mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 06:56:40 +01:00
MetalandAlex Goodman
b0a8de7bf6
* fix(redact): reset redaction store between command runs cli.Command() may be invoked more than once in the same process (e.g. when syft is embedded as a library). The clio initializer calls internal/redact.Set on every command execution, but the redact store is process-global and Set panics when a store already exists, so the second invocation dies with "replace existing redaction store (probably unintentional)". Add redact.Reset() to clear the previous run's store and call it in the initializer before Set. The double-Set guard in Set is kept: an unexpected second Set within a single run still panics. Add TestAppClioSetupConfigInitializerCanRunMultipleTimes which runs the initializer twice; it panics with the exact reported message on the old code and passes with the fix. Fixes #2285 Signed-off-by: JasonMetal <935216773@qq.com> * fix(redact): release the redact store at the end of each run Clear the global redact store in the post-run hook instead of resetting it before every `Set`. The double-`Set` panic keeps its meaning: a store is only present while a run is in flight, so a second run starting mid-run still panics rather than splitting secrets across two stores and leaking the ones in the dropped store. Sequential runs in the same process work since the previous run releases its store on the way out. A run only releases the store it set, so it never clears a store owned by someone else. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: JasonMetal <935216773@qq.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
64 lines
2.3 KiB
Go
64 lines
2.3 KiB
Go
package internal
|
|
|
|
import (
|
|
"io"
|
|
"os"
|
|
|
|
"github.com/anchore/clio"
|
|
"github.com/anchore/stereoscope"
|
|
handler "github.com/anchore/syft/cmd/syft/cli/ui"
|
|
"github.com/anchore/syft/cmd/syft/internal/ui"
|
|
"github.com/anchore/syft/internal/bus"
|
|
"github.com/anchore/syft/internal/log"
|
|
"github.com/anchore/syft/internal/redact"
|
|
)
|
|
|
|
func AppClioSetupConfig(id clio.Identification, out io.Writer) *clio.SetupConfig {
|
|
clioCfg := clio.NewSetupConfig(id).
|
|
WithGlobalConfigFlag(). // add persistent -c <path> for reading an application config from
|
|
WithGlobalLoggingFlags(). // add persistent -v and -q flags tied to the logging config
|
|
WithConfigInRootHelp(). // --help on the root command renders the full application config in the help text
|
|
WithUIConstructor(
|
|
// select a UI based on the logging configuration and state of stdin (if stdin is a tty)
|
|
func(cfg clio.Config) (*clio.UICollection, error) {
|
|
noUI := ui.None(out, cfg.Log.Quiet)
|
|
if !cfg.Log.AllowUI(os.Stdin) || cfg.Log.Quiet {
|
|
return clio.NewUICollection(noUI), nil
|
|
}
|
|
|
|
return clio.NewUICollection(
|
|
ui.New(out, cfg.Log.Quiet,
|
|
handler.New(handler.DefaultHandlerConfig()),
|
|
),
|
|
noUI,
|
|
), nil
|
|
},
|
|
).
|
|
WithInitializers(
|
|
func(state *clio.State) error {
|
|
// clio is setting up and providing the bus, redact store, and logger to the application. Once loaded,
|
|
// we can hoist them into the internal packages for global use.
|
|
stereoscope.SetBus(state.Bus)
|
|
bus.Set(state.Bus)
|
|
|
|
// the redact store is process-global and only cleared when a run ends (see the post-run below), so
|
|
// setting it while another run is still in flight panics rather than splitting secrets across stores.
|
|
redact.Set(state.RedactStore)
|
|
|
|
log.Set(state.Logger)
|
|
stereoscope.SetLogger(state.Logger.Nested("from", "stereoscope"))
|
|
return nil
|
|
},
|
|
).
|
|
WithPostRuns(func(state *clio.State, _ error) {
|
|
stereoscope.Cleanup() //nolint:staticcheck // we don't have access to the image object here
|
|
|
|
// release the redact store now that nothing in this run can report anymore, so a later run in the same
|
|
// process (e.g. syft embedded as a library) can set its own. Only release the store this run set.
|
|
if redact.Get() == state.RedactStore {
|
|
redact.Reset()
|
|
}
|
|
})
|
|
return clioCfg
|
|
}
|