chore(docs): Created `GitHub runner cryptographic overview` #386

alithethird · 2024-10-03T08:13:57Z

Applicable spec: SEC0030 - SSDLC - Cryptographic Documentation

Overview

Created the GitHub runner cryptographic overview document.

Rationale

Juju Events Changes

Module Changes

Library Changes

Checklist

The charm style guide was applied.
The contributing guide was applied.
The changes are compliant with ISD054 - Managing Charm Complexity
The documentation is generated using src-docs.
The documentation for charmhub is updated.
The PR is tagged with appropriate label (urgent, trivial, complex).
The changelog is updated with changes that affects the users of the charm.

docs/reference/cryptographic-overview.md

github-actions · 2024-10-03T09:08:50Z

Test coverage for 514725e

Name                         Stmts   Miss Branch BrPart  Cover   Missing
------------------------------------------------------------------------
src/charm.py                   613    160    153     26    71%   242-244, 310-329, 347-349, 350->354, 380-384, 463, 470-472, 493-498, 515-521, 542, 554-560, 575-576, 595-596, 605, 610, 640-641, 643->652, 647->652, 657-663, 697, 701-706, 757-762, 771->774, 797-809, 813-814, 842-869, 882-887, 906-916, 931-933, 980-981, 983-984, 986-987, 1066->1068, 1133-1134, 1172-1174, 1182-1188, 1266-1298, 1312-1317, 1332-1366, 1370
src/charm_state.py             456     17     98      5    95%   276-288, 513-517, 639-640, 695-696, 1131->1134, 1138-1139, 1186
src/errors.py                   25      0      0      0   100%
src/event_timer.py              52      6      0      0    88%   105-106, 143-144, 160-161
src/firewall.py                 51     18     20      0    61%   42-43, 66-69, 111-185
src/github_client.py            23      2      6      1    90%   66->exit, 71-72
src/logrotate.py                43      0      2      0   100%
src/lxd_type.py                 35      0      2      0   100%
src/runner_manager_type.py      39      0      6      0   100%
src/runner_type.py              38      0     10      0   100%
src/shared_fs.py                93     17     10      1    83%   52-53, 120-121, 146-147, 155-156, 162-163, 181, 184-185, 197-198, 241-242
src/utilities.py                32      4      6      2    79%   66-69, 111
------------------------------------------------------------------------
TOTAL                         1500    224    313     35    83%

Static code analysis report

Run started:2024-10-03 09:08:06.665251

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 4976
  Total lines skipped (#nosec): 2
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 6

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

docs/reference/cryptographic-overview.md

yanksyoon

wow, great research, thank you for doing it!

docs/reference/cryptographic-overview.md

cbartz

Thanks! Mostly have nits

docs/reference/cryptographic-overview.md

cbartz · 2024-10-18T08:36:16Z

docs/reference/cryptographic-overview.md

+
+The GitHub runner charm supports being deployed behind an HTTP proxy. [Aproxy](https://github.com/canonical/aproxy) is installed and enabled when an HTTP proxy is detected so that jobs executing in the runner VMs don’t have to configure the proxy themselves. Aproxy is a transparent proxy service for HTTP and HTTPS/TLS connections. Aproxy works by pre-reading the Host header in HTTP requests and SNI in TLS hellos; it forwards HTTP proxy requests with the hostname therefore, complies with HTTP proxies requiring destination hostname for auditing or access control. Aproxy doesn't and can't decrypt the TLS connections. It works by reading the plaintext SNI information in the client hello during the TLS handshake, so the authentication and encryption of TLS are never compromised. Aproxy supports TLS 1.0 and above except TLS 1.3 Encrypted Client Hello.
+### Signature Verification
+Cloud image is verified by SHA256 checksum. Runner binary is also downloaded by [GitHub Runner Charm](https://github.com/canonical/github-runner-operator) and verified by SHA256 in this charm.


Could we elaborate which Cloud image is meant here?

I think this sentence should be updated here, too.

docs/reference/cryptographic-overview.md

…om:canonical/github-runner-operator into ISD-2412-SSDLC-Cryptographic-Documentation

cbartz

Thanks. Some follow-up comments.

cbartz · 2024-10-18T12:48:22Z

docs/reference/cryptographic-overview.md


-Images that run in the OpenStack vm are built using the [Image Builder Charm](https://github.com/canonical/github-runner-image-builder-operator). This charm needs to download the runner binary, cloud image to base the image on and yq. All these images are downloaded with TLS.
+Images that run in the OpenStack vm are built using the [Image Builder](https://github.com/canonical/github-runner-image-builder-operator). This application needs to download the runner binary, yq and the cloud image to base the image on. All these images are downloaded with TLS.


Suggested change

Images that run in the OpenStack vm are built using the [Image Builder](https://github.com/canonical/github-runner-image-builder-operator). This application needs to download the runner binary, yq and the cloud image to base the image on. All these images are downloaded with TLS.

