Comments (9)
In addition to hardcoding a shared-key for official-committers, add a run-time flag so that people who fork the ami can sign their own commits or disable commit-signing.
@elad You've expressed interest in hacking the community part of this feature (I'll add in the new committer key after I merge your changes), and it's one that should go in prior to the next rebake. I'm excited to merge it if you have time to put the code-changes together. Also for the record, I will merge either an option to disable commit-signing (which I think will be sufficient for 99% of AMI users) or an option to specify a custom commit-signing key.
If you want to have any design discussions we can do so here, but feel free to just start hacking as I'm sure you'll come up with something nice.
from comboami.
Working on it. :) Submitted #75 with the option to disable commit signature verification. I'll work on the other part (allowed keys) tomorrow morning.
from comboami.
After much discussion in #75, I've decided to remove commit-signing entirely. It was implemented in response to #33 but has the following issues that mean it does more harm than good:
- From the time it was implemented until today, it was trivially bypassable (using a crafted commit-message) and so completely ineffective.
- The signature-bypass bug occurred because Python (and it's library ecosystem) offers no native facilities to perform sig-checks on git-repos, so we're forced to parsed the command-line output of git. This is a recipe for bugs of this kind, and we're not in a position to invest in something more robust. When it comes to security features, not doing them at all is better than doing them badly.
- Most of the benefit of commit-signing is provided by specifying a commit-hash to --repository or --forcecommit. Git commit hashes are already strong checksums, they are already delivered over https from github, the only piece missing is a signing key separate from the repository... which is admittedly helpful but not a guarantee that malicious code can't be shipped.
- The overhead of maintaining this poor quality commit-signing setup is out of alignment with the rest of the security infrastructure surrounding ComboAMI. ComboAMI stands up clusters with authentication disabled!!!
While we should always strive to improve the security of ComboAMI, over-investing in features that don't work or provide little benefit has the opposite effect. It's time for commit-signing to go.
from comboami.
@mlococo this should probably be closed as well no?
from comboami.
Yeah, my attention has been focused elsewhere this week. Closing.
Thanks again for your help on these features. Your PR's will always be welcome here.
from comboami.
No problem, and you're welcome! Thank you and @joaquincasares for being so helpful. :)
from comboami.
Sure thing! :)
from comboami.
Re-opening this. We can't actually ship it until the rebake because ds0_updater.py doesn't restart itself after pulling the new code, so ds0_updater.py can't only be updated during a rebake.
The result is that unrebaked AMI's are still giving commit-signing errors.
from comboami.
Tested and working in dev-2.6
from comboami.
Related Issues (20)
- Java 8 HOT 2
- Exception seen in ds1_launcher.py HOT 2
- base64postscript fails when there are multiple commands HOT 2
- Installation Issue AWS EC2 dsc22 : Depends: cassandra (= 2.2.3) but 3.0.0 is to be installed HOT 10
- Please fix Cassandra version in http://debian.datastax.com/community HOT 1
- No cassandra/cassandra.yaml file or directory HOT 2
- Missing Enhanced Networking drivers on Ubuntu 14.04 HVM HOT 1
- Raid0 for DSE HOT 2
- Wrong device name md_d0 should be md0? HOT 1
- Unable to start a cluster using DataStax Auto-Clustering AMI 2.6-1404-hvm - ami-35ac725e HOT 5
- apt-get install fails due to unauthorized packages HOT 7
- Image failing to bootstrap HOT 3
- ComboAMI Updates Broken for named branches HOT 2
- skip reflector HOT 1
- Add custom script to execute at installation end HOT 7
- Uneven Token Distribution HOT 10
- Document additional switches HOT 3
- Bootstrap fails in AWS - Other bootstrapping/leaving/moving nodes detected HOT 1
- dsc22 : Depends: cassandra (= 2.2.3) but 3.0.0 is to be installed HOT 6
- Add support for DSC 3.0 HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from comboami.