You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "sbp (via GitHub)" <gi...@apache.org> on 2025/09/15 13:15:03 UTC
[I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-release)
sbp opened a new issue, #233:
URL: https://github.com/apache/tooling-trusted-release/issues/233
The ATR issues secret tokens such as PATs. These should use a standard prefix, and we should report this prefix to selected scanners such as GitHub, to help prevent them from being accidentally recorded in logs etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4408262088
> Yes, but in ATR and in Tooling more generally we're currently using tooling.apache.org, so the prefix for us would be secret_m_org_apache_tooling_. This would not, however, be true of other teams. Instead of contacting all upstream scanners whenever another team is added, perhaps we could just register secret_[df-kmnp-z]_org_apache_. This would allow us to use any namespace with apache.org or a subdomain thereof up to the Noisy Secret length limit. Note that e isn't a valid length because that would be an encoded domain of length 11, whereas apache.org is length 10 and a.apache.org is length 12.
What is our prefix in this new scheme?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3583390339
I did move this to [`tooling-docs`](https://tooling.apache.org/draft-asf-token-standard) - [source](https://github.com/apache/tooling-docs/blob/main/content/pages/draft-asf-token-standard.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4085778444
@sbp Let's finish this for our ATR PATs by March 31. We can do this for all future PATs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3577574617
We need to consider whether we still want to use scannable prefixes if we use DPoP tokens instead of bearer tokens (#335). RFC 9449 § 2 says that "DPoP renders exfiltrated tokens alone unusable", which is true (and not true of an exfiltrated DPoP proof, within tight constraints), but we would still like to know when tokens, which should remain secret, are accidentally shared in public. In other words, a prefix helps not to identify exposure of a DPoP token, which cannot be used without its corresponding private key, but to identify broken workflows or practices that allowed that token to be shared in the first place. Such workflows may also be exposing other secret data.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3538865715
The next step here is for me to write a full proposal for Security to review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3539528446
Further, I'd suggest placing this into the `asfpy` module, and all our tools/apps can use it from there.
(not sure we need a registry for the sub-prefix, but we could certainly do that)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4086699835
asfpy, please?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4129737824
@gstein Yep, we'll contribute an implementation to asfpy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4298707096
After incorporating feedback, the next step will be to use these values within ATR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4407972020
> Submit the noisy secret prefix/pattern to GitHub so their scanner can detect leaked ATR PATs in public repositories. This requires filing a request with GitHub's secret scanning team with the regex pattern matching the noisy secret format.
Yes, but in ATR and in Tooling more generally we're currently using `tooling.apache.org`, so the prefix for us would be `secret_m_org_apache_tooling_`. This would not, however, be true of other teams. Instead of contacting all upstream scanners whenever another team is added, perhaps we could just register `secret_[df-kmnp-z]_org_apache_`. This would allow us to use any namespace with `apache.org` or a subdomain thereof up to the Noisy Secret length limit. Note that `e` isn't a valid length because that would be an encoded domain of length 11, whereas `apache.org` is length 10 and `a.apache.org` is length 12.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3499854750
What's clear so far is that we are discussing this format `asf_${prefix}_`. I don't think we have agreed on how ${prefix} is chosen. I'm not sure that a obfuscated single character for the team that created it is best. A more application specific two or three letter code could be better. In infra docs somewhere we can keep a log of these codes as more kinds of tokens are created.
With this idea `asf_atr_` would be the prefix for ATR tokens or `asf_aaa_` could be the prefix for Oath tokens.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3614078475
Note that your concerns about code complexity may be solved via the "bech" package.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3577877780
Since we are proposing a standard for the ASF for bearer tokens. Please proceed.
