villebro opened a new pull request, #328:
URL: https://github.com/apache/superset-kubernetes-operator/pull/328

   ## Summary
   
   A Claude security scan found the edges where the project's otherwise strong 
pin-everything, fail-closed posture still had exceptions or laundering paths. 
This tightens the release pipeline and the tool-pinning automation.
   
   ## Details
   
   - **Release tag injection.** The "Set chart version" step spliced the 
unvalidated tag name into a `sed` program; GNU sed's `s///e` flag executes the 
pattern space, so a crafted `v`-tag could run shell in a job holding `packages: 
write` + `id-token: write` and cosign-sign the result. The release job now 
validates `GITHUB_REF_NAME` against `^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$` as 
its first step, before the ref reaches any interpreter (mirrors 
`scripts/release-rc.sh`).
   - **Unprotected `v*` tags.** `.asf.yaml` protected only `main` while the 
release workflow triggers on `v*` tags. Added `protected_tags: ["v*"]` so tag 
creation is restricted to release managers. *(Requires ASF Infra to apply — see 
release notes.)*
   - **Checksum-pin laundering.** `sync-tool-checksums.sh` now fails loudly 
(exit 3, no auto-PR) when a checksum changes for an **unchanged** version 
string — the signature of an upstream asset swap — requiring an explicit 
`--allow-same-version-hash-change` flag after out-of-band verification; the 
auto-PR body is corrected accordingly. `sync-helm-checksum.sh`'s mismatch 
guidance is branched: regenerate only on a deliberate version bump, otherwise 
verify out-of-band against Helm's GPG-signed checksums.
   - **Mutable envtest ref.** `ENVTEST_VERSION` derived a `release-X.Y` branch 
ref — the sole mutable fetch in an otherwise version+SHA-pinned toolchain. It 
now pins the exact tagged controller-runtime version from `go.mod`, bumped via 
Renovate.
   - **Devcontainer tools.** `post-install.sh` fetched kind/kubebuilder/kubectl 
from mutable `latest`/`stable.txt` with no pin or checksum. It now runs `set 
-euo pipefail`, pins kind via `supported-k8s.json` (as CI does), pins kubectl 
and verifies its published SHA-256, and pins kubebuilder to an immutable 
release-tag URL (strict verification when `KUBEBUILDER_SHA256` is set; 
warn-only otherwise, since upstream ships no checksum artifact).
   
   ## Release notes / follow-ups
   
   - `v*` tags can no longer be pushed by a lone committer once ASF Infra 
applies `protected_tags`; verify with a non-admin `git push origin v0.0.0-test` 
(should be rejected) and document in the release runbook.
   - The daily checksum resync fails red on a same-version hash change; verify 
out-of-band and rerun with `make sync-tool-checksums 
ARGS=--allow-same-version-hash-change`.
   - Generate and commit `KUBEBUILDER_SHA256` from a trusted network so the 
devcontainer kubebuilder install is strictly verified (upstream publishes no 
checksum artifact).
   
   Found via a Claude security scan.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to