Files
LocalAI/scripts/build/gallery/main.go
T
localai-org-maint-botandlocalai-org-maint-bot 490b952d06 feat(gallery): publish signed OCI fallbacks (#12182)
* feat(gallery): publish signed OCI fallbacks

Publish both official gallery indexes with their local base configs so
an outage of the HTTP and GitHub sources can fall back to Quay.

Keep artifact signing policies separate from backend image policies,
and expose each moving gallery tag only after its digest is signed.

Assisted-by: Codex:gpt-6

* fix(gallery): confine packaged files to selected roots

Use directory-scoped file access to reject symlink escapes during gallery packaging. Create private bundle files for the publishing runner.

Assisted-by: Codex:GPT-6

---------

Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
2026-09-27 21:18:38 +02:00

95 lines
2.5 KiB
Go

// SPDX-License-Identifier: MIT
// Package the official index and its repository-local base configurations.
package main
import (
"fmt"
"os"
"path/filepath"
"strings"
"gopkg.in/yaml.v3"
)
func main() {
if len(os.Args) != 4 {
fmt.Fprintln(os.Stderr, "usage: gallery REPOSITORY {gallery|backend} OUTPUT")
os.Exit(1)
}
if err := packageGallery(os.Args[1], os.Args[2], os.Args[3]); err != nil {
fmt.Fprintln(os.Stderr, err)
os.Exit(1)
}
}
func packageGallery(root, source, output string) error {
if source != "gallery" && source != "backend" {
return fmt.Errorf("unsupported gallery directory %q", source)
}
repository, err := os.OpenRoot(root)
if err != nil {
return err
}
defer func() { _ = repository.Close() }()
body, err := repository.ReadFile(filepath.Join(source, "index.yaml"))
if err != nil {
return err
}
var doc yaml.Node
if err := yaml.Unmarshal(body, &doc); err != nil {
return err
}
// The build operator explicitly selects the output directory via the CLI.
if err := os.MkdirAll(output, 0700); err != nil { // #nosec G703 -- caller-selected output root
return err
}
destination, err := os.OpenRoot(output)
if err != nil {
return err
}
defer func() { _ = destination.Close() }()
// Keep the tree relative to the repository root so repeated base configs
// share a layer, even when an index refers outside its own directory.
const prefix = "github:mudler/LocalAI/"
var walk func(*yaml.Node) error
walk = func(n *yaml.Node) error {
if n.Kind == yaml.MappingNode {
for i := 0; i < len(n.Content); i += 2 {
value := n.Content[i+1]
if n.Content[i].Value != "url" || value.Kind != yaml.ScalarNode || !strings.HasPrefix(value.Value, prefix) || !strings.HasSuffix(value.Value, "@master") {
continue
}
path := strings.TrimSuffix(strings.TrimPrefix(value.Value, prefix), "@master")
if !filepath.IsLocal(path) {
return fmt.Errorf("base config escapes repository: %q", path)
}
config, err := repository.ReadFile(path)
if err != nil {
return err
}
if err := destination.MkdirAll(filepath.Dir(path), 0700); err != nil {
return err
}
if err := destination.WriteFile(path, config, 0600); err != nil {
return err
}
value.Value = filepath.ToSlash(path)
}
}
for _, child := range n.Content {
if err := walk(child); err != nil {
return err
}
}
return nil
}
if err := walk(&doc); err != nil {
return err
}
body, err = yaml.Marshal(&doc)
if err != nil {
return err
}
return destination.WriteFile("index.yaml", body, 0600)
}