@Override
public TarArchiver customize(TarArchiver archiver) throws IOException {
log.warn("/--------------------- SECURITY WARNING ---------------------\\");
log.warn("|You are building a Docker image with normalized permissions.|");
log.warn("|All files and directories added to build context will have |");
log.warn("|'-rwxr-xr-x' permissions. It is recommended to double check |");
log.warn("|and reset permissions for sensitive files and directories. |");
log.warn("\\------------------------------------------------------------/");
if (innerCustomizer != null) {
archiver = innerCustomizer.customize(archiver);
}
TarArchiver newArchiver = new TarArchiver();
newArchiver.setDestFile(archiver.getDestFile());
newArchiver.setLongfile(TarLongFileMode.posix);
ResourceIterator resources = archiver.getResources();
while (resources.hasNext()) {
ArchiveEntry ae = resources.next();
String fileName = ae.getName();
PlexusIoResource resource = ae.getResource();
String name = StringUtils.replace(fileName, File.separatorChar, '/');
// See docker source:
// https://github.com/docker/docker/blob/3d13fddd2bc4d679f0eaa68b0be877e5a816ad53/pkg/archive/archive_windows.go#L45
int mode = ae.getMode() & 0777;
int newMode = mode;
newMode &= 0755;
newMode |= 0111;
if (newMode != mode) {
log.debug("Changing permissions of '%s' from %o to %o.", name, mode, newMode);
}
newArchiver.addResource(resource, name, newMode);
}
archiver = newArchiver;
return archiver;
}
