feat(sbom): enforce network isolation for Stapel stages when SBOM enabled

pkg/build/build_phase.go

@@ -354,6 +354,10 @@ func (phase *BuildPhase) scanOptionsForImage(img *image.Image) scanner.ScanOptio
 		return scanOpts
 	}
 
+	if len(scanOpts.Commands) == 0 {
+		return scanOpts
+	}
+
 	catalogers := managedinput.ToCatalogers(stapelConfig.ImageBaseConfig().Packages)
 	for i := range scanOpts.Commands {
 		scanOpts.Commands[i].Catalogers = catalogers

pkg/build/builder/ansible.go

@@ -73,6 +73,14 @@ func (b *Ansible) BeforeSetupChecksum(ctx context.Context) string {
 }
 func (b *Ansible) SetupChecksum(ctx context.Context) string { return b.stageChecksum(ctx, "Setup") }
 
+func (b *Ansible) IsPackagesEmpty(_ context.Context) bool { return true }
+
+func (b *Ansible) Packages(_ context.Context, _ container_backend.ContainerBackend, _ stage_builder.StageBuilderInterface, _ bool) error {
+	return nil
+}
+
+func (b *Ansible) PackagesChecksum(_ context.Context) string { return "" }
+
 func (b *Ansible) isEmptyStage(ctx context.Context, userStageName string) bool {
 	return b.stageChecksum(ctx, userStageName) == ""
 }

pkg/build/builder/builder.go

@@ -13,14 +13,17 @@ type Builder interface {
 	IsInstallEmpty(ctx context.Context) bool
 	IsBeforeSetupEmpty(ctx context.Context) bool
 	IsSetupEmpty(ctx context.Context) bool
+	IsPackagesEmpty(ctx context.Context) bool
 	BeforeInstall(ctx context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error
 	Install(ctx context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error
 	BeforeSetup(ctx context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error
 	Setup(ctx context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error
+	Packages(ctx context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error
 	BeforeInstallChecksum(ctx context.Context) string
 	InstallChecksum(ctx context.Context) string
 	BeforeSetupChecksum(ctx context.Context) string
 	SetupChecksum(ctx context.Context) string
+	PackagesChecksum(ctx context.Context) string
 }
 
 type Container interface {

pkg/build/builder/shell.go

@@ -40,6 +40,8 @@ func (b *Shell) IsBeforeSetupEmpty(ctx context.Context) bool {
 }
 func (b *Shell) IsSetupEmpty(ctx context.Context) bool { return b.isEmptyStage(ctx, "Setup") }
 
+func (b *Shell) IsPackagesEmpty(ctx context.Context) bool { return b.isEmptyStage(ctx, "Packages") }
+
 func (b *Shell) BeforeInstall(_ context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error {
 	return b.stage(cr, stageBuilder, useLegacyStapelBuilder, "BeforeInstall")
 }
@@ -56,14 +58,19 @@ func (b *Shell) Setup(_ context.Context, cr container_backend.ContainerBackend,
 	return b.stage(cr, stageBuilder, useLegacyStapelBuilder, "Setup")
 }
 
+func (b *Shell) Packages(_ context.Context, cr container_backend.ContainerBackend, stageBuilder stage_builder.StageBuilderInterface, useLegacyStapelBuilder bool) error {
+	return b.stage(cr, stageBuilder, useLegacyStapelBuilder, "Packages")
+}
+
 func (b *Shell) BeforeInstallChecksum(ctx context.Context) string {
 	return b.stageChecksum(ctx, "BeforeInstall")
 }
 func (b *Shell) InstallChecksum(ctx context.Context) string { return b.stageChecksum(ctx, "Install") }
 func (b *Shell) BeforeSetupChecksum(ctx context.Context) string {
 	return b.stageChecksum(ctx, "BeforeSetup")
 }
-func (b *Shell) SetupChecksum(ctx context.Context) string { return b.stageChecksum(ctx, "Setup") }
+func (b *Shell) SetupChecksum(ctx context.Context) string    { return b.stageChecksum(ctx, "Setup") }
+func (b *Shell) PackagesChecksum(ctx context.Context) string { return b.stageChecksum(ctx, "Packages") }
 
