pjfanning commented on code in PR #3478: URL: https://github.com/apache/pekko/pull/3478#discussion_r3918637048
########## THREAT_MODEL.md: ########## @@ -0,0 +1,424 @@ +# Apache Pekko — Threat Model + +**Status:** Reviewed by the Apache Pekko PMC, 2026-08-27. The thirteen questions this document was drafted around are answered in §14 and carry *(maintainer)* provenance; the residual module in/out split noted in §2 and Q6 is the one open item. + +| | | +| --- | --- | +| **Project** | Apache Pekko (core toolkit) | +| **Written against** | commit `90b02d60`, `main` | +| **Date** | 2026-08-27 | +| **Authors** | ASF Security team, at the request of the Pekko PMC | +| **Version binding** | This model is versioned alongside the project. A report against Pekko version *N* is triaged against the model as it stood at *N*, not at `main`. | +| **Reporting** | Findings that violate a §8 property should be reported per [`SECURITY.md`](SECURITY.md). Findings that fall under §3 or §9 will be closed citing this document. | + +**Provenance legend.** Every non-trivial claim is tagged: +*(documented)* — stated in Pekko's own docs, cited. +*(maintainer)* — stated by a Pekko maintainer in review of this document. +*(inferred)* — reasoned from code or config defaults, **not yet confirmed**; each has a matching question in §14. + +**Provenance mix:** 43 documented / 48 maintainer / 3 inferred. The §5a default rulings — previously the largest inferred block — are now answered by the §5b posture statement and §14 Q1 to Q5. What remains inferred is the residual module in/out split (§14 Q6). + +## §1 Overview + +Apache Pekko is a Scala/Java toolkit for building concurrent, distributed and resilient message-driven applications. Its unit of computation is the actor: an object with private state that communicates only by asynchronous message passing. Pekko extends that model across machines — an `ActorSystem` can address actors on remote nodes as if they were local, and a cluster of such systems provides membership, sharding, singletons and replicated data. That transparency is the source of most of this document: **the network is not incidental to Pekko, it is part of the programming model**, and the security consequences follow from where the toolkit assumes that network sits. + +--- + +## §2 Scope and intended use + +Pekko is an **in-process library** that the application embeds and configures. It is not a server, not a daemon, and ships no runnable artifact that an operator deploys on its own. There is consequently no "Pekko instance" to secure independently of the application hosting it. + +Three caller roles matter, and they are not equally trusted: + +- **The embedding application** — fully trusted. It constructs the `ActorSystem`, supplies configuration, and already shares the JVM with Pekko. +- **The operator/deployer** — trusted for the instance. Chooses transport, TLS material, and the network the node sits on. Most of §10 lands here. +- **The remote peer** — another `ActorSystem` that has associated over remoting. Its trust level is the central question of this model, and §7 answers it. + +### Component families + +| Family | Modules | Entry point | Leaves the process? | In model | +| --- | --- | --- | --- | --- | +| Actor core | `actor`, `actor-typed`, `slf4j`, `coordination` | `ActorSystem`, `ActorRef` | no | **yes** | +| Classic IO | `actor` (`org.apache.pekko.io`) | `IO(Tcp)`, `IO(Udp)`, `IO(Dns)` | **network — if the application binds** | **yes** | +| Remoting | `remote` | Artery transport (`tcp` / `tls-tcp` / `aeron-udp`); classic remoting (netty), deprecated but supported *(maintainer — §14 Q13)* | **network** | **yes — primary surface** | +| Cluster | `cluster`, `cluster-typed`, `cluster-tools`, `cluster-sharding*`, `cluster-metrics` | gossip, membership, sharding | **network** (via remoting) | **yes** | +| Replicated data | `distributed-data` | CRDT replication | **network** (via remoting) | **yes** | +| Serialization | `serialization-jackson`, `serialization-jackson3` | `Serializer` SPI | deserializes network bytes | **yes — critical** | +| Wire encoding | `protobuf-v3` | shaded protobuf runtime | parses remoting and cluster wire bytes | **yes** | +| Streams | `stream`, `stream-typed` | `Source`/`Flow`/`Sink`; `Tcp`, `TLS`, `FileIO`, `Framing` | **network / filesystem — if the application uses those connectors** | **yes** | +| Persistence | `persistence`, `persistence-typed`, `persistence-query`, `persistence-shared` | journal / snapshot plugin SPI | **storage backend** | **yes**, boundary at the SPI | +| PKI | `pki` | PEM/keystore parsing | **reads files** | **yes** | +| Discovery | `discovery` | service-discovery SPI | **network / DNS** | **yes** | +| OSGi | `osgi` | bundle activator | classloading | **yes** *(maintainer — §14 Q6)* | +| Test kits | `*-testkit`, `multi-node-testkit`, `*-tests`, `persistence-tck`, `stream-tests-tck` | — | — | **no** — §3 | +| Benchmarks | `bench-jmh` | — | — | **no** — §3 | +| Build / docs | `docs`, `project`, `scripts`, `legal`, `kubernetes` (test-cluster provisioning scripts), `plugins`, `bill-of-materials`, `scala-nightly` | — | — | **no** — §3 | + +*(inferred — the in/out split is the ASF Security team's proposal, except `osgi`, which is confirmed in model; see §14 Q6)* + +--- + +## §3 Out of scope (explicit non-goals) Review Comment: If we have a supply chain attack and something malicious gets injected into our source release or published jars, I would regard that as a very serious CVE worthy episode. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
