426054
+ echo "Configure APT mirrors"
+ mirror_file_path="/etc/apt/mirrors.txt"
+ default_ubuntu_mirror_url="http://azure.archive.ubuntu.com/ubuntu/";
+
+ # add Azure's Ubuntu mirror as a top-priority source
+ echo -e "${default_ubuntu_mirror_url}\tpriority:1" | sudo tee
${mirror_file_path}
+
+ # use other mirrors as a fallback option
+ curl http://mirrors.ubuntu.com/mirrors.txt | sudo tee --append
${mirror_file_path}
Review Comment:
> It makes us vulnerable because we're relying on
`mirrors.ubuntu.com/mirrors.txt`
Yes
> What about specifying a fixed list of mirrors ourselves instead of relying
on an external service?
That would remove the attack vector, as long as we specify it in the repo :)2
##########
tools/azure-pipelines/e2e-template.yml:
##########
@@ -98,6 +98,19 @@ jobs:
echo "Free up disk space"
./tools/azure-pipelines/free_disk_space.sh
+
+ # the APT mirrors access is based on a proposal from
https://github.com/actions/runner-images/issues/7048#issuecomment-1419426054
+ echo "Configure APT mirrors"
+ mirror_file_path="/etc/apt/mirrors.txt"
+ default_ubuntu_mirror_url="http://azure.archive.ubuntu.com/ubuntu/";
+
+ # add Azure's Ubuntu mirror as a top-priority source
+ echo -e "${default_ubuntu_mirror_url}\tpriority:1" | sudo tee
${mirror_file_path}
+
+ # use other mirrors as a fallback option
+ curl http://mirrors.ubuntu.com/mirrors.txt | sudo tee --append
${mirror_file_path}
Review Comment:
> It makes us vulnerable because we're relying on
`mirrors.ubuntu.com/mirrors.txt`
Yes
> What about specifying a fixed list of mirrors ourselves instead of relying
on an external service?
That would remove the attack vector, as long as we specify it in the repo :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
