You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "villebro (via GitHub)" <gi...@apache.org> on 2026/08/18 00:16:23 UTC
[PR] fix(release): harden release-pipeline integrity [superset-kubernetes-operator]
villebro opened a new pull request, #280:
URL: https://github.com/apache/superset-kubernetes-operator/pull/280
## Summary
Closes four independent integrity gaps in the release/supply-chain pipeline. All are in-scope per the operator's documented "supply chain issues in the build and release pipeline" security policy.
## Details
- **Helm chart signed by a mutable tag (TOCTOU).** The chart signing step reconstructed a tag reference from `Chart.yaml` after `helm push` had discarded the digest, so cosign signed whatever the registry served at signing time — a window in which a `packages:write` credential could swap the chart and receive a valid keyless signature under the workflow's OIDC identity. The push step now captures and validates the pushed digest (`^sha256:...`, hard-fail otherwise) and the chart is signed by digest, mirroring the manager image step.
- **Signed release image consumed the GHA build cache.** `cache-from/to: type=gha` fed the cosign-signed, SLSA-attested `build-push` step, so a poisoned default-branch-scope BuildKit cache entry could be laundered into a signed release. Cache is now gated on `github.ref_type != 'tag'` — tag-triggered release builds rebuild every layer from source; dev builds keep the cache.
- **Documented `cosign verify` commands were unpinned/permissive.** `security.md` used a bare verify with no identity; `downloads.md` used an unanchored repo-wide identity regexp satisfied by any workflow/ref. Both now pin `--certificate-oidc-issuer` and an anchored `release.yml@refs/tags/v*` identity, with explicit text that `@refs/heads/main` dev builds share the identity and must fail the check.
- **Finalize could promote a non-voted RC tarball.** `release-source.sh` globbed `-rc*.tar.gz` and took `head -1` of unsorted `find` output, ignoring the RC number derived from the tag on HEAD. It now selects the exact voted `rc${RC}` tarball (validated integer) and errors on ambiguity instead of picking one.
## Testing
- `release.yml` parses as valid YAML; `bash -n` and `shellcheck -S error` clean on `release-source.sh`
- `golangci-lint` and `rumdl` (markdown) clean
- Workflow/script behavior is observable on the next dev push and release tag (no test harness for workflow YAML in this repo)
---
Found via a Claude security scan. Part of a series of security follow-ups; opened as a draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(release): harden release-pipeline integrity [superset-kubernetes-operator]
Posted by "villebro (via GitHub)" <gi...@apache.org>.
villebro merged PR #280:
URL: https://github.com/apache/superset-kubernetes-operator/pull/280
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(release): harden release-pipeline integrity [superset-kubernetes-operator]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #280:
URL: https://github.com/apache/superset-kubernetes-operator/pull/280#issuecomment-5321839827
## [Codecov](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/280?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 90.01%. Comparing base ([`41c95d7`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/41c95d76da37110f6d4fa786e1ad1836ac4d0188?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`b2de958`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/b2de958cd86a1570b51e94d370710d3fa14d8b4b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/280?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org