 func (b *Shell) isEmptyStage(ctx context.Context, userStageName string) bool {
 	return b.stageChecksum(ctx, userStageName) == ""

pkg/build/image/image_tree.go

@@ -431,6 +431,7 @@ func stageDependenciesToMap(sd *config.StageDependencies) map[stage.StageName][]
 		stage.Install:     sd.Install,
 		stage.BeforeSetup: sd.BeforeSetup,
 		stage.Setup:       sd.Setup,
+		stage.Packages:    sd.Packages,
 	}
 
 	return result

pkg/build/image/stapel.go

@@ -113,6 +113,8 @@ func initStages(ctx context.Context, image *Image, metaConfig *config.Meta, stap
 		stages = append(stages, stage.NewGitArchiveStage(gitArchiveStageOptions, baseStageOptions))
 	}
 
+	stages = appendIfExist(ctx, stages, stage.GeneratePackagesStage(ctx, imageBaseConfig, gitPatchStageOptions, baseStageOptions))
+
 	stages = appendIfExist(ctx, stages, stage.GenerateInstallStage(ctx, imageBaseConfig, gitPatchStageOptions, baseStageOptions))
 	stages = appendIfExist(ctx, stages, stage.GenerateDependenciesAfterInstallStage(imageBaseConfig, baseStageOptions))
 	stages = appendIfExist(ctx, stages, stage.GenerateBeforeSetupStage(ctx, imageBaseConfig, gitPatchStageOptions, baseStageOptions))
@@ -149,11 +151,36 @@ func initStages(ctx context.Context, image *Image, metaConfig *config.Meta, stap
 		}
 	}
 
+	sbomEnabled := metaConfig.Build.Sbom != nil && metaConfig.Build.Sbom.Enable
+	if sbomEnabled {
+		hasShellStages := false
+		for _, s := range stages {
+			if stageHasNetworkAccess(s) {
+				continue
+			}
+			if no, ok := s.(interface{ SetNetworkOverride(string) }); ok {
+				no.SetNetworkOverride("none")
+				hasShellStages = true
+			}
+		}
+
+		if hasShellStages {
+			logboek.Context(ctx).Warn().LogLn("Network is disabled for shell stages (build.sbom.enable is true). Declare dependencies via 'packages' directive.")
+		}
+	}
+
 	image.SetStages(stages)
 
 	return nil
 }
 
+func stageHasNetworkAccess(s stage.Interface) bool {
+	if nn, ok := s.(interface{ NeedsNetwork() bool }); ok {
+		return nn.NeedsNetwork()
+	}
+	return false
+}
+
 // TODO(v3): make this a hard error instead of a warning.
 func warnStageDependenciesWithoutInstructions(ctx context.Context, imageBaseConfig *config.StapelImageBase, gitMappings []*stage.GitMapping) {
 	for _, gitMapping := range gitMappings {

pkg/build/stage/base.go

@@ -33,6 +33,7 @@ const (
 	DependenciesBeforeSetup   StageName = "dependenciesBeforeSetup"
 	Setup                     StageName = "setup"
 	DependenciesAfterSetup    StageName = "dependenciesAfterSetup"
+	Packages                  StageName = "packages"
 	GitCache                  StageName = "gitCache"
 	GitLatestPatch            StageName = "gitLatestPatch"
 	DockerInstructions        StageName = "dockerInstructions"
@@ -88,6 +89,7 @@ type BaseStageOptions struct {
 	ContainerWerfDir  string
 	ProjectName       string
 	Network           string
+	NeedsNetwork      bool
 }
 
 const disableGitCommitAncestryCheckEnv = "WERF_DISABLE_GIT_COMMIT_ANCESTRY_CHECK"
@@ -120,6 +122,7 @@ func NewBaseStage(name StageName, options *BaseStageOptions) *BaseStage {
 	s.containerWerfDir = options.ContainerWerfDir
 	s.projectName = options.ProjectName
 	s.network = options.Network
+	s.needsNetwork = options.NeedsNetwork
 	s.meta = &StageMeta{}
 	return s
 }
@@ -138,6 +141,8 @@ type BaseStage struct {
 	configMounts     []*config.Mount
 	projectName      string
 	network          string
+	networkOverride  string
+	needsNetwork     bool
 	meta             *StageMeta
 }
 
