Repository navigation
Release 0.4.2 - #164
Merged
Merged
Release 0.4.2#164
Conversation
Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
- A count printed on standard error uses the singular for one item: "1 vendor across 2 client tenants", "1 vendor." after --all, and "Skipping 1 inactive client tenant". The nouns are the plurals the commands already pass, so the singular drops the final "s". - The API's message is quoted without its closing punctuation where the CLI ends the sentence itself (a rejected request, an unexpected answer), so "Bad value." no longer becomes "Bad value..". The not-found message, which is the server's sentence as it is, is unchanged. Closes #135 Closes #136 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Count one item in the singular, and end API messages with one full stop Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
docs/user-information.md now ships as USER-INFORMATION.md: - next to the binary in every release archive (Linux, macOS and both Windows zips); - in /usr/share/doc/hodeishield/ from the .deb and .rpm; - in the install folder from the MSI; - in Homebrew's documentation folder from the formula. The release's hand-off checks now require it: the macOS and Windows archive listings, the MSI's file count and payload, and the packages job, which copies it out of each Linux archive. The repository tests stage it for nfpm. The container image still carries only the binary and the licence files, and the README says where its user information is. Closes #133 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Ship the user information document with every release package Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
…ekly Three workflows, every action pinned by commit and every tool by version and SHA-256, with results in the repository's code scanning view: - security-tests.yml: CodeQL for the Rust code and the GitHub Actions workflows (security-extended queries), and OSV-Scanner over the dependencies, on pull requests, pushes to dev and main, and weekly; - workflow-lint.yml: actionlint and zizmor over .github, when it changes and weekly. Both report without failing the run until the findings in the release workflow are dealt with (#149); - scorecard.yml: OpenSSF Scorecard on main, weekly and on pushes, in its own file as its publishing rules require. .github/zizmor.yml accepts the SLSA generator's tag reference, which the generator requires. CONTRIBUTING gains a "Security testing" section with what runs, when, where the results are, and how findings are handled, and gives the dependency review a frequency. Refs #124 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
docs/release-signing.md describes each signature a release carries: - Authenticode through a managed signing service, reached by OIDC from the release-signing environment; - the Sigstore identities of the release and container image workflows; - the SLSA provenance. It says who may change each one, and gives the steps for a compromised Windows certificate profile and for a compromised release workflow: stop, revoke or disable, find what is affected, publish a notice, and release again under a new signature that users can check. docs/verifying-releases.md explains how to check the Authenticode certificate profile and how to recognise a release published after a signing change. SECURITY.md now says precisely which signatures have no long-lived key, links the new document, and points to the published security.txt. Refs #126 Refs #125 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
The release tags ruleset now lets only the organisation's release team create, move or delete v* tags. The signing document and CONTRIBUTING say so. Refs #126 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Run security tests of the code, the dependencies and the workflows weekly Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Document the signing identities and what to do if one is compromised Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
In the release workflow, pass the matrix target through env: instead of expanding it inside run: scripts, end the checksum command's options before the file glob, run one release at a time per ref without cancelling a running one, and give the provenance job's actions: read permission its reason. Scorecard's concurrency finding is accepted in .github/zizmor.yml with a reason. zizmor now runs at its pedantic level, and both actionlint and zizmor fail the job on any finding. Refs #149 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Fix the workflow lint findings and fail the lint job on new ones Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Refs #149 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
docs/risk-assessment.md lists the assets, the threats and the controls, maps each point of Annex I, Parts I and II of the Cyber Resilience Act to the control that meets it or the reason it does not apply, and records the decisions on automatic updates, security logging, attack surface and data minimisation, with a review schedule. SECURITY.md and the user information link to it. Refs #122, #123 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
docs/release-signing.md now names the OIDC subject that the federated credential trusts, as the release runs log it. It says that the app registration is shared with another project's release signing and has no app owners, so only the directory administrator roles can change its credentials, and that one account holds the Owner role on the subscription. The single Owner, the missing written recovery route and the shared app registration are listed as known gaps with their actions. The compromise steps now change only this repository's federated credential. Closes #126 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
When the keychain entry of a profile cannot be decoded, logout now deletes it and says that nothing was revoked at the app, instead of failing with the same error whose hint pointed to logout. Any other keychain error still fails logout as before. The in-memory test store decodes entries the same way as the keychain. Refs #154 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Add the cybersecurity risk assessment Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Record who controls the Azure signing access, and its known gaps Closes #126 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Let logout remove a sign-in it cannot read Closes #154 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
A new weekly workflow, release-integrity.yml, compares the runs of release.yml and container-image.yml with the published releases in both directions, checks every release file against SHA256SUMS, looks up every signed file in Rekor by its SHA-256 and checks that its certificate names release.yml at the release's tag, commit and run, and verifies each container image signature with cosign. A mismatch, or anything it cannot read, fails the run and opens or updates an issue labelled release-integrity; a pass closes it. docs/release-signing.md describes the check, what it cannot see and what to do when it alerts, and puts the Sigstore and SLSA item back in the list of who may change the signing identities. CONTRIBUTING and the risk assessment list the check. Refs #152 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Rekor accepts any certificate in a hashedrekord entry, so an entry with a certificate that claims the release identity could make a file look signed, or raise a false mismatch. The integrity check now counts an entry only if Rekor's signed entry timestamp verifies with Rekor's key and its certificate chains to Sigstore's certificate authority at the time it was logged, both from the trust root that cosign initialize fetches through TUF. Tests use a public fixture of that trust root and of the v0.4.1 entry. Refs #152 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
CONTRIBUTING.md suggested pointing core.hooksPath at the tracked .githooks directory, so git would run the hooks of whatever branch is checked out. It now says to copy the hook into the clone's hooks directory from a branch you trust, and to unset core.hooksPath if it was set. CI keeps running the same check on every pull request. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Install the commit-message hook as a copy Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Check weekly that release runs, files, Rekor entries and images match Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Version 0.4.2, the dated changelog section, the version in the examples of the README and docs/verifying-releases.md, and "from 0.4.2" where the docs say which release first ships USER-INFORMATION.md. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Prepare 0.4.2: version and changelog Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.4.2: merges
devintomain. The full notes are the## [0.4.2]section ofCHANGELOG.md, which also becomes the release notes.Fixes
logoutremoves a sign-in that the keychain returns in a form the CLI cannot read, and says that nothing was revoked at the app. (logout cannot remove a sign-in that the keychain returns in an unreadable form #154, Let logout remove a sign-in it cannot read #157)Added
.deb,.rpmand the MSI include the user information asUSER-INFORMATION.md. The release workflow fails if one lacks it. (release archives and packages do not include the user information document #133, Ship the user information document with every release package #148)docs/risk-assessment.md: the cybersecurity risk assessment, covering assets, threats and controls, the mapping of the Cyber Resilience Act's Annex I, and the decisions on updates, logging, attack surface and data minimisation. (no cybersecurity risk assessment mapped to the essential requirements #122, update notification is not in a released version and the update approach is not documented #123, Add the cybersecurity risk assessment #155)Documentation
docs/release-signing.md:core.hooksPathat the working tree. (Install the commit-message hook as a copy #160)Release and infrastructure
No change to the scripting surface. macOS binaries remain unsigned in this release, as in 0.4.1.