Tuf: GitHub Actions: Consider hardening setup against CVE-2020-15228

[lukpueh]

Description of issue or feature request:

1242 added a GitHub Actions based CI workflow . GitHub Actions has a moderate injection vulnerability (CVE-2020-15228) against which we should consider hardening our setup.

Current behavior:
No particular hardening against CVE-2020-15228

Expected behavior:
Assess necessity and harden against CVE-2020-15228.

@jku proposes a strategy in https://github.com/theupdateframework/tuf/issues/1195#issuecomment-744600836 also described in https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/

[joshuagl]

Additional hardening we might consider is in the actions we use.

AFAICT an Action release on the marketplace corresponds to a tag in the repository that publishes the action, which leaves users open to malicious maintainer attacks - tags are not immutable, so a repo owner (or attacker) can replace the tag and point to a malicious version of the action.

GitHub allows us to restrict actions to either: only use actions defined in our org, only allow a predefined list of actions, or allow all actions.

[lukpueh]

Good observation, @joshuagl! Here are some ideas to reduce the attack surface:

• use the commit sha instead of the tag (with the downside of pinning full versions, whereas with tags you can also pin major or minor only)
• allow only actions created/hosted by GitHub (and maybe popular verified 3rd-party actions)
• try to use custom shell scripts on the run: keyword instead of non-verified 3rd-party actions where feasible

[trishankatdatadog]

You guys are really thinking this through. Very impressive! 👏🏽

[joshuagl]

Another reason to distrust 3rd-party Actions – they can push commits (and tags?) to the repository[1].

Furthermore, possibly due to the underlying shared object storage of GitHub, it seems that git activity on forks __may__ have unintended consequences on the forked repo. So far as I can tell, this is not yet confirmed, but the Caddy Web Server seems to have had a release made – and pushed to the Go module proxy – by a tag being pushed to a fork of their repo[2].