Concerning the security of third-party buildbots
I'm concerned with the security of buildbots which are provided by third-party individuals and organisations.
- What if the buildbots would infect the builds with malware or whatever else?
- What type of security precaution is in place?
Hi,
Here is the Python buildbot security documentation: https://devguide.python.org/buildworker/#security-considerations
Victor
Le mar. 28 janv. 2020 à 08:35, A via Python-Buildbots <python-buildbots@python.org> a écrit :
I'm concerned with the security of buildbots which are provided by third-party individuals and organisations.
- What if the buildbots would infect the builds with malware or whatever else?
- What type of security precaution is in place?_______________________________________________ Python-Buildbots mailing list -- python-buildbots@python.org To unsubscribe send an email to python-buildbots-leave@python.org https://mail.python.org/mailman3/lists/python-buildbots.python.org/
-- Night gathers, and now my watch begins. It shall not end until my death.
On Jan 28, 2020, at 02:39, Victor Stinner <vstinner@python.org> wrote:
Here is the Python buildbot security documentation: https://devguide.python.org/buildworker/#security-considerations
Victor
Le mar. 28 janv. 2020 à 08:35, A via Python-Buildbots <python-buildbots@python.org> a écrit :
I'm concerned with the security of buildbots which are provided by third-party individuals and organisations.
- What if the buildbots would infect the builds with malware or whatever else?
- What type of security precaution is in place?_______________________________________________
Also, in case it's not obvious, the buildbots are only used for testing fixes. We do not use any of these buildbots, or systems that these buildbots run on, to produce any CPython release materials.
-- Ned Deily nad@python.org -- []
Re: your first question: the buildbot process does not push, and b) 3rd party people/organizations do not have push authority, so your concern is not not about buildbot - but github and who can push into it (regardless of whether it is part of buildbot testing or not).
As to your second question: the security in place will depend on what that party considers adequate for the task; if you find a security bug in the buildbot package - post there as an issue, better publish a pull request.
On 28/01/2020 07:40, A via Python-Buildbots wrote:
I'm concerned with the security of buildbots which are provided by third-party individuals and organisations.
- What if the buildbots would infect the builds with malware or whatever else?
- What type of security precaution is in place?
Python-Buildbots mailing list -- python-buildbots@python.org To unsubscribe send an email to python-buildbots-leave@python.org https://mail.python.org/mailman3/lists/python-buildbots.python.org/
participants (4)
-
A -
Michael Felt -
Ned Deily -
Victor Stinner