Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Reduce filecoin-project org ownership

Aperta
  • Qualcosa non va?
#47 7 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
20/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
github, typescript
Ambito
authorization, security

Direzione di ricerca

Inizia con le PR #60 e #61 di github-mgmt e con l’attività rimanente collegata all’issue #65; l’issue indica il team Stewards di github-mgmt e le impostazioni dell’organizzazione GitHub come punti di ingresso. Esamina le modifiche alle autorizzazioni esistenti e conferma che la proprietà, l’accesso in push, le assegnazioni dei ruoli e le motivazioni dei nomi utente soddisfino i criteri elencati.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Done Criteria

  1. Reduce org ownership to only a couple of people since "org owners" have the ability to impact the github org as a whole and every repo in the org (docs). This includes destructive one-way operations like repo deletion. These people should:
    1. be active in the filecoin-project org because they are more likely to make informed decisions and
    2. collectively represent multiple independent companies/teams.
  2. Review/reduce who has push access to github-mgmt in the org, as that is an escalation path to "org ownership" as well. This translates to looking at the "github-mgmt stewards" team, since that team has push access to github-mgmt. This group should be:
    1. still small (5-8)
    2. active in the org because they are more likely to make informed decisions
    3. representative of multiple independent companies/teams
  3. Give the "github-mgmt Stewards" team "moderator" and "security manager" roles.
  4. There should be comments above each username that has "org owner like" permissions providing a justification.

Why Important

This is the lowest-hanging fruit to protect the filecoin-project org around overly generous permissions. We're obviously not seeking to restrict access to code itself, and this isn't about checking some box for "good OpSec". Some reasons we care about the OpSec here include:

  1. We want to reduce the ability of malicious actors' ability to introduce vulnerabilities/bugs when they compromise a member's account.
  2. We want to reduce the possibility that someone's account could be compromised and then destructive actions are taken like deleting repos.

Communication Channels

This issue and the connected PRs are intended to be the main communication channels.

Background

The filecoin-project org has accumulated a lot of permissions over the years. This was somewhat acceptable/mitigated in the past by Protocol Labs Inc being a single company. As Protocol Labs Inc moves to an innovation network of companies (related blog) and projects like Filecoin having more and more independent teams, we're overdue on cleaning up permissions and reevaluating past assumptions.

Notes

  1. I don't think giving moderator and security operator roles to a team can be one through github-mgmt itself. For example, I don't see any useful docs when searching Terraform's docs. It would need to be a one-time action through the GitHub UI rather than through github-mgmt.
  2. For reference, a similar campaign was done in IPFS earlier in 2024 per https://github.com/ipfs/ipfs/issues/511
  3. I went through all permissions listed in github org role docs and then listed how I think they could/should be handled (see the collapsed table at the bottom of https://github.com/ipfs/ipfs/issues/511#issuecomment-1947577416).
## Tasks
- [x] Temporarily escalate @BigLep permissions so can view the [audit log](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization) and give the moderator and security manager permissions to the newly created teams in https://github.com/filecoin-project/github-mgmt/pull/60
- [x] PR for proposing/doing the corresponding permissions changes including the related communication: https://github.com/filecoin-project/github-mgmt/pull/61
- [x] Give the "moderators" team moderator permissions.
- [x] Give the "security-managers" team security manager permissions
- [ ] ~Revoke @BigLep's escalated permissions~ Per #61, he is keeping permissions through 2024-12-31.
- [ ] https://github.com/filecoin-project/github-mgmt/issues/65
Lingua principale
TypeScript
Stelle
2
Fork
24
Merge medio
4m
PR unite (30g)
1

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di filecoin-project/github-mgmt

Tutte le issue di filecoin-project/github-mgmt

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.