Skip to content

Consolidate trust logic into IsTrustedBuilder #2573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
runesoerensen wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Consolidate trust logic into IsTrustedBuilder #2573

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dbceb5f
Add failing test for `IsTrustedBuilder` not matching tagless known bu…
runesoerensen Apr 15, 2026
85e15fc
Consolidate trust logic in IsTrustedBuilder with smart tag matching
runesoerensen Apr 15, 2026
90e1d2a
Merge branch 'main' into runesoerensen/consolidate-trusted-builder-logic
jjbustamante May 18, 2026
6bb75db
Apply smart matching to IsKnownTrustedBuilder
runesoerensen Jun 4, 2026
3dc1da2
Add caller-level tests for tagged known trusted builders
runesoerensen Jun 4, 2026
fa3cc50
Merge remote-tracking branch 'origin/main' into runesoerensen/consoli…
runesoerensen Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion internal/builder/trusted_builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,11 +122,29 @@ func IsTrustedBuilder(cfg config.Config, builderName string) (bool, error) {
if err != nil {
return false, err
}

// Collect all trusted builder names
var trustedBuilderNames []string

// Add known trusted builders
for _, knownBuilder := range KnownBuilders {
if knownBuilder.Trusted {
trustedBuilderNames = append(trustedBuilderNames, knownBuilder.Image)
}
}

// Add user-configured trusted builders
for _, trustedBuilder := range cfg.TrustedBuilders {
trustedBuilderReference, err := name.ParseReference(trustedBuilder.Name, name.WithDefaultTag(""))
trustedBuilderNames = append(trustedBuilderNames, trustedBuilder.Name)
}

// Check if builder matches any trusted builder
for _, trustedBuilderName := range trustedBuilderNames {
trustedBuilderReference, err := name.ParseReference(trustedBuilderName, name.WithDefaultTag(""))
if err != nil {
return false, err
}

if trustedBuilderReference.Identifier() != "" {
if builderReference.Name() == trustedBuilderReference.Name() {
return true, nil
Expand All @@ -137,5 +155,6 @@ func IsTrustedBuilder(cfg config.Config, builderName string) (bool, error) {
}
}
}

return false, nil
}
17 changes: 17 additions & 0 deletions internal/builder/trusted_builder_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,23 @@ func trustedBuilder(t *testing.T, when spec.G, it spec.S) {
})

when("IsTrustedBuilder", func() {
it("trusts known trusted builders", func() {
// Known builder with exact tag match
isTrusted, err := bldr.IsTrustedBuilder(config.Config{}, "heroku/builder:24")
h.AssertNil(t, err)
h.AssertTrue(t, isTrusted)

// Known builder without tag should match any tag
isTrusted, err = bldr.IsTrustedBuilder(config.Config{}, "paketobuildpacks/builder-jammy-base:latest")

@jjbustamante jjbustamante May 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this test case reference: paketobuildpacks/builder-jammy-base?

@runesoerensen runesoerensen May 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The :latest here is intentional - this case exercises the "known entry has no tag, match any tag in the same repository" branch of the new name.ParseReference logic, which is what #2572 is about and is also the example shown in the Before/After in the PR description.

The heroku/builder:24 case above covers the exact-tag branch. Switching to a bare paketobuildpacks/builder-jammy-base would collapse this into a bare-vs-bare repository match and stop exercising the "any tag" path.

Happy to expand the inline comment if it'd read more clearly, or add a second assertion with a different tag (e.g. :anything) to make the "any tag" intent more obvious - let me know what you'd prefer (or if I'm missing something obvious :)).

h.AssertNil(t, err)
h.AssertTrue(t, isTrusted)

// Unknown builder should not be trusted
isTrusted, err = bldr.IsTrustedBuilder(config.Config{}, "my/private/builder")
h.AssertNil(t, err)
h.AssertFalse(t, isTrusted)
})

it("trust image without tag", func() {
cfg := config.Config{
TrustedBuilders: []config.TrustedBuilder{
Expand Down
2 changes: 1 addition & 1 deletion internal/commands/build.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ func Build(logger logging.Logger, cfg config.Config, packClient PackClient) *cob
if err != nil {
return err
}
trustBuilder := isTrusted || bldr.IsKnownTrustedBuilder(builder) || flags.TrustBuilder
trustBuilder := isTrusted || flags.TrustBuilder
if trustBuilder {
logger.Debugf("Builder %s is trusted", style.Symbol(builder))
if flags.LifecycleImage != "" {
Expand Down
2 changes: 1 addition & 1 deletion internal/commands/builder_inspect.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ func inspectBuilder(
builderInfo := writer.SharedBuilderInfo{
Name: imageName,
IsDefault: imageName == cfg.DefaultBuilder,
Trusted: isTrusted || bldr.IsKnownTrustedBuilder(imageName),
Trusted: isTrusted,
}

localInfo, localErr := inspector.InspectBuilder(imageName, true, client.WithDetectionOrderDepth(flags.Depth))
Expand Down
2 changes: 1 addition & 1 deletion internal/commands/config_trusted_builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ func addTrustedBuilder(args []string, logger logging.Logger, cfg config.Config,
if err != nil {
return err
}
if isTrusted || bldr.IsKnownTrustedBuilder(imageName) {
if isTrusted {
logger.Infof("Builder %s is already trusted", style.Symbol(imageName))
return nil
}
Expand Down
Loading