villebro opened a new pull request, #280:
URL: https://github.com/apache/superset-kubernetes-operator/pull/280
## Summary
Closes four independent integrity gaps in the release/supply-chain pipeline.
All are in-scope per the operator's documented "supply chain issues in the
build and release pipeline" security policy.
## Details
- **Helm chart signed by a mutable tag (TOCTOU).** The chart signing step
reconstructed a tag reference from `Chart.yaml` after `helm push` had discarded
the digest, so cosign signed whatever the registry served at signing time — a
window in which a `packages:write` credential could swap the chart and receive
a valid keyless signature under the workflow's OIDC identity. The push step now
captures and validates the pushed digest (`^sha256:...`, hard-fail otherwise)
and the chart is signed by digest, mirroring the manager image step.
- **Signed release image consumed the GHA build cache.** `cache-from/to:
type=gha` fed the cosign-signed, SLSA-attested `build-push` step, so a poisoned
default-branch-scope BuildKit cache entry could be laundered into a signed
release. Cache is now gated on `github.ref_type != 'tag'` — tag-triggered
release builds rebuild every layer from source; dev builds keep the cache.
- **Documented `cosign verify` commands were unpinned/permissive.**
`security.md` used a bare verify with no identity; `downloads.md` used an
unanchored repo-wide identity regexp satisfied by any workflow/ref. Both now
pin `--certificate-oidc-issuer` and an anchored `release.yml@refs/tags/v*`
identity, with explicit text that `@refs/heads/main` dev builds share the
identity and must fail the check.
- **Finalize could promote a non-voted RC tarball.** `release-source.sh`
globbed `-rc*.tar.gz` and took `head -1` of unsorted `find` output, ignoring
the RC number derived from the tag on HEAD. It now selects the exact voted
`rc${RC}` tarball (validated integer) and errors on ambiguity instead of
picking one.
## Testing
- `release.yml` parses as valid YAML; `bash -n` and `shellcheck -S error`
clean on `release-source.sh`
- `golangci-lint` and `rumdl` (markdown) clean
- Workflow/script behavior is observable on the next dev push and release
tag (no test harness for workflow YAML in this repo)
---
Found via a Claude security scan. Part of a series of security follow-ups;
opened as a draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
