fix: remove builder proxy declarations from exported package environments

hydra/image.py

@@ -1,5 +1,8 @@
 """Prepare only exported Gentoo payloads and configure the dedicated guest network."""
 import argparse
+import bz2
+import io
+import runpy
 import hashlib
 import ipaddress
 import json
@@ -50,6 +53,39 @@ def write(root, relative, content, mode=0o644):
     return path
 
 
+def sanitize_saved_environments(root):
+    """Use Portage's parser to scrub exported declarations without evaluating them."""
+    database = root_path(root, 'var/db/pkg')
+    paths = sorted(database.glob('*/*/environment.bz2'))
+    result = {'files_scanned': len(paths), 'filtered_files': 0, 'variable_names': []}
+    if not paths:
+        return result
+    scripts = sorted(root_path(root, 'usr/lib/portage').glob('*/filter-bash-environment.py'))
+    if not scripts:
+        raise ImageError('Installed Portage environment filter is required for export')
+    script = root_path(root, scripts[0].relative_to(root))
+    api = runpy.run_path(str(script))
+    pattern = re.compile(rb'(?i:(?:HTTP|HTTPS|FTP|ALL|NO)_PROXY|.*(?:PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|ACCESS_KEY|CREDENTIAL|AUTHORIZATION).*)')
+    declarations = re.compile(rb'^(?:declare|export|readonly)\s+(?:-[^ ]+\s+)*([A-Za-z_][A-Za-z0-9_]*)=', re.M)
+    names = set()
+    for path in paths:
+        path = root_path(root, path.relative_to(root))
+        try:
+            original = bz2.decompress(path.read_bytes())
+        except (OSError, ValueError) as error:
+            raise ImageError('Cannot read an exported package environment') from error
+        filtered = io.BytesIO()
+        api['filter_bash_environment'](pattern, io.BytesIO(original), filtered)
+        clean = filtered.getvalue()
+        if clean != original:
+            names.update(name.decode('ascii') for name in declarations.findall(original)
+                         if pattern.fullmatch(name))
+            path.write_bytes(bz2.compress(clean))
+            result['filtered_files'] += 1
+    result['variable_names'] = sorted(names)
+    return result
+
+
 def sanitize_rootfs(root):
     """Erase builder identity/secrets in the exported copy, retaining Gentoo updates."""
     for relative in ('etc/portage/gnupg', 'etc/portage/gnupg.hydra-untrusted',
@@ -76,6 +112,8 @@ def sanitize_rootfs(root):
     write(root, 'etc/hosts', '127.0.0.1 localhost\n::1 localhost\n127.0.1.1 hydra-os\n')
     remove(root, 'etc/resolv.conf')
     root_path(root, 'etc/resolv.conf', follow_leaf=False).symlink_to('/run/NetworkManager/resolv.conf')
+    audit = sanitize_saved_environments(root)
+    write(root, 'usr/share/hydra/environment-sanitization.json', json.dumps(audit, indent=2) + '\n')
 
 
 def copy_overlay(root, overlay):