villebro opened a new pull request, #328: URL: https://github.com/apache/superset-kubernetes-operator/pull/328
## Summary A Claude security scan found the edges where the project's otherwise strong pin-everything, fail-closed posture still had exceptions or laundering paths. This tightens the release pipeline and the tool-pinning automation. ## Details - **Release tag injection.** The "Set chart version" step spliced the unvalidated tag name into a `sed` program; GNU sed's `s///e` flag executes the pattern space, so a crafted `v`-tag could run shell in a job holding `packages: write` + `id-token: write` and cosign-sign the result. The release job now validates `GITHUB_REF_NAME` against `^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$` as its first step, before the ref reaches any interpreter (mirrors `scripts/release-rc.sh`). - **Unprotected `v*` tags.** `.asf.yaml` protected only `main` while the release workflow triggers on `v*` tags. Added `protected_tags: ["v*"]` so tag creation is restricted to release managers. *(Requires ASF Infra to apply — see release notes.)* - **Checksum-pin laundering.** `sync-tool-checksums.sh` now fails loudly (exit 3, no auto-PR) when a checksum changes for an **unchanged** version string — the signature of an upstream asset swap — requiring an explicit `--allow-same-version-hash-change` flag after out-of-band verification; the auto-PR body is corrected accordingly. `sync-helm-checksum.sh`'s mismatch guidance is branched: regenerate only on a deliberate version bump, otherwise verify out-of-band against Helm's GPG-signed checksums. - **Mutable envtest ref.** `ENVTEST_VERSION` derived a `release-X.Y` branch ref — the sole mutable fetch in an otherwise version+SHA-pinned toolchain. It now pins the exact tagged controller-runtime version from `go.mod`, bumped via Renovate. - **Devcontainer tools.** `post-install.sh` fetched kind/kubebuilder/kubectl from mutable `latest`/`stable.txt` with no pin or checksum. It now runs `set -euo pipefail`, pins kind via `supported-k8s.json` (as CI does), pins kubectl and verifies its published SHA-256, and pins kubebuilder to an immutable release-tag URL (strict verification when `KUBEBUILDER_SHA256` is set; warn-only otherwise, since upstream ships no checksum artifact). ## Release notes / follow-ups - `v*` tags can no longer be pushed by a lone committer once ASF Infra applies `protected_tags`; verify with a non-admin `git push origin v0.0.0-test` (should be rejected) and document in the release runbook. - The daily checksum resync fails red on a same-version hash change; verify out-of-band and rerun with `make sync-tool-checksums ARGS=--allow-same-version-hash-change`. - Generate and commit `KUBEBUILDER_SHA256` from a trusted network so the devcontainer kubebuilder install is strictly verified (upstream publishes no checksum artifact). Found via a Claude security scan. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
