Travis Response to Meltdown Attack

blog.travis-ci.com

3 pointsedmorley1 comment

Even disregarding CPU bugs, Travis CI is a security disaster. Keep your secrets far away from it.

* They use 32-bit id to retrieve an OpenPGP key (meaning that anybody can get their key added to the APT keyring):

* Here they are identifying OpenPGP keys with HTTP URLs (sometimes with 32-bit id, too):

* But none of the above matters much, because they use APT with the --force-yes, which among other things, disables package authentication:

[I reported the --force-yes bug to the security team in October 2017, but AFAICS nothing changed nice then.]

* https://github.com/travis-ci/apt-package-whitelist is just bizarre. They try to to detect "malicious or goofy bits" with grep. What.

And these are just things I stumbled upon randomly...

If you're using Travis CI only for testing stuff, you should be fine. If you're using it for deployment, you're doing it wrong.