{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla-releng/scriptworker/issues/273","repository_url":"https://api.github.com/repos/mozilla-releng/scriptworker","labels_url":"https://api.github.com/repos/mozilla-releng/scriptworker/issues/273/labels{/name}","comments_url":"https://api.github.com/repos/mozilla-releng/scriptworker/issues/273/comments","events_url":"https://api.github.com/repos/mozilla-releng/scriptworker/issues/273/events","html_url":"https://github.com/mozilla-releng/scriptworker/issues/273","id":382742922,"node_id":"MDU6SXNzdWUzODI3NDI5MjI=","number":273,"title":"Chain of Trust: Restrict git/hg branches ","user":{"login":"JohanLorenzo","id":5907366,"node_id":"MDQ6VXNlcjU5MDczNjY=","avatar_url":"https://avatars2.githubusercontent.com/u/5907366?v=4","gravatar_id":"","url":"https://api.github.com/users/JohanLorenzo","html_url":"https://github.com/JohanLorenzo","followers_url":"https://api.github.com/users/JohanLorenzo/followers","following_url":"https://api.github.com/users/JohanLorenzo/following{/other_user}","gists_url":"https://api.github.com/users/JohanLorenzo/gists{/gist_id}","starred_url":"https://api.github.com/users/JohanLorenzo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JohanLorenzo/subscriptions","organizations_url":"https://api.github.com/users/JohanLorenzo/orgs","repos_url":"https://api.github.com/users/JohanLorenzo/repos","events_url":"https://api.github.com/users/JohanLorenzo/events{/privacy}","received_events_url":"https://api.github.com/users/JohanLorenzo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-11-20T16:23:56Z","updated_at":"2018-11-21T16:10:30Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Today, @rpappalax came to me with an interesting case: he has some big changes to make on the [focus-android](https://github.com/mozilla-mobile/focus-android/) taskgraph and he's willing to use a github branch (living the focus-android repo). This branch needs some taskcluster scopes.\r\nHe asked @imbstack to expand the following role: https://tools.taskcluster.net/auth/roles/repo%3Agithub.com%2Fmozilla-mobile%2Ffocus-android%3Abranch%3A*. Without too much context, all the scopes needed to sign and publish a Focus build ended up in the role (I actually wonder if these scopes were on the master role). \r\n\r\n## Immediate fix\r\n\r\nI updated to role to strip all the signing/publishing scopes out. As of now, no one can publish Focus from a random branch on the main repo.\r\n\r\n## What scriptworker can do\r\n\r\nIn hg.mozilla.org, this is safeguarded by [cot_restricted_scopes](https://github.com/mozilla-releng/scriptworker/blob/ae4cc4de36bd59a235c7a48e17d15c827caa3024/scriptworker/constants.py#L217-L269). Sadly, scriptworker doesn't allow to restrict branches within an existing repo. This case has never popped up on hg.mozilla.org, but we now have a case on github.\r\n\r\nTo me, scriptworker can enforce that. scriptworker knows what's the commit under checks. We can let it know what's the branch it's on. scriptworker will then verify against:\r\n* github.com by fetching and parsing https://github.com/:user/:repo/branch_commits/:commit (for instance: https://github.com/mozilla-mobile/focus-android/branch_commits/1d0f51cd43f45a25b34191a5276d3f5d98023899). I [couldn't find](https://stackoverflow.com/questions/29992441/github-api-identify-the-branches-that-contain-a-given-commit) an API endpoint that exposes this piece of data.\r\n* hg.mozilla.org withhttps://hg.mozilla.org/releases/mozilla-release/json-pushes?full=1&changeset=tip \r\n\r\nThis way scriptworker knows the branch against which the graph was triggered, and it knows the branch isn't a lie. Therefore, scriptworker can restrict by git/hg branches.\r\n\r\n@escapewindow @tomprince, how does this look to you? "},"comment":{"url":"https://api.github.com/repos/mozilla-releng/scriptworker/issues/comments/440721821","html_url":"https://github.com/mozilla-releng/scriptworker/issues/273#issuecomment-440721821","issue_url":"https://api.github.com/repos/mozilla-releng/scriptworker/issues/273","id":440721821,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MDcyMTgyMQ==","user":{"login":"djmitche","id":28673,"node_id":"MDQ6VXNlcjI4Njcz","avatar_url":"https://avatars3.githubusercontent.com/u/28673?v=4","gravatar_id":"","url":"https://api.github.com/users/djmitche","html_url":"https://github.com/djmitche","followers_url":"https://api.github.com/users/djmitche/followers","following_url":"https://api.github.com/users/djmitche/following{/other_user}","gists_url":"https://api.github.com/users/djmitche/gists{/gist_id}","starred_url":"https://api.github.com/users/djmitche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djmitche/subscriptions","organizations_url":"https://api.github.com/users/djmitche/orgs","repos_url":"https://api.github.com/users/djmitche/repos","events_url":"https://api.github.com/users/djmitche/events{/privacy}","received_events_url":"https://api.github.com/users/djmitche/received_events","type":"User","site_admin":false},"created_at":"2018-11-21T16:10:30Z","updated_at":"2018-11-21T16:10:30Z","author_association":"CONTRIBUTOR","body":"The hypothetical scenario was that Mallory got access to the Github repo *and* got access to edit the roles for that repo.  Having compromised two systems, it's not unlikely they've compromised a third. The most likely situations where this would occur are a rogue employee or compromise of an employee's credentials.\r\n\r\nI don't have a dog in this race -- it's no problem to me if scriptworker grows this feature.  I'm just thinking of balancing risk against the effectiveness of the proposed solution and against the difficulty of implementing it and maintaining it.  If it didn't involve scraping HTML that balance would shift a little :)"}}
{"actor":{"display_login":"djmitche"}}