Clojurians Log v2

What is a GHA

GitHub Action.

https://github.com/clojure/build.ci/blob/master/.github/workflows/test.yml#L14 uses @v6 so it isn't fixed. A malicious actor with control of a GHA project could push code to a new v6.x.y tag and the Clojure CI would execute it.

Nearly all projects I've looked at are like this—or even use @master—but I'm wondering whether folks think switching to SHAs instead is worthwhile?

If a malicious actor has control of it and I pin to their sha, aren't I equally as screwed?

If you pin to a known, good SHA you're safe and wouldn't automatically pick up a new (bad) version.

I know you're working with folks on security around Clojure stuff so I figured I'd get your take (and theirs, hopefully). Phil, Jeaye, Ambrose, yes?

How do I know it’s good if a malicious actor controls it? My point is, if there is a malicious controller, then that is the real problem

A malicious controller cannot changed a previous, known good SHA tho', right? That's what the point of this Plumber project is. There have been instances of good projects getting hijacked and a malicious new version released. I don't really know enough to have an opinion, hence my posting it here.

How do I know any sha is good?

I'm mostly using GitHub actions. I already trust them to actually run the CI itself. You gotta trust something eventually right?

This seems similar to discussions about using SHA + tag rather than just tag for dependencies, and avoiding version ranges and RELEASE and LATEST. I'm just the messenger here, looking for input from folks who know more about security 🙂

I understand the theoretical issue, it's just down the list of my concerns at the moment

Here's a CVE that Plumber links to, with a widely-used GHA getting hijacked and the malicious code being run in various projects to lift secrets etc: https://github.com/advisories/GHSA-mrrh-fwg8-r2c3

I've not had enough coffee yet. What access does the attacker need to be successful?

Per the CVE, the ability to push malicious code and move a tag—I think... I'm not the security guy here 🙂

Ah, the PR to honeysql makes it clearer to me https://github.com/seancorfield/honeysql/pull/605, I think. So, someone compromises a Github Action I am using. And moves the action version tag I am referencing to something malicious?

That seems to be what Plumber's README is talking about, yes.

Got it, thanks.