@@ -151,6 +156,14 @@ func (s *BaseStage) IsBuildable() bool {
 	return true
 }
 
+func (s *BaseStage) SetNetworkOverride(network string) {
+	s.networkOverride = network
+}
+
+func (s *BaseStage) NeedsNetwork() bool {
+	return s.needsNetwork
+}
+
 func (s *BaseStage) IsMutable() bool {
 	return false
 }
@@ -344,11 +357,16 @@ func (s *BaseStage) PrepareImage(ctx context.Context, c Conveyor, cb container_b
 
 	s.addProjectRepoCommitLabel(ctx, c, cb, stageImage)
 
-	if s.network != "" {
+	network := s.network
+	if s.networkOverride != "" {
+		network = s.networkOverride
+	}
+
+	if network != "" {
 		if c.UseLegacyStapelBuilder(cb) {
-			stageImage.Builder.LegacyStapelStageBuilder().Container().RunOptions().AddNetwork(s.network)
+			stageImage.Builder.LegacyStapelStageBuilder().Container().RunOptions().AddNetwork(network)
 		} else {
-			stageImage.Builder.StapelStageBuilder().SetNetwork(s.network)
+			stageImage.Builder.StapelStageBuilder().SetNetwork(network)
 		}
 	}
 

pkg/build/stage/packages.go

@@ -0,0 +1,52 @@
+package stage
+
+import (
+	"context"
+
+	"github.com/werf/common-go/pkg/util"
+	"github.com/werf/werf/v2/pkg/build/builder"
+	"github.com/werf/werf/v2/pkg/config"
+	"github.com/werf/werf/v2/pkg/container_backend"
+)
+
+type PackagesStage struct {
+	*UserWithGitPatchStage
+}
+
+func GeneratePackagesStage(ctx context.Context, imageBaseConfig *config.StapelImageBase, gitPatchStageOptions *NewGitPatchStageOptions, baseStageOptions *BaseStageOptions) *PackagesStage {
+	b := getBuilder(imageBaseConfig, baseStageOptions)
+	if b != nil && !b.IsPackagesEmpty(ctx) {
+		return newPackagesStage(b, gitPatchStageOptions, baseStageOptions)
+	}
+
+	return nil
+}
+
+func newPackagesStage(builder builder.Builder, gitPatchStageOptions *NewGitPatchStageOptions, baseStageOptions *BaseStageOptions) *PackagesStage {
+	opts := *baseStageOptions
+	opts.NeedsNetwork = true
+	s := &PackagesStage{}
+	s.UserWithGitPatchStage = newUserWithGitPatchStage(builder, Packages, gitPatchStageOptions, &opts)
+	return s
+}
+
+func (s *PackagesStage) GetDependencies(ctx context.Context, c Conveyor, cb container_backend.ContainerBackend, prevImage, prevBuiltImage *StageImage, buildContextArchive container_backend.BuildContextArchiver) (string, error) {
+	stageDependenciesChecksum, err := s.getStageDependenciesChecksum(ctx, c, Packages)
+	if err != nil {
+		return "", err
+	}
+
+	return util.Sha256Hash(s.builder.PackagesChecksum(ctx), stageDependenciesChecksum), nil
+}
+
+func (s *PackagesStage) PrepareImage(ctx context.Context, c Conveyor, cb container_backend.ContainerBackend, prevBuiltImage, stageImage *StageImage, buildContextArchive container_backend.BuildContextArchiver) error {
+	if err := s.UserWithGitPatchStage.PrepareImage(ctx, c, cb, prevBuiltImage, stageImage, nil); err != nil {
+		return err
+	}
+
+	if err := s.builder.Packages(ctx, cb, stageImage.Builder, c.UseLegacyStapelBuilder(cb)); err != nil {
+		return err
+	}
+
+	return nil
+}