Credentials in starlingx-staging repo
Hi StarlingX community, Someone reached out on the info email for the project to raise a concern about exposed credentials in the starlingx-staging repo in the jenkins folder. The person listed a few items that might be of a concern to be stored in the public repository: * base64-encoded client certificates and private keys * Cluster configurations referring to kubernetes-admin access * Kubernetes API endpoints While these are likely out of concern due to describing a test environment, but I wanted to share the concern if it might still be helpful to look into. Best Regards, Ildikó ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
Thanks Ildiko, we are looking into this. ________________________________ From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Thursday, April 17, 2025 5:49 AM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: Credentials in starlingx-staging repo CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi StarlingX community, Someone reached out on the info email for the project to raise a concern about exposed credentials in the starlingx-staging repo in the jenkins folder. The person listed a few items that might be of a concern to be stored in the public repository: * base64-encoded client certificates and private keys * Cluster configurations referring to kubernetes-admin access * Kubernetes API endpoints While these are likely out of concern due to describing a test environment, but I wanted to share the concern if it might still be helpful to look into. Best Regards, Ildikó ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
On 2025-04-17 16:21:23 +0000 (+0000), Panech, Davlet wrote:
Thanks Ildiko, we are looking into this. [...]
In order to cut down on future unsolicited reports from concerned individuals on the Internet who sit around scanning random Git repos looking for accidentally included secret data, it can help to include comments in affected files pointing out when they're non-production test data and the like. -- Jeremy Stanley
My thinking in the early days was that the StarlingX build was a build for developers. In order to facilitate contributions to StarlingX, we needed allow folks to build and install packages signed with the same common set of developer credentials. Anyone looking to do a real world deployment was expected to rebuild the full load, substituting their own credentials, or employing a signing server. At the next community meeting, we should switching to a secure set of credentials for our release branches. Or perhaps having two builds, one with secure creds and one with the current developer creds. Scott
Actually that wasn't the best response. I was thinking of a different set of creds in a different git. I do see that the .kube subdirectory was included in the git, which should have been in the .gitignore file. I can remove that. Ildikó, can you forward the email with the details of that info email. Perhaps there is more I haven't spotted yet. Scott On 2025-04-17 12:43, Scott Little wrote:
participants (4)
-
Ildiko Vancsa
-
Jeremy Stanley
-
Panech, Davlet
-
Scott Little