If we continue with DPoP then any exposed in logs token is of no concern, but as you note in #335 that's not even a capability of Authentik ...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave closed issue #233: Use a prefix for all secret tokens, and inform selected third party scanners
URL: https://github.com/apache/tooling-trusted-releases/issues/233
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3613285375
While `obvious_secret_` is very obvious. Is 15 characters too long? Would `secret_` be obvious enough?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3621907585
@gstein Thanks. I see that there are two, [bech32m](https://github.com/ods/bech32m/blob/master/bech32m/codecs.py) and [bech32m-chia](https://github.com/nongyehezuoshe/bech32m-chia/blob/main/python/src/bech32m_chia/bech32m.py). I haven't reviewed either yet, just noting them here to make it easier to return to or for others to comment. I've started writing the specification, and it's still in progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3433263431
I also like the checksum concept, but would suggest a simple CRC16. That is more than sufficient to reduce accidental mistakes in copying tokens. (eg. one false positive crc-check in 65536 samples; one-thousandth of 1%). CRC16 would produce half the characters.
I do not recommend base62. That is not a well-standardized algorithm (eg. not in python's standard library). Not in APR(-util). etc
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "asf-tooling (via GitHub)" <gi...@apache.org>.
asf-tooling commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4410422768
<!-- gofannon-issue-triage-bot v2 -->
**Automated triage** — analyzed at `main@2da7807a`
**Type:** `new_feature` • **Classification:** `actionable` • **Confidence:** `high`
**Application domain(s):** `authentication_authorization`, `shared_infrastructure`
### Summary
This issue tracks using prefixed (Noisy Secrets) tokens in ATR and informing third-party scanners. The specification is complete (published at tooling.apache.org/noisy-secrets.html), the reference implementation exists in `atr/noisy.py`, and ATR already generates PATs using noisy secrets (`atr/post/tokens.py` line 62). Per @sbp's latest comment (Apr 22), the next step is to more fully integrate these values within ATR — likely adding format verification on PAT acceptance and registering the `secret_` prefix pattern with GitHub's secret scanning partner program. @gstein also requested upstreaming to `asfpy`.
### Where this lives in the code today
#### `atr/noisy.py` — `create` (lines 292-294)
_currently does this_
The top-level API for creating noisy secrets, already used by the PAT creation flow.
```python
def create(fqdn: bytes | None = None) -> NoisySecret:
noisy_secret = construct_noisy_secret(FQDN(fqdn) if (fqdn is not None) else None)
return NoisySecret(noisy_secret)
```
#### `atr/noisy.py` — `verify` (lines 297-300)
_extension point_
Verification function exists but is not yet called during PAT acceptance/JWT issuance, meaning ATR doesn't validate incoming PAT format.
```python
def verify(bytes_value: bytes) -> bool:
if not is_candidate(bytes_value):
return False
return is_noisy_secret_tag(bytes_value)
```
#### `atr/post/tokens.py` — `_add_token` (lines 69-73)
_currently does this_
PAT creation already uses noisy.create() with the tooling.apache.org domain to generate prefixed tokens.
```python
async def _add_token(session: web.Committer, add_form: shared.tokens.AddTokenForm) -> web.WerkzeugResponse:
plaintext = noisy.create(_PAT_NOISY_SECRET_DOMAIN).decode("ascii")
token_hash = hashlib.sha3_256(plaintext.encode()).hexdigest()
created = datetime.datetime.now(datetime.UTC)
expires = created + datetime.timedelta(days=_EXPIRY_DAYS)
```
#### `atr/storage/writers/tokens.py` — `FoundationCommitter.issue_jwt` (lines 113-128)
_needs modification_
JWT issuance accepts any PAT string without validating its format as a noisy secret. Adding verification here could catch corrupted tokens early and log format mismatches.
```python
async def issue_jwt(self, pat_text: str) -> str:
pat_hash = hashlib.sha3_256(pat_text.encode()).hexdigest()
pat = await self.__data.query_one_or_none(
sqlmodel.select(sql.PersonalAccessToken).where(
sql.PersonalAccessToken.asfuid == self.__asf_uid,
sql.PersonalAccessToken.token_hash == pat_hash,
)
)
if (pat is None) or (pat.expires < datetime.datetime.now(datetime.UTC)):
log.warning(
"Authentication failed",
extra={
"reason": "invalid_or_expired_pat",
},
)
raise storage.AccessError("Authentication failed", status=401)
```
### Where new code would go
- `atr/storage/writers/tokens.py` — after symbol FoundationCommitter.issue_jwt
Add optional noisy secret format validation when a PAT is presented for JWT exchange, logging a warning if the format doesn't match (for migration compatibility with pre-noisy-secret PATs).
### Proposed approach
The core Noisy Secrets implementation is complete and already integrated into PAT generation. The remaining in-code work is to add format verification when PATs are presented for JWT exchange, which helps detect corrupted or fabricated token strings early. Because pre-existing PATs were not generated as noisy secrets, strict rejection would break backwards compatibility — so verification should log a warning rather than reject outright, at least until all legacy PATs have expired (180-day TTL). The second half of this issue — registering the `secret_` + namespace pattern with GitHub's secret scanning partner program — is an external/administrative task that requires submitting a regex pattern to GitHub. Additionally, @gstein requested upstreaming the `atr/noisy.py` implementation to the `asfpy` package, which is a separate contribution outside this repository.
### Suggested patches
#### `atr/storage/writers/tokens.py`
Add format validation logging when a PAT is presented for JWT issuance, helping track migration from legacy tokens to noisy secrets
````diff
--- a/atr/storage/writers/tokens.py
+++ b/atr/storage/writers/tokens.py
@@ -27,6 +27,7 @@ import sqlmodel
import atr.db as db
import atr.jwtoken as jwtoken
import atr.ldap as ldap
+import atr.noisy as noisy
import atr.log as log
import atr.mail as mail
import atr.models.sql as sql
@@ -97,6 +98,10 @@ class FoundationCommitter(GeneralPublic):
async def issue_jwt(self, pat_text: str) -> str:
pat_hash = hashlib.sha3_256(pat_text.encode()).hexdigest()
+ if not noisy.verify(pat_text.encode("ascii")):
+ # Legacy PATs created before noisy secrets will not pass verification.
+ # Log for monitoring migration progress; do not reject yet.
+ log.warning("PAT presented for JWT exchange is not a valid noisy secret", extra={"asfuid": self.__asf_uid})
pat = await self.__data.query_one_or_none(
sqlmodel.select(sql.PersonalAccessToken).where(
sql.PersonalAccessToken.asfuid == self.__asf_uid,
````
### Open questions
- When should legacy (non-noisy-secret) PATs be hard-rejected? After all existing 180-day PATs expire, or with an explicit migration notice?
- Has the `secret_` prefix regex been submitted to GitHub's secret scanning partner program yet? This is the 'inform selected third party scanners' half of the issue.
- Should the noisy.py module be upstreamed to asfpy before or after full ATR integration, per @gstein's request?
- Are there other secret token types in ATR (beyond PATs) that should also use noisy secrets?
### Files examined
- `atr/noisy.py`
- `atr/post/tokens.py`
- `atr/storage/writers/tokens.py`
- `atr/get/tokens.py`
- `atr/docs/authentication-security.md`
- `atr/shared/tokens.py`
- `atr/jwtoken.py`
- `atr/config.py`
---
*Draft from a triage agent. A human reviewer should validate before merging any change. The agent did not run tests or verify diffs apply.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4665576993
Shouldn't the prefix for the ASF allow multiple letters?
```secret_[df-kmnp-z]+_org_apache_```
And can we get this into asfpy, so that I can use it in Apache STeVe, and other projects be able to use it from there?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3612684619
The more I consider this, the more I prefer the design suggested in the FAQ.
Some modifications that I would make:
* Use `obvious_secret_` as the prefix instead of `secret_scannable_`.
* Use 160 bits of entropy instead of 130 bits.
* Remove the underscore between the entropy and checksum in the output.
* Use BIP-350 Bech32m instead of BIP-173 Bech32.
This uses 15 characters for the prefix, 32 characters for the entropy, and 6 characters for the checksum. The anonymous HRP is of length 14, giving a token length of 53. The maximum number of characters permitted in the namespace is 42, and the maximum length of a namespaced token is 96 characters.
The three things that I dislike most about this format are the relative complexity of the code, the use of `l` in the Bech32m alphabet (present in Bech32 too), and the long length of tokens.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3539523365
I suggest this as the basis of your proposal:
https://grok.com/share/c2hhcmQtMg_1276cac7-fcf6-4f48-8246-b850d7d7cfd6
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3433050904
We should probably use an underscore, too, for the reasons that GitHub and npm gave.
