7 ms·
One thing I don't quite get is how trusted publishing is supposed to be more secure. It still allows publishing if they pwn your workflow. Is it purely more se
by skipants 2mo ago
One thing I don't quite get is how trusted publishing is supposed to be more secure. It still allows publishing if they pwn your workflow.
Is it purely more secure because they can't exfiltrate your secret keys to publish again?
I feel like if your workflow gets pwned you'd be rotating your keys anyways, so I'm not sure if the vendor lock-in is worth it.
- flyingshelf 2mo agoKeys can be reused from anywhere. Trusted publishing means the attacker must trigger the specific workflow on GitHub, which is more difficult and leaves trace of actions on GitHub itself.
- pimterry 2mo agoTrusted staged publishing helps a lot: you have to independently pwn the workflow _and_ then complete a separate 2FA flow as a maintainer. The workflow never sees any keys that can publish independently.
- insanitybit 2mo agoTrusted Publishing pins the publish to the workflow. The next step is to isolate "run untrusted code (`npm build`)" from "publish" in your workflows. Now you have two properties - the publish can only happen from one place and the publish is isolated from untrusted code execution.