Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encrypt balenaOS artifacts at rest in GitHub #410

Merged
merged 8 commits into from
Oct 1, 2024
Merged

Encrypt balenaOS artifacts at rest in GitHub #410

merged 8 commits into from
Oct 1, 2024

Commits on Oct 1, 2024

  1. Encrypt balenaOS artifacts at rest in GitHub 

    Applies symmetric encryption (PBKDF2 hardened) to balenaOS
build assets prior to uploading them to GitHub for temporary
storage between builds. Decrypts assets after downloading.

Requires: balena-os/.github#83

change-type: patch
    @ab77 @klutchell
    ab77 authored and klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    116d81b View commit details
    Browse the repository at this point in the history

  2. actionlint/shellcheck

    @ab77 @klutchell
    ab77 authored and klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    de74469 View commit details
    Browse the repository at this point in the history

  3. conditionally entrypt/decrypt

    @ab77 @klutchell
    ab77 authored and klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    1d49530 View commit details
    Browse the repository at this point in the history

  4. Fix check for private repositories 

    Signed-off-by: Kyle Harding <[email protected]>
    @klutchell
    klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    f673834 View commit details
    Browse the repository at this point in the history

  5. Prevent duplicate artifact upload 

    Signed-off-by: Kyle Harding <[email protected]>
    @klutchell
    klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    c098541 View commit details
    Browse the repository at this point in the history

  6. Add openssl verbosity and avoid piping find to xargs 

    Signed-off-by: Kyle Harding <[email protected]>
    @klutchell
    klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    505cabc View commit details
    Browse the repository at this point in the history

  7. Fetch full depth in order to checkout custom meta-balena-refs 

    Change-type: patch
Signed-off-by: Kyle Harding <[email protected]>
    @klutchell
    klutchell committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    e1f1a2f View commit details
    Browse the repository at this point in the history

  8. Only attempt to decrypt if we have encrypted in the build step 

    Change-type: patch
Signed-off-by: Ryan Cooke<[email protected]>
    @rcooke-warwick
    rcooke-warwick committed Oct 1, 2024
    Configuration menu
    Copy the full SHA
    c3d6770 View commit details
    Browse the repository at this point in the history