news.volyx.in

Open source security at Astral (astral.sh)

365 points by vinhnx · 144 days ago · 109 comments on HN

Article summary

Astral, a company that builds tools used by millions of developers, has shared its techniques for securing its tools and CI/CD processes. The company uses GitHub Actions, but notes that it has poor security defaults, and has implemented various measures to secure its workflows, such as forbidding certain triggers and requiring actions to be pinned to specific commits. Astral also limits workflow and job permissions, isolates secrets, and enforces branch and tag protection rules. The company hopes that sharing its techniques will be useful to other maintainers, projects, and companies.

Main themes

  • CI/CD security
  • Supply chain attacks
  • GitHub Actions
  • Security best practices
  • Open source security
  • Dependency management

What commenters say

  • The recent incidents affecting Trivy and LitLLM highlight the importance of securing the release process, and Astral's guide provides solid and actionable advice.
  • Nix and other declarative build systems can provide reproducible builds, but may not be widely adopted due to their complexity and niche user base.
  • Some commenters argue that the open source ecosystem is resilient, but still needs to improve its tools and practices for sandboxing third-party code.
  • Others believe that unpaid volunteer hackers are putting more effort into supply chain security than some companies, and that this is a problem with the current state of open source software.
  • There is a debate about the effectiveness of permissive licenses, with some arguing that they allow companies to exploit free work, while others see them as a way to improve things and make code available to anyone.
  • Some commenters are skeptical of the ability of companies like GitHub to provide secure platforms, citing bugs and compromises, and argue that dependence on a single platform is a risk.
  • Others argue that the benefits of using tools like uv and GitHub Actions outweigh the risks, and that with proper configuration and security measures, they can be used safely.
  • There is a concern that the lack of funding and support for open source projects and maintainers is a major issue, and that this can lead to security vulnerabilities and other problems.