Security review: ensure ownership of build and launch caches

[natalieparellano]

Description

In the security review, this is HIGH-2: Cache poisoning by accessing other applications caches. The action plan asks us to ensure that

Buildpacks binaries have to ensure that the build and launch caches belong to the application which is being built before processing them or restrict their usage by modifying the needed permissions

Proposed solution

• pack should expect a PACK_VOLUME_KEY environment variable containing a secret key, and when computing build and launch cache volume names, should take this key into account.
• When an application is first built, pack should generate a volume key for the application name and save it in ~/.pack/volume-keys.toml or similar.
• If PACK_VOLUME_KEY is unset, pack should source it from ~/.pack/volume-keys.toml (this avoids the need for application developers to keep track of this variable).
• PACK_VOLUME_KEY should be overridden when pack is running in CI (we could warn if this env var is unset and we detect that pack is running in a container as this effectively disables caching).
• We could recommend that platform operators use a repository secret for PACK_VOLUME_KEY.

Describe alternatives you've considered

We considered using a secret key combined with authentication codes stored in the cache root, but this is a heavier approach.

Additional context

• This feature should be documented somewhere

[natalieparellano]

I'll work on this one :)