[dead]
Trivy under attack again: Widespread GitHub Actions tag compromise secrets
61–70 of 97 posts
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#62Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#63Earlier quoted context omitted.
> it might not be so explicitly state, but a desire to have constant updated-ness w/ security patches amounts to an argument against pinning When you want to update, you update the hashes too. This isn’t an issue in any other packaging ecosystem, where locking (including hashing) is a baseline expectation. The main issue is developer ergonomics, which comes back to GitHub Actions providing very poor package managemen…
Honestly what I really want is the latter (mutable references), but pointing to aliases that I own and update manually (the former).
Yeah, that’s essentially what a lockfile would provide. I think GitHub Actions should really have an (official) one.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#64"GitHub's own security guidance recommends pinning actions to full commit SHAs as the only truly immutable way to consume an action" Why doesn't GitHub just enforce immutable versioning for actions? If you don't want immutable releases, you don't get to publish an Action. They could decide to enforce this and mitigate this class of issue.
Because the true name of the feature is VisualSourceSafe actions. It's all over the code of the runner if you take a second to look, and the runner, like the rest of the feature, is of typical early 2000s Microsoft quality, which is to say, none at all.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#65So by wanting to improve the security of my application, I ended up lowering the security of my application? Nice.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#66"GitHub's own security guidance recommends pinning actions to full commit SHAs as the only truly immutable way to consume an action" Why doesn't GitHub just enforce immutable versioning for actions? If you don't want immutable releases, you don't get to publish an Action. They could decide to enforce this and mitigate this class of issue.
Because the true name of the feature is VisualSourceSafe actions. It's all over the code of the runner if you take a second to look, and the runner, like the rest of the feature, is of typical early 2000s Microsoft quality, which is to say, none at all.
GitHub Actions, the feature that was years in the making, and launched in August 2018. Which Microsoft then acquired 2 months later.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#67"GitHub's own security guidance recommends pinning actions to full commit SHAs as the only truly immutable way to consume an action" Why doesn't GitHub just enforce immutable versioning for actions? If you don't want immutable releases, you don't get to publish an Action. They could decide to enforce this and mitigate this class of issue.
Even then, that's only immutable for the workflow config. Many workflows then go on to pull in mutable inputs downstream (eg: default to "latest" version).
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#68"GitHub's own security guidance recommends pinning actions to full commit SHAs as the only truly immutable way to consume an action" Why doesn't GitHub just enforce immutable versioning for actions? If you don't want immutable releases, you don't get to publish an Action. They could decide to enforce this and mitigate this class of issue.
Because the true name of the feature is VisualSourceSafe actions. It's all over the code of the runner if you take a second to look, and the runner, like the rest of the feature, is of typical early 2000s Microsoft quality, which is to say, none at all.
Yep, once you start looking into the inner workings, you realize it's just a rebranded Azure Pipelines with a ton of technical debt attached.
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#69"GitHub's own security guidance recommends pinning actions to full commit SHAs as the only truly immutable way to consume an action" Why doesn't GitHub just enforce immutable versioning for actions? If you don't want immutable releases, you don't get to publish an Action. They could decide to enforce this and mitigate this class of issue.
A better question perhaps is why we’ve allowed ourselves to be so vulnerable by a single provider (GitHub). Supply chain attacks would have a significantly smaller blast radius if people start using their own forges. GitHub as a social network is no longer a good idea
Re: Trivy under attack again: Widespread GitHub Actions tag compromise secrets
#70How the heck are credential compromises still a thing with 2FA and refresh tokens???
Usually through service accounts. Those are single factor.