Repository navigation
[pull] trunk from cli:trunk - #260
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
validateSignerWorkflow built a pattern anchored only at the start, and sigstore-go applies SAN patterns with regexp.MatchString, which is unanchored. The pin was therefore a prefix match: a workflow named release.yml.attacker.yml satisfied a pin on release.yml. Append (@[^@]*)?$ to both return paths so the pinned value must run to the end of the SAN, optionally followed by a single @<ref>. The ref is matched without an "@" so that an "@" in a workflow file name cannot be presented as the separator. Refs appear as both git refs and commit SHAs, so the suffix cannot assume a refs/ prefix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The first cut of this fix ended the pattern with (@[^@]*)?$, which treats the last "@" as the separator between workflow path and ref. That rejects legitimate signers: "@" is valid in a git ref, and refs/tags/pkg@1.2.3 is the tag convention used by JavaScript monorepos, whose release workflows are exactly what --signer-workflow is meant to pin. Allowing any ref instead, with (@.*)?$, is not an option. Actions loads a workflow file whose name contains "@", the OIDC job_workflow_ref claim carries the name verbatim, and Fulcio leaves "@" unescaped because it is a legal path character, so a file named release.yml@evil.yml yields a SAN that a permissive pattern accepts for a pin on release.yml. Match the ref by shape instead: either a "refs/"-prefixed path or a bare object ID. A workflow file name can be neither, because Actions only loads workflows stored directly in .github/workflows so the name cannot contain "/", and the name must carry a .yml or .yaml extension so it cannot be a bare object ID. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Trunk changed the same lines in internal/zip and run download: - Use errors.AsType in ExtractZip, following the Go 1.27.1 bump - Pass the repository host to downloadArtifact and send the request through api.Client, keeping the openDestination callback - Set repo on apiPlatform in Test_Download so RepoHost resolves Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The optional "@<ref>" suffix is right for the documented flag format, which carries no ref and has to keep matching a certificate from any ref. Applied to a value that pins a ref, though, it allows a second ref to follow the pinned one. A git ref may be named "main@refs/heads/attacker": git accepts it, GitHub accepts the push, and Actions runs a workflow from it, issuing a certificate whose job_workflow_ref ends "@refs/heads/main@refs/ heads/attacker". A pin on refs/heads/main matched that, so the pin no longer constrained which ref the workflow ran from, and a branch protection rule on main does not cover the attacker's branch name. Append the optional suffix only when the value does not already end in a ref. When it does, anchor the pattern at the end of the SAN. This is narrower than the prefix match it replaces rather than a regression against it: a bare prefix match already admitted both this SAN and "@refs/heads/mainattacker", which stays rejected either way. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The trunk merge brought in a test that calls downloadAsset directly. destinationWriter now keeps its destination directory open until Close, so on Windows the test could not remove its temporary directory and failed during cleanup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Make SourceRepositoryRef check case-sensitive
Make --signer-workflow an identity match instead of a prefix match
Prevent flag injection in installs from skill search
Harden filesystem writes against symlinks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )