Merge pull request #86 from Cray-HPE/release/2.14.0

Release v2.14.0

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.14.0] - 2024-08-29
+### Dependencies
+- CSM 1.6 moved to Kubernetes 1.24, so use client v24.x to ensure compatibility
+- Simplify how `ims-python-helper` major/minor version is pinned
+
+### Changed
+- CASMCMS-9040 - change permissions on image config files after recipe build.
+
 ## [2.13.2] - 2024-07-25
 ### Dependencies
 - Resolve CVES:

constraints.txt

@@ -6,11 +6,11 @@ chardet==3.0.4
 docutils==0.14
 google-auth==1.6.3
 idna==2.8
-ims-python-helper==0.0.0-imspython
+ims-python-helper>=3.0,<3.1
 Jinja2==2.10.3
 jmespath==0.9.5
-# CSM 1.6 uses Kubernetes 1.22, so use client v22.x to ensure compatability
-kubernetes==22.6.0
+# CSM 1.6 moved to Kubernetes 1.24, so use client v24.x to ensure compatability
+kubernetes>=24.2,<24.3
 MarkupSafe<2.1.0
 oauthlib==2.1.0
 pyasn1==0.4.8

scripts/package_and_upload.sh

@@ -2,7 +2,7 @@
 #
 # MIT License
 #
-# (C) Copyright 2018-2023 Hewlett Packard Enterprise Development LP
+# (C) Copyright 2018-2024 Hewlett Packard Enterprise Development LP
 #
 # Permission is hereby granted, free of charge, to any person obtaining a
 # copy of this software and associated documentation files (the "Software"),
@@ -76,6 +76,22 @@ check_image_artifact_exists() {
 check_image_artifact_exists "$IMAGE_ROOT_DIR/boot/$KERNEL_FILENAME"
 check_image_artifact_exists "$IMAGE_ROOT_DIR/boot/$INITRD_FILENAME"
 
+# Change ownership and permissions on /image dir if it exists.
+#  This dir contains config files that may have sensative information
+#  in them and should only be readable by root.
+if [[ -d ${IMAGE_ROOT_DIR}/image ]]; then
+  # change read/write permissions of dir to root only
+  chown root ${IMAGE_ROOT_DIR}/image
+  chmod 700 ${IMAGE_ROOT_DIR}/image
+
+  # change files in the dir to root ownership and only rw for root
+  chown root ${IMAGE_ROOT_DIR}/image/*
+  chmod 600 ${IMAGE_ROOT_DIR}/image/*
+
+  # change the .sh file to rwx for root
+  chmod 700 ${IMAGE_ROOT_DIR}/image/*.sh
+fi
+
 # Make the squashfs formatted archive
 time mksquashfs "$IMAGE_ROOT_DIR" "$IMAGE_ROOT_PARENT/$IMAGE_ROOT_ARCHIVE_NAME.sqsh"
 fail_if_error "Creating squashfs of image root"