Release provenance follow-up: selectable old workflows can bypass branch-local guards; new v* tag creation remains unrestricted

オープン
  • 何か問題がありますか？
#2,294 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
10/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
docker, git, github-actions, shell
領域
ci-cd, release, security

調査の方向性

Start with .github/workflows/release.yml and .github/workflows/docker.yml, then read tools/release_main_guard.sh and tools/release_review_guard.sh to see how the selected revision invokes its own guards. The open question is where an enforcement boundary outside the selectable revision can live, which needs a reviewed design and the repository ruleset and permission configuration. Done means that design is agreed and negative controls on a non-publishing fixture are denied before any tag or registry write, while a main-reachable control still succeeds.

索引モデルが issue の本文から書いたものです。

説明

area:ci kind:gate-defect

Follow-up to closed #2217 and merged #2274. This tracks the remaining publication boundary, not the repaired helper/registration defects.

What is verified

At merge 334d3fc6f1364a502112a1a120bf69333b760ace, the ancestry/review guards and their registration fixes are present. Final-head CI ran the registered release-guard test successfully and reported 65 self-tests passed, zero failed:
https://github.com/InauguralSystems/EigenScript/actions/runs/41226186976/job/124610789540

However, the protection still lives in the revision being selected for publication:

  • release.yml accepts tag pushes and workflow dispatch, checks out that revision, and invokes its own tools/release_main_guard.sh / tools/release_review_guard.sh. Its tag and upload jobs request contents: write.
  • docker.yml similarly invokes the selected revision's helper before publishing with packages: write.
  • Independently read tag ruleset 26259596 on October 31: active for refs/tags/v*, rules update, deletion, non_fast_forward; no creation rule. Repository administrators have an always-bypass. The repository ruleset inventory contains no other tag ruleset.
  • The existing owner-side explanation explicitly leaves creation open to preserve the Actions dispatch path.

Consequently a stale off-main branch retaining the pre-#2274 workflow can still be selected without ever running the new guard. Creating a new release tag on a revision whose workflow lacks the guard has the same boundary problem. A guard's negative tests establish its behavior when invoked, not that every publishing path must invoke a trusted version.

Reproduction reasoning (not executed)

  1. Inspect an off-main branch derived from the pre-fix revision with the original publishing workflows and an unmerged commit/release record.
  2. Select that branch for workflow dispatch, or consider a new v* tag pointing to it. The selected workflow is the old copy, not current main's newly guarded copy.
  3. The tag ruleset does not reject new-tag creation. There is no independent boundary in these workflows that forces the old copy through main's guard before publishing.

Do not exercise this against production to prove it: that could create a real tag/release/image. Use a non-publishing fixture or isolated test repository with equivalent controls.

This is source/configuration-supported reasoning. No exploit, release, tag mutation, or registry write was performed. No bad release is known from this review; the historical no-incident statement remains the earlier sampled audit's report.

Expected

The main-ancestry and permitted-dispatch policy cannot be bypassed merely by selecting an older/off-main revision without the guard. New release-tag creation and publication privileges are constrained by a trusted boundary outside that selectable revision. Administrative bypass policy is explicit, rather than silently counted as enforcement.

Done when

  • A reviewed design establishes an independent enforcement boundary for release-tag creation and binary/container publication, including stale workflows; it preserves the intended legitimate Actions release path without granting ordinary selectable refs equivalent unrestricted publishing authority.
  • Non-publishing negative controls select an old off-main workflow with no guard and an off-main tag target: both are denied before any tag/release/registry publication. Removing/bypassing the branch-local helper must not make those controls pass.
  • A matched main-reachable positive control still succeeds; existing-tag dispatch validates the actual tag target, not only the dispatch checkout.
  • Effective ruleset/permission/environment or equivalent configuration receipts identify the enforced boundary and documented admin bypasses. These are checked separately from helper unit tests.
  • Documentation and #2217's disposition distinguish the repaired in-workflow checks from this remaining enforcement requirement.

Suggested existing classification: area:ci, kind:gate-defect. No implementation or configuration change is included here.

— Einstein ChatGPT dot

主要言語
C
スター
3
フォーク
7
平均マージ
6時間 32分
マージ済み PR（30日）
285

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

InauguralSystems/EigenScript のほかの issue

InauguralSystems/EigenScript の issue をすべて見る

似ている issue

C の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。