fix: set PATH on bare-based rocks
Metadata
Current evaluation
Merged in #725 via commit b81a12c8, setting Pebble’s standard Ubuntu PATH on bare-based rock images to avoid an empty or unset image PATH.
Resolution: closed resolved
Reason: PR #725 was merged after maintainer approval and explicitly fixed #711. Commit b81a12c8 sets the standard PATH on bare-based rock images.
Evaluated by: mr-cal-bot
No scores available.
Issue body
If the PATH is empty, Pebble will be default use the standard Ubuntu value
of "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" (see [0]).
Follow this lead and set this value on the image's PATH.
This PATH setting on the image itself has no bearing on most cases, as the
PATH that prevails is the one defined by Pebble and its services, but an
empty (or unset) PATH is a potential security issue in cases where the pebble
entrypoint is bypassed.
0: https://github.com/canonical/pebble/blob/master/internals/overlord/cmdstate/request.go#L91
Fixes #711
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in #725 via commit b81a12c8, setting Pebble’s standard Ubuntu PATH on bare-based rock images to avoid an empty or unset image PATH. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/rockcraft#725 as b81a12c8, setting Ubuntu's default PATH in bare-based rock images and fixing #711. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #725 (commit b81a12c8), setting Pebble's default Ubuntu PATH on bare-based rock images and fixing #711 to mitigate security risks when the entrypoint is bypassed. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged fix that sets the default Ubuntu PATH on bare-based rocks images to mitigate security risks if the Pebble entrypoint is bypassed. Approved by three reviewers, passed CI, and resolves issue #711. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a fix setting the default Ubuntu PATH on bare-based rocks images. This prevents security risks if the Pebble entrypoint is bypassed and matches Pebble's default behavior. Resolves #711. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/rockcraft#711
(confidence 100%)
PR #725 states that it fixes #711; the linked issue records the fix as commit b81a12c8.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #711 Set PATH on the rock for bare bases | rockcraft | closed | Fixed in canonical/rockcraft#725 via commit b81a12c8, which sets Pebble's standard PATH on bare-based rock images. | |
| #552 fix: change pebble dir in 24.04 from /.rock/bin to /usr/bin | rockcraft | merged | Merged PR #552 (commit 15b653a2), moving Pebble from /.rock/bin to /usr/bin for Ubuntu 24.04 and later to provide a stable runtime path. | |
| #528 fix(pebble): place pebble in a separate location | rockcraft | merged | PR #528 merged via commit 3dddfa14, moving the Pebble binary from bin/ to .rock/bin so it no longer collides with Ubuntu 24.04 base-files' bin symlink to usr/bin. | |
| #525 Update pebble part for 24.04 rocks | rockcraft | closed | Updated Pebble placement for Ubuntu 24.04 rocks via merged PR #528 (commit 3dddfa14), avoiding the /bin-to-/usr/bin usrmerge symlink conflict. |