Bitrise builds viewable from the public
Categories
(Focus :: Security: iOS, defect)
Tracking
(Not tracked)
People
(Reporter: juanlunathethird, Unassigned, NeedInfo)
Details
Steps to reproduce:
Searching for a Bitrise nodename ATL1-vFW02-gen2-mmg4-10-87-55-52
Actual results:
Bitrise build logs for the iOS mobile build appeared https://firefoxci.taskcluster-artifacts.net/Tu8sIrLhTBSUGcEjVrZfZA/0/public/logs/bitrise.log
Expected results:
No bitrise build logs should be viewable
|
||
Comment 1•3 years ago
|
||
Firefox is an open source project and we prefer to have all of our build artifacts public. What is wrong with treating a bitrise log like our other build output? (Note we do redact user names and tokens)
|
|
||
Comment 2•3 years ago
|
||
Laurie: who works on our iOS build infra and can check whether this is OK or not. The sensitive data seemed redacted at a quick skim
|
||
Updated•3 years ago
|
|
|
||
Comment 4•3 years ago
|
||
Hello,
This data is coming from a Taskcluster job that we run ad-hoc, the job is always the same and those will be the logs. It is not running for PRs so the output will always be similar to that one attached. The sensitive data is not visible in the logs.
Furthemore, currently firefox-ios is configured as level 3 repo, that means that PRs will not be able to launch this task and so generate logs exposing other data.
Hope that helps but in any case, please let us know which issues and or concerns there are with this implementation so that we can act accordingly.
Thanks
|
|
||
Comment 5•3 years ago
|
||
No bitrise build logs should be viewable
Closing incomplete:
- no reasons or references given to support this blanket assertion
- no evidence given from our logs that we are leaking secrets
Description
•