CI: fork PRs run untrusted code on the self-hosted runner, and the SDK download is unverified #12
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Split out of the #9 review so it does not become a scope grab there. Both landed in #6; neither is introduced by #9, which only edits comments in the same file.
1.
pull_requeston a self-hosted runner from a public repo.forgejo/workflows/pr-checks.ymltriggers onpull_request, runs oncth-ubuntu-latest(self-hosted), and executes./gradlewfrom the PR head. This repo is public, so a PR opened from a fork gets its ownbuild.gradle.kts,settings.gradle.kts, wrapper jar and task graph executed on the runner. The runner's filesystem, its Gradle and SDK caches, and its network position are all in reach of whatever that branch configures.The keystore is genuinely not in this workflow — that separation was deliberate in #6 and it holds. What is exposed is the runner, not release signing.
Options, roughly in order of bluntness:
The last is a real option — it just deserves to be a decision rather than an oversight. The trigger's own comment currently reasons about a future default change widening the trigger while this goes unmentioned.
2. The cmdline-tools zip has no checksum
No signature check, no
sha256sum -c. The URL is already version-pinned, so pinning the hash beside it is a one-line change. Whatever the archive contains becomes the build toolchain, and the result is cached at/opt/android-sdkunder a key that does not cover the archive's content.The same two lines exist in
build.yml, which does touch the keystore.