That would make our example `asftap_`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-release)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-release/issues/233#issuecomment-3299232607
[GitHub use](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-authentication-to-github) `ghp_`, `github_pat_`, `gho_`, `ghu_`, `ghs_`, `ghr_`.
[GitLab use](https://docs.gitlab.com/security/tokens/) `glpat-`, `gloas-`, `gldt-`, `glrt-`, `glrtr-`, `glcbt-`, `glptt-`, etc.
[Stripe use](https://docs.stripe.com/keys) `sk_test_`, `pk_test_`, `rk_test_` for test keys.
[Slack use](https://docs.slack.dev/authentication/tokens/) `xoxb-`, `xwfp-`, `xoxp-`, and `xapp-`.
[NPM use](https://github.blog/security/announcing-npms-new-access-token-format/) `npm_`, with a little note about why they chose underscore:
"Moreover, the delimiter following after is no longer a - but an underscore _ which means that the full token can be selected when double-clicked (saving you 0.005 seconds 🎉 )."
They also include a checksum, which is interesting:
"The last six characters of the tokens consist of CRC32 checksum, which is encoded in our Base62 implementation to further eliminate false positives when scanning for leaked tokens."
Also [GitHub give rationale about the underscore](https://github.blog/security/announcing-npms-new-access-token-format/):
"An underscore is not a Base64 character which helps ensure that our tokens cannot be accidentally duplicated by randomly generated strings like SHAs."
We could use something like `asf` as a general prefix, `t` for tooling, `a` for the atr, and then I suppose a token type, e.g. `p` for PATs. That would give e.g. `asftap-`, which is still reasonably short, but well scoped, with room for extensibility across the whole foundation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4389977675
The feedback has been addressed in the specification in https://github.com/apache/tooling-docs/commit/5d66ce236a86a566189031ea75065fed13d93ff7.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4389680338
The feedback to incorporate was [submitted on Slack](https://the-asf.slack.com/archives/C036TP6JNQL/p1776275156744429).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-release)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-release/issues/233#issuecomment-3299102653
Since a prefix is arbitrary I think we should discuss this prefix with others in the foundation. I also do not know if there is a standard approach like all caps or mixed case. My opinion is that the prefix ought to include "TheASF" in some form.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3377697315
Interact with Arnout
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3433235073
I agree with the idea to use "asf_" as the prefix, and then a subcomponent can further scope it. There are other apps and the asfquart framework where we need to generate (in-flight) tokens, which could follow the asf_ prefix pattern.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3589764640
I also wrote an FAQ where we consider an alternative design based on early feedback:
https://github.com/apache/tooling-trusted-releases/blob/143f876bd75d79e945eea653f1ebb3845488dc50/notes/draft-asf-token-standard-faq.md
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4183873211
The new draft specification is available at:
https://tooling.apache.org/noisy-secrets.html
https://github.com/apache/tooling-runbooks/blob/main/notes/noisy-secrets.md
And the draft reference implementation is available at:
https://github.com/apache/tooling-trusted-releases/blob/main/atr/noisy.py
Which we will upstream once it and the specification have been more widely reviewed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4390212021
Commit 7c161aee10f2b9abc1528ffcef73e0d2050839b1 migrates ATR to use Noisy Secrets for PATs, using `tooling.apache.org` as the namespace domain.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3583170910
I have published a draft ASF token standard here:
https://github.com/apache/tooling-trusted-releases/blob/1fb5833d1c64976dfdf0d1ef318e8bd9f38fe014/notes/draft-asf-token-standard.md
As this is an ATR issue I have added it to the ATR source, with the bonus that it allows collaboration through standard Git and GitHub interfaces. We could move or copy the draft to `tooling-docs` or our Confluence wiki or any other suitable venue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3433080643
This proposal looks very reasonable to me. Some thoughts:
* ~I'm curious why you cite a couple of reasons to pick `_` for the delimiter, and then seem to pick `-`? No strong preference though~ (ha GMTA)
* I wonder if it'd make sense to split the `asf` prefix from our 'internal' `tap` scoping, possibly that'd make it easier to register them all 'in one go' to scanners?
* Likely our MFA/identitymanagement/Authentik will also support tokens in some form. I wonder if that'd ever lead to a situation where a token used to be 'managed' by (say) ATR, but later we'd decide to move the management of that token to Authentik, or vice-versa, or to/from other systems. I think your proposal allows such migrations (and the scoping makes this easier, rather than harder), so that seems OK?
I see no problems, but would be good to coordinate with Infra, particularly wrt the MFA project?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3499930673
I can envision Apache STeVe possibly issuing tokens for API access to manage Elections.
To follow the above pattern, we would go with `asf_stv_` as a prefix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3433146942
I've asked Infra on Slack what they think of the proposal, but I will also draft a more formal proposal on the ASF confluence wiki for Infra review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3613270901
Here is ChatGPT's similar explanation: https://chatgpt.com/share/6931be65-98e8-8005-8216-02c2560f5f13
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-3612842768
BIP-350 versus BIP-173 Bech32, explained by Grok:
https://grok.com/share/c2hhcmQtMg_db611964-fdc4-48e5-9234-33b37ff4c23f
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "asf-tooling (via GitHub)" <gi...@apache.org>.
asf-tooling commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4407589945
<!-- gofannon-issue-triage-bot v2 -->
**Automated triage** — analyzed at `main@751c2146`
**Type:** `new_feature` • **Classification:** `actionable` • **Confidence:** `medium`
**Application domain(s):** `authentication_authorization`, `admin_operations`
### Summary
This issue requests using a standard prefix for ATR secret tokens (PATs) and registering the prefix with third-party scanners like GitHub. The team has developed a 'noisy secrets' specification (published at tooling.apache.org/noisy-secrets.html) with a reference implementation in `atr/noisy.py`. The PAT creation code already uses `noisy.create()` (visible in `atr/post/tokens.py`). The remaining work is: (1) registering the prefix pattern with GitHub's secret scanning partner program and other scanners, (2) upstreaming `atr/noisy.py` to `asfpy` per @gstein's request, and (3) potentially integrating with any other secret token types ATR issues.
### Where this lives in the code today
#### `atr/post/tokens.py` — `_add_token` (lines 69-84)
_currently does this_
PAT creation already uses noisy.create() with a domain prefix, implementing the 'prefix for all secret tokens' part of the issue.
```python
import atr.noisy as noisy
import atr.sessions as sessions
import atr.shared as shared
import atr.storage as storage
import atr.web as web
_EXPIRY_DAYS: Final[int] = 180
_PAT_NOISY_SECRET_DOMAIN: Final[bytes] = b"tooling.apache.org"
...
async def _add_token(session: web.Committer, add_form: shared.tokens.AddTokenForm) -> web.WerkzeugResponse:
plaintext = noisy.create(_PAT_NOISY_SECRET_DOMAIN).decode("ascii")
token_hash = hashlib.sha3_256(plaintext.encode()).hexdigest()
created = datetime.datetime.now(datetime.UTC)
expires = created + datetime.timedelta(days=_EXPIRY_DAYS)
```
#### `atr/storage/writers/tokens.py` — `FoundationCommitter.add_token` (lines 61-75)
_currently does this_
Storage layer for token creation - receives the already-hashed noisy secret; no changes needed here.
```python
async def add_token(
self, token_hash: str, created: datetime.datetime, expires: datetime.datetime, label: str | None
) -> types.PersonalAccessTokenSafe:
if not label:
raise ValueError("Label is required")
pat = sql.PersonalAccessToken(
asfuid=self.__asf_uid,
token_hash=token_hash,
created=created,
expires=expires,
label=label,
)
self.__data.add(pat)
await self.__data.commit()
log.auth_event("pat_issuance", self.__asf_uid, pat_hash=pat.token_hash)
```
#### `atr/storage/writers/tokens.py` — `FoundationCommitter.issue_jwt` (lines 113-128)
_currently does this_
JWT issuance from PAT - accepts the noisy secret plaintext and hashes it for lookup. Works with the new format since hashing is format-agnostic.
