From 1634dddd44b423fc52ba82080b114f0efaa8e12f Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 23 Oct 2026 14:54:15 +0200 Subject: [PATCH] fix(security): restore verified organization settings publication --- .../apps/github-config/oci-repository.yaml | 2 +- .../publish-workflow-canonical-approvals.tsv | 2 +- ...st-publish-workflow-canonical-approvals.sh | 43 +++++++++++++++++++ .../approved-surface.txt | 2 +- 4 files changed, 46 insertions(+), 3 deletions(-) diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml index 888aba8b4e..f3d1355104 100644 --- a/k8s/bases/apps/github-config/oci-repository.yaml +++ b/k8s/bases/apps/github-config/oci-repository.yaml @@ -29,4 +29,4 @@ spec: # signer and this consumer's current publish-workflow pin in one identity. # Regeneration updates the pair and the approved set in the same PR. - issuer: '^https://token\.actions\.githubusercontent\.com$' - subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(8d2203af130a8c27b8b98b3d7146f76b5ade7a98|0f390329b590404c02565b27a263ee841fa02bce))$' + subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(0f390329b590404c02565b27a263ee841fa02bce|6f1dee9557a939cc24ca2c562ea775d05e01564d))$' diff --git a/scripts/publish-workflow-canonical-approvals.tsv b/scripts/publish-workflow-canonical-approvals.tsv index 6ccedcd97b..70193f165e 100644 --- a/scripts/publish-workflow-canonical-approvals.tsv +++ b/scripts/publish-workflow-canonical-approvals.tsv @@ -1,7 +1,7 @@ consumer workflow repository commit aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42 -.github publish-manifests devantler-tech/.github 8d2203af130a8c27b8b98b3d7146f76b5ade7a98 .github publish-manifests devantler-tech/.github 0f390329b590404c02565b27a263ee841fa02bce +.github publish-manifests devantler-tech/.github 6f1dee9557a939cc24ca2c562ea775d05e01564d ascoachingogvaner publish-app devantler-tech/.github 0c7b6c3509b73adbc7537e030935bb01987e625b ascoachingogvaner publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0 data-product-controller publish-app devantler-tech/.github 0c7b6c3509b73adbc7537e030935bb01987e625b diff --git a/scripts/tests/test-publish-workflow-canonical-approvals.sh b/scripts/tests/test-publish-workflow-canonical-approvals.sh index dd1bfe6499..9b0a08bcee 100755 --- a/scripts/tests/test-publish-workflow-canonical-approvals.sh +++ b/scripts/tests/test-publish-workflow-canonical-approvals.sh @@ -604,5 +604,48 @@ node-pull talos/cluster/verify-first-party-images.yaml .rules[] | select(.image generic-tenant k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml .spec.resources[] | select(.id == "ociRepository").template.spec.verify.matchOIDCIdentity[0].subject PROFILES +# The github-config v12 transition retains the independently verified v12.0.2 +# signer while admitting the new exact publisher. Retired and unrelated +# identities must fail both the committed subject and issuer predicates (#5265). +github_source="$REPO_ROOT/k8s/bases/apps/github-config/oci-repository.yaml" +github_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$github_source")" +github_issuer="$(yq -er '.spec.verify.matchOIDCIdentity[0].issuer' "$github_source")" +while IFS=$'\t' read -r expected issuer identity; do + result=reject + if printf '%s\n' "$issuer" | grep -Eq -- "$github_issuer" && + printf '%s\n' "$identity" | grep -Eq -- "$github_subject"; then + result=accept + fi + if [ "$result" = "$expected" ]; then + pass "github-config transition: $expected $issuer $identity" + else + fail "github-config transition: expected $expected for $issuer $identity, got $result" + fi +done <<'IDENTITIES' +accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0f390329b590404c02565b27a263ee841fa02bce +accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@8d2203af130a8c27b8b98b3d7146f76b5ade7a98 +accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@1d726483facb9340655489913f609082677be8f5 +accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 +reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d +reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d +reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@v12.0.1 +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@main +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9 +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d-extra +IDENTITIES + +aws_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$REPO_ROOT/k8s/providers/hetzner/apps/aws/oci-repository.yaml")" +if printf '%s\n' 'https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d' | + grep -Eq -- "$aws_subject"; then + fail 'github-config approval must not authorize the same new publisher for aws' +else + pass 'github-config approval leaves the unrelated aws consumer closed to the new publisher' +fi + printf '\n%d failure(s)\n' "$failures" [ "$failures" -eq 0 ] diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 1b4e915c12..6ae582cc87 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -422,7 +422,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771 -source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 16447462c20c2f5a38287845572807803de61105fc84a6b6ca868e36d4e3bf39 +source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config b5ab7e893cffdb3eaa01de448e1daa4ec95e6d9e9a72d4f47ab8439ad7e558e6 source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38