Skip to content

fix(security): restore verified organization settings publication #5266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 1 commit into from
Oct 23, 2026
+46 −3
Merged

fix(security): restore verified organization settings publication #5266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion k8s/bases/apps/github-config/oci-repository.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,4 @@ spec:
# signer and this consumer's current publish-workflow pin in one identity.
# Regeneration updates the pair and the approved set in the same PR.
- issuer: '^https://token\.actions\.githubusercontent\.com$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(8d2203af130a8c27b8b98b3d7146f76b5ade7a98|0f390329b590404c02565b27a263ee841fa02bce))$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(0f390329b590404c02565b27a263ee841fa02bce|6f1dee9557a939cc24ca2c562ea775d05e01564d))$'
2 changes: 1 addition & 1 deletion scripts/publish-workflow-canonical-approvals.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
consumer workflow repository commit
aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42
.github publish-manifests devantler-tech/.github 8d2203af130a8c27b8b98b3d7146f76b5ade7a98
.github publish-manifests devantler-tech/.github 0f390329b590404c02565b27a263ee841fa02bce
.github publish-manifests devantler-tech/.github 6f1dee9557a939cc24ca2c562ea775d05e01564d
ascoachingogvaner publish-app devantler-tech/.github 0c7b6c3509b73adbc7537e030935bb01987e625b
ascoachingogvaner publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0
data-product-controller publish-app devantler-tech/.github 0c7b6c3509b73adbc7537e030935bb01987e625b
Expand Down
43 changes: 43 additions & 0 deletions scripts/tests/test-publish-workflow-canonical-approvals.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -604,5 +604,48 @@ node-pull talos/cluster/verify-first-party-images.yaml .rules[] | select(.image
generic-tenant k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml .spec.resources[] | select(.id == "ociRepository").template.spec.verify.matchOIDCIdentity[0].subject
PROFILES

# The github-config v12 transition retains the independently verified v12.0.2
# signer while admitting the new exact publisher. Retired and unrelated
# identities must fail both the committed subject and issuer predicates (#5265).
github_source="$REPO_ROOT/k8s/bases/apps/github-config/oci-repository.yaml"
github_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$github_source")"
github_issuer="$(yq -er '.spec.verify.matchOIDCIdentity[0].issuer' "$github_source")"
while IFS=$'\t' read -r expected issuer identity; do
result=reject
if printf '%s\n' "$issuer" | grep -Eq -- "$github_issuer" &&
printf '%s\n' "$identity" | grep -Eq -- "$github_subject"; then
result=accept
fi
if [ "$result" = "$expected" ]; then
pass "github-config transition: $expected $issuer $identity"
else
fail "github-config transition: expected $expected for $issuer $identity, got $result"
fi
done <<'IDENTITIES'
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0f390329b590404c02565b27a263ee841fa02bce
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@8d2203af130a8c27b8b98b3d7146f76b5ade7a98
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@1d726483facb9340655489913f609082677be8f5
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328
reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@v12.0.1
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@main
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d-extra
IDENTITIES

aws_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$REPO_ROOT/k8s/providers/hetzner/apps/aws/oci-repository.yaml")"
if printf '%s\n' 'https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d' |
grep -Eq -- "$aws_subject"; then
fail 'github-config approval must not authorize the same new publisher for aws'
else
pass 'github-config approval leaves the unrelated aws consumer closed to the new publisher'
fi

printf '\n%d failure(s)\n' "$failures"
[ "$failures" -eq 0 ]
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,7 +422,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen

source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771

source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 16447462c20c2f5a38287845572807803de61105fc84a6b6ca868e36d4e3bf39
source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config b5ab7e893cffdb3eaa01de448e1daa4ec95e6d9e9a72d4f47ab8439ad7e558e6

source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38

Expand Down
Loading