Images that run in the OpenStack vm are built using the [Image Builder](https://github.com/canonical/github-runner-image-builder. This application needs to download the runner binary, yq and the cloud image to base the image on. All these images are downloaded with TLS.

cbartz · 2024-10-18T12:50:20Z

docs/reference/cryptographic-overview.md

 ### Signature Verification
-Cloud images are verified by SHA256 checksum. Runner binary is also downloaded by [the GitHub Runner Charm](https://github.com/canonical/github-runner-operator) and verified by SHA256 in this charm.
+Cloud images that are downloaded by the Image Builder are verified by SHA256 checksum. Runner binary is also downloaded by [the GitHub Runner Charm](https://github.com/canonical/github-runner-operator) and verified by SHA256 in this charm.


@yanksyoon Can you have a look on "Cloud images that are downloaded by the Image Builder are verified by SHA256 checksum." if its correct in terms of the technical implementation?

cbartz · 2024-10-18T12:50:34Z

docs/reference/cryptographic-overview.md

+
+The GitHub runner charm supports being deployed behind an HTTP proxy. [Aproxy](https://github.com/canonical/aproxy) is installed and enabled when an HTTP proxy is detected so that jobs executing in the runner VMs don’t have to configure the proxy themselves. Aproxy is a transparent proxy service for HTTP and HTTPS/TLS connections. Aproxy works by pre-reading the Host header in HTTP requests and SNI in TLS hellos; it forwards HTTP proxy requests with the hostname therefore, complies with HTTP proxies requiring destination hostname for auditing or access control. Aproxy doesn't and can't decrypt the TLS connections. It works by reading the plaintext SNI information in the client hello during the TLS handshake, so the authentication and encryption of TLS are never compromised. Aproxy supports TLS 1.0 and above except TLS 1.3 Encrypted Client Hello.
+### Signature Verification
+Cloud image is verified by SHA256 checksum. Runner binary is also downloaded by [GitHub Runner Charm](https://github.com/canonical/github-runner-operator) and verified by SHA256 in this charm.


I think this sentence should be updated here, too.

chore(docs): Created GitHub runner cryptographic overview

3d2c870

alithethird added documentation Improvements or additions to documentation trivial labels Oct 3, 2024

alithethird requested a review from a team as a code owner October 3, 2024 08:13

github-actions bot added the Libraries: Out of sync label Oct 3, 2024

arturo-seijas reviewed Oct 3, 2024

View reviewed changes

docs/reference/cryptographic-overview.md Show resolved Hide resolved

chore(): Simplified a little

514725e

erinecon reviewed Oct 3, 2024

View reviewed changes

docs/reference/cryptographic-overview.md Outdated Show resolved Hide resolved

Merge branch 'main' into ISD-2412-SSDLC-Cryptographic-Documentation

84150b2

yanksyoon previously approved these changes Oct 18, 2024

View reviewed changes

docs/reference/cryptographic-overview.md Show resolved Hide resolved

docs/reference/cryptographic-overview.md Show resolved Hide resolved

cbartz reviewed Oct 18, 2024

View reviewed changes

alithethird added 2 commits October 18, 2024 12:58

chore(docs): Addressed comments

3b229be

Merge branch 'ISD-2412-SSDLC-Cryptographic-Documentation' of github.c…

f4e275f

…om:canonical/github-runner-operator into ISD-2412-SSDLC-Cryptographic-Documentation

alithethird dismissed yanksyoon’s stale review via f4e275f October 18, 2024 09:58

alithethird requested review from cbartz, yanksyoon, erinecon and arturo-seijas October 18, 2024 09:58

cbartz reviewed Oct 18, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(docs): Created `GitHub runner cryptographic overview` #386

chore(docs): Created `GitHub runner cryptographic overview` #386

alithethird commented Oct 3, 2024

github-actions bot commented Oct 3, 2024

yanksyoon left a comment

cbartz left a comment

cbartz Oct 18, 2024

cbartz Oct 18, 2024

cbartz left a comment

cbartz Oct 18, 2024

cbartz Oct 18, 2024

cbartz Oct 18, 2024


		Images that run in the OpenStack vm are built using the [Image Builder Charm](https://github.com/canonical/github-runner-image-builder-operator). This charm needs to download the runner binary, cloud image to base the image on and yq. All these images are downloaded with TLS.
		Images that run in the OpenStack vm are built using the [Image Builder](https://github.com/canonical/github-runner-image-builder-operator). This application needs to download the runner binary, yq and the cloud image to base the image on. All these images are downloaded with TLS.

chore(docs): Created GitHub runner cryptographic overview #386

Are you sure you want to change the base?

chore(docs): Created GitHub runner cryptographic overview #386

Conversation

alithethird commented Oct 3, 2024

Overview

Rationale

Juju Events Changes

Module Changes

Library Changes

Checklist

github-actions bot commented Oct 3, 2024

yanksyoon left a comment

Choose a reason for hiding this comment

cbartz left a comment

Choose a reason for hiding this comment

cbartz Oct 18, 2024

Choose a reason for hiding this comment

cbartz Oct 18, 2024

Choose a reason for hiding this comment

cbartz left a comment

Choose a reason for hiding this comment

cbartz Oct 18, 2024

Choose a reason for hiding this comment

cbartz Oct 18, 2024

Choose a reason for hiding this comment

cbartz Oct 18, 2024

Choose a reason for hiding this comment

chore(docs): Created `GitHub runner cryptographic overview` #386

chore(docs): Created `GitHub runner cryptographic overview` #386