fix: replace ADD with COPY #2180
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chmeliik
reviewed
Sep 25, 2025
MartinBasti
force-pushed
the
replace-add-with-copy
branch
from
ca37071 to
581554d
Compare
chmeliik
approved these changes
Sep 25, 2025
rcerven
requested changes
Oct 2, 2025
MartinBasti
force-pushed
the
replace-add-with-copy
branch
from
581554d to
327c808
Compare
RHACS reports OSBS images as vulnerable because of the usage of ADD instruction, that allows to fetch remote content. It's false positive as OSBS uses local resources only, but it scares users. We need to use keep ADD instruction to inject filestystem for base image builds, to untar sources STONEBLD-3815 Signed-off-by: Martin Basti <mbasti@redhat.com>
MartinBasti
force-pushed
the
replace-add-with-copy
branch
from
327c808 to
95e1156
Compare
rcerven
approved these changes
Oct 2, 2025
MartinBasti
merged commit 96d90ce
into
containerbuildsystem:master
13 of 15 checks passed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
RHACS reports OSBS images as vulnerable because of the usage of ADD instruction, that allows to fetch remote content.
It's false positive as OSBS uses local resources only, but it scares users.
We don't need to use ADD instruction, we can replace it with COPYWe need to keep ADD instruction for building base images, as it untars archive into filesystem.
STONEBLD-3815
Maintainers will complete the following section