-
Notifications
You must be signed in to change notification settings - Fork 69
Issue #52, There is a real binary distribution trust issue. #55
Comments
Note that I proposed to consider moving my actions under the ruby organization in #44 (comment) but it seems there was no interest. @bryanmacfarlane BTW, I think there was no need to lock #52 (comment). Closing would be enough. |
@MSP-Greg - yes, that's the crux of the issue. Right now, our actions/setup-xxx actions (1) resolve to what's on the virtual-environments VM or (2) optionally pull from a trusted binary distribution if the version spec cannot be satisfied by the VM image. For example, if you look at setup-node action, it pulls from the official node dist. The same one users acquire node from. It's trusted. The comment and other discussions here was referring to an individual repo with a release distributed by an individual user. Note ruby-build is a build solution, not a trusted distribution. The virtual-environments team is building a tool cache of built rubies and I believe they are planning on open sourcing it. I referred to this in the ADR . I'm discussing with that team how we could consume the same store of binaries. The vm gen and this action should pull from the same trusted store. So the problem is not just with this action. |
Coming up with a common way to consume prebuilt binaries should occur in the ADR instead of various issues: #49 |
Thanks @MSP-Greg! Let's iterate on the ADR ☝️ and also in actions/runner-images#281 Since the VM team is iterating on building a cache of images relevant to their VM environments, I think that's an interesting path to pursue. I'll update the ADR with details around that option. I met with them this week to understand where that is heading. More in the ADR soon. Closing this for now but let me know if there's anything else I can answer. |
@bryanmacfarlane I saw this comment at #52 (comment)
I know it been 3 days since you made it, so maybe your understanding has changed since, but if not, I just want to reiterate that I think specific versions should be your top priority, if you want to attract adoption of GitHub Actions as CI for Ruby projects and applications. I understand you are working on it and you have your process for it, and hopefully you can get it done sooner rather than later. |
@bryanmacfarlane @ethomson
'There is a real binary distribution trust issue.'
That seems to be the main issue here, and ruby/ruby has never released binaries. Obviously, other languages have, but there's also several copies of OpenSSL binaries on the Windows image because OpenSSL doesn't release binaries. To my knowledge, for some of the builds one cannot even get to the build code or a log of the build behind an https CI system.
So, GH wants 'binary distribution trust', but it doesn't want to host the binaries themselves.
I think there needs to be another solution.
The build system (rbenv/ruby-build) used by use-ruby-action has a few maintainers that are GH staff.
If a repo/org account was started that was more of a 'collective' of people, could it create and host the binary builds? Not part of GH, but 'approved' by GH? Certainly could contain whatever 'due diligence, but if you really want secure' language as needed...
The text was updated successfully, but these errors were encountered: