Episode 877 transcript

FLOSS-877 Jonathan: Hey folks, this week we're talking with Francois Proulx about smoked meat, and poutine, and Bagel, a trio of open source security tools that you don't wanna pass up on. This is Floss Weekly, episode 877, recorded Tuesday, July the 28th: RCE as a Service.

It's time for Floss Weekly. That's the show about free, libre, and open source software. I'm your host, Jonathan Bennett, and today we're revisiting a topic that we've talked about in the past, and in fact, revisiting a guest. We've got Francois Proulx of Boost Security. These guys are experts in supply chain security, and really one of the main things that we're talking about with this is GitHub CI, continuous integration.

And so a lot of projects will have a CI set up to where you run automated tests on your code changes. Where this can get dangerous is if you allow the outside community, so untrusted people, to make pull requests, and then that CI engine runs against those incoming pull requests. And then you have this kind of strange problem, that you're running untrusted code inside your GitHub repository, and surely that doesn't ever go wrong.

Yes, sometimes it goes wrong. We had Francois on the show about two years ago, and we talked about a project then called Poutine, which was a scanner, an automated scanner to take a look at a project's CI runs, and essentially give you an evaluation. Do we think this is safe or not? And in the time since then surely we've fixed this problem and it doesn't exist anymore, right?

Unfortunately I don't think that's the case. I'm gonna go ahead and bring Francois on. He's the guy that has the answers, and we're gonna find out. So welcome, sir, to the show. It is great to have you back.

Francois: Thank you.

Jonathan: Yeah what, w- what, did I get the problem space right? And then what's changed in the last two years?

Francois: Ver- very good introduction. Yeah, I think you got the, the takeaway from the last discussion, and I guess you, you did your own homework on your own projects and could actually see why the tool was created. Why I created it, why it's a, it's an issue that especially maintainers... this audience is both consumers, like users of open source, as well as maintainers.

Jonathan: Yeah, absolutely.

Francois: For the maintainers, I think my message was that they should give the tool a try so that they can protect their own end users, right?

Jonathan: Yeah, and I think we're probably gonna pitch this in the context of GitHub, but this is not just a GitHub issue, is it? There's there's GitLab, there's Codeberg, there's glued together CI scripts that run on infrastructure that's not any of those three things.

And I imagine you could have problems on any of those contexts, couldn't you?