Determine security requirements for automating kernel builds
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- aws, docker, python
- Domain
- build-system, ci-cd, cloud, infrastructure, security
Research direction
Start with the make securedrop-core-5.15 and make securedrop-workstation-5.15 entry points and review the current build-log, S3 signing, and apt-test upload steps. Compare the CircleCI or other cloud, controlled DigitalOcean, FPF physical-machine, and maintainer-laptop options, then document agreed security requirements for the build host.
Written by the indexing model from the issue text.
Description
Splitting from https://github.com/freedomofpress/securedrop/issues/6514
On a technical level, to build packages one needs a machine (currently a clean Qubes VM) that has Docker installed, and then:
- run
make securedrop-core-5.15, wait 2+ hours - run
make securedrop-workstation-5.15, wait 2+ hours - upload the build logs to the build-logs repo
- sign and upload the source tarballs to S3
- copy and upload the debs to apt-test, to kick off kernel testing
Currently these steps are done manually, on maintainer laptops. This seems ripe for automation, especially because it's a slow process.
One important note is that these builds are currently not reproducible (see #3).
So if we were to automate this process, what are the requirements for the build host? Would we be OK if:
- it was entirely run on a CircleCI pipeline (or other cloud CI provider, e.g. CodeFresh)?
- it was entirely run on a DO droplet we/infra controls?
- it was entirely run on a physical machine under FPF control (e.g. in NYO)?
- status quo, entirely run on a maintainer laptop
Pinging @l3th3 & @lsd-cat for security input
- Dominant language
- Python
- Stars
- 5
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from freedomofpress/kernel-builder
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
6.18 kernels don't include metapackage in buildinfoPossibly taken @legoktm claimed this 8 days ago. Open
freedomofpress/kernel-builder#90 · 1 assignee ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
-
Difficulty 5/5 Over a week Newbie friendliness 18/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in freedomofpress/kernel-builder
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
rpm-software-management/mock#1824 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
jpata/particleflow#520 ·
Maintainers usually reply within 1 day
-
bug good first issue hacktoberfest
Difficulty 1/5 Under an hour Newbie friendliness 78/100
gridhead/gi-loadouts#699 ·
Maintainers usually reply within 13 days
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
FinanceFlash/unvibecode#206 ·
Maintainers usually reply within 1 day