```python
async def issue_jwt(self, pat_text: str) -> str:
pat_hash = hashlib.sha3_256(pat_text.encode()).hexdigest()
pat = await self.__data.query_one_or_none(
sqlmodel.select(sql.PersonalAccessToken).where(
sql.PersonalAccessToken.asfuid == self.__asf_uid,
sql.PersonalAccessToken.token_hash == pat_hash,
)
)
if (pat is None) or (pat.expires < datetime.datetime.now(datetime.UTC)):
log.warning(
"Authentication failed",
extra={
"reason": "invalid_or_expired_pat",
},
)
raise storage.AccessError("Authentication failed", status=401)
```
#### `atr/jwtoken.py` — `verify` (lines 125-138)
_currently does this_
JWT verification - JWTs themselves don't need the noisy prefix (they're short-lived and derived from PATs), but this shows the authentication chain from PAT to JWT.
```python
async def verify(token: str) -> dict[str, Any]:
jwt_secret_key = _signing_key()
claims_unsafe = jwt.decode(token, options={"verify_signature": False}, algorithms=[_ALGORITHM])
asf_uid = claims_unsafe.get("sub")
log.set_asf_uid(asf_uid)
claims = jwt.decode(
token,
jwt_secret_key,
algorithms=[_ALGORITHM],
issuer=_ATR_JWT_ISSUER,
audience=_ATR_JWT_AUDIENCE,
leeway=_ATR_JWT_LEEWAY_SECONDS,
options={"require": ["sub", "iss", "aud", "iat", "nbf", "exp", "jti"]},
)
```
### Where new code would go
- `atr/noisy.py` — existing file (reference implementation)
The noisy secrets reference implementation already exists here per @sbp's comment. It will eventually be upstreamed to asfpy per @gstein's request.
### Proposed approach
The core implementation within ATR is already complete - PATs are generated using `noisy.create()` with the domain `b"tooling.apache.org"`. The remaining work is primarily external to this codebase:
1. **Register with GitHub Secret Scanning Partner Program**: Submit the noisy secret prefix/pattern to GitHub so their scanner can detect leaked ATR PATs in public repositories. This requires filing a request with GitHub's secret scanning team with the regex pattern matching the noisy secret format.
2. **Upstream to asfpy**: Per @gstein's request (confirmed by @sbp), move the `atr/noisy.py` implementation into the shared `asfpy` module so other ASF tools can use the same token format. Once upstreamed, ATR would depend on `asfpy.noisy` instead of `atr.noisy`.
3. **Incorporate specification feedback**: @sbp's last comment notes that feedback from `#security-discuss` needs to be incorporated before the standard is finalized.
Since the in-repo implementation is already functional and the remaining work is coordination/external registration, no immediate code diffs are needed within this repository.
### Open questions
- What is the exact regex pattern produced by atr/noisy.py that should be registered with GitHub's secret scanning partner program?
- Has the feedback from #security-discuss been incorporated into the specification yet?
- Are there other secret token types in ATR beyond PATs that need the noisy prefix (e.g., any temporary secrets in SSH workflows)?
- What is the timeline for upstreaming to asfpy, and will ATR then switch its import from atr.noisy to asfpy.noisy?
- Should the IssueForm in atr/shared/tokens.py validate that the submitted PAT matches the noisy secret format (as a client-side hint that old-format PATs are no longer accepted)?
### Files examined
- `atr/post/tokens.py`
- `atr/storage/writers/tokens.py`
- `atr/get/tokens.py`
- `atr/jwtoken.py`
- `tests/unit/test_tokens_safe.py`
- `atr/shared/tokens.py`
- `atr/storage/readers/tokens.py`
- `atr/ssh.py`
---
*Draft from a triage agent. A human reviewer should validate before merging any change. The agent did not run tests or verify diffs apply.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4245555930
Today, I announced the draft specification and reference implementation on `#security-discuss`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-4661623615
> What is our prefix in this new scheme?
The prefix for ASF Tooling is:
```
secret_m_org_apache_tooling_
```
The prefix for the entire ASF is:
```
secret_[df-kmnp-z]_org_apache_
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #233:
URL: https://github.com/apache/tooling-trusted-releases/issues/233#issuecomment-6236554602
Closing since the design is done.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org