protobuf

18946 Commits

198 Branches

349 Tags

255 MiB

Tag: Branch: Tree: b5fca3e1b5

Commit Graph

Author	SHA1	Message	Date
Deanna Garcia	39824ca7bd	Disable dependabot for version updates that aren't security related. This will still allow dependabot security updates according to https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit. PiperOrigin-RevId: 677879732	2 months ago
Protobuf Team Bot	da398bd4c2	Hash pin github workflows ## Description I would like to suggest a security practice recommended by the [OpenSSF Scorecard][scorecard-repo] which is to hash pin dependencies to prevent typosquatting and tag renaming attacks. The change would only be applied to GitHub workflows. This means hash pinning GitHub Workflow actions. Along with hash-pinning dependencies, I also recommend adopting dependabot (or other dependency update tool) to help keep the dependencies up to date. Most tools can update hashes and associated semantic version comments. Any questions or concerns just let me know. Thanks! ## Additional Context A tag renaming attack is a type of attack whereby an attacker: - Hijack an action. - Upload a malicious version. - Replace existing tags with malicious versions. A [typosquatting attack][typosquatting] is a type of attack whereby an attacker: - Create a malicious package - Publish it with a similar name of a known package (example: numpi instead of numpy) For more informations about the dependency-update tools: - [Dependabot][dependabot] [scorecard-repo]: https://github.com/ossf/scorecard [deps-confusion]: https://www.websecuritylens.org/how-dependency-confusion-attack-works-and-how-to-prevent-it/ [typosquatting]: https://snyk.io/blog/typosquatting-attacks/ [dependabot]: https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/ [renovatebot]:https://www.mend.io/renovate/ PiperOrigin-RevId: 561019142	1 year ago

Author

SHA1

Message

Date

Deanna Garcia

39824ca7bd

Disable dependabot for version updates that aren't security related.

This will still allow dependabot security updates according to https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit.

PiperOrigin-RevId: 677879732

2 months ago

Protobuf Team Bot

da398bd4c2

Hash pin github workflows

## Description

I would like to suggest a security practice recommended by the [OpenSSF Scorecard][scorecard-repo] which is to hash pin dependencies to prevent typosquatting and tag renaming attacks.

The change would only be applied to GitHub workflows.

This means hash pinning GitHub Workflow actions.

Along with hash-pinning dependencies, I also recommend adopting dependabot (or other dependency update tool) to help keep the dependencies up to date. Most tools can update hashes and associated semantic version comments.

Any questions or concerns just let me know.
Thanks!

## Additional Context

A tag renaming attack is a type of attack whereby an attacker:
- Hijack an action.
- Upload a malicious version.
- Replace existing tags with malicious versions.

A [typosquatting attack][typosquatting] is a type of attack whereby an attacker:
- Create a malicious package
- Publish it with a similar name of a known package (example: numpi instead of numpy)

For more informations about the dependency-update tools:
- [Dependabot][dependabot]

[scorecard-repo]: https://github.com/ossf/scorecard
[deps-confusion]: https://www.websecuritylens.org/how-dependency-confusion-attack-works-and-how-to-prevent-it/
[typosquatting]: https://snyk.io/blog/typosquatting-attacks/
[dependabot]: https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/
[renovatebot]:https://www.mend.io/renovate/

PiperOrigin-RevId: 561019142

1 year ago

2 Commits (b5fca3e1b5a52e7fab8cfa529d7841b95e65482c)