Security audit fixes + CI supply-chain guards#31
Closed
electricapp wants to merge 3 commits into
Closed
Conversation
sandbox: PR_SET_DUMPABLE(0) on orchestrator+proxies; join egress cgroup in pre_exec (close exec->migrate window); cgroup.kill teardown; WNOWAIT stop; F_DUPFD_CLOEXEC; helper read timeouts; unique cgroup suffix crypto: DSSE/chain fail-closed (unsigned attestation != verified); cert SAN identity binding to owner/repo; single /commits fetch; cap error bodies scanner: download-artifact pattern globs; per-line external-artifact exemptions (no decoy bypass); normalize injection contexts (case/index); case-insensitive actions/checkout; audit local composite actions; conclusion-gate || bypass; id-token/security-events/deployments scopes; case-insensitive secret extraction oidc: flag wildcard aud; degrade GCP || attribute conditions to wildcard cli/proxy: guard --diff-base ref before git show; block signals on signal worker thread; replay distinguishes git error from missing file; case-insensitive forbidden-method block; connection rate window (no mid-build kill); stream request body misc: alias-bomb guard on manifest/oidc parse; reject path traversal in ipc
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch of security/correctness fixes from a deep audit, plus CI supply-chain hardening.
Security:
/proc/<ppid>/environsecret leak (PR_SET_DUMPABLE), close the pre-cgroup egress window (join cgroup in pre_exec), cgroup.kill teardown, PID-reuse-safe stop||bypass, extra permission scopesaud, degrade GCP||conditions to wildcard, guard--diff-baseagainst git arg-injection, connection rate window (no mid-build kill), streamed request bodiesCI: cargo-deny + deny.toml, actionlint, cargo-machete, scheduled audit, repo settings.
Tests + clippy pass on macOS and the linux target.