Project

General

Profile

Actions
Copy link

action #160334

open

openQA Project (public) - coordination #105624: [saga][epic] Reconsider how openQA handles secrets

[qe-core] Add CI/CD check to avoid uses of nots3cr3t or other hardcoded password in pull requests

Added by szarate 9 months ago. Updated 1 day ago.

Status:
In Progress
Priority:
Normal
Assignee:
tinawang123
Category:
Infrastructure
Target version:
QA (public) - QE-Core: Ready
Start date:
2024-09-06
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
Difficulty:
Sprint:
QE-Core: February Sprint 25 (Feb 03 - Feb 28)
Tags:
security, password

Description

Motivation

In https://sd.suse.com/servicedesk/customer/portal/1/SD-150437 we are asked to handle "compromised root passwords in QA segments"

This will not stop somebody from adding a different password though, so we need to think a bit before working on this, however we can start with using it on the data directory first.

Subtasks 1 (0 open — 1 closed)

action #166439: [qe-core] Remove hardcode password on the data directoryResolvedtinawang1232024-09-06

Actions

Related issues 3 (2 open — 1 closed)

Related to openQA Tests (public) - coordination #96596: [qe-core][CI] CI/CD and Coding style improvementsFeedbackmgrifalconi2019-12-11

Actions
Related to openQA Tests (public) - action #160325: [qe-core] Use templating system in autoyast profiles to use testapi::$password instead of nots3cr3tResolvedrfan12024-05-14

Actions
Related to openQA Tests (public) - action #173938: Remove hardcode password for wsl/Autounattend_BIOS.xml and wsl/Autounattend_UEFI.xmlNewpherranz2024-12-09

Actions
Actions
Copy link
 #1

Updated by szarate 9 months ago

Actions
Copy link
 #2

Updated by szarate 9 months ago

  • Related to action #160325: [qe-core] Use templating system in autoyast profiles to use testapi::$password instead of nots3cr3t added
Actions
Copy link
 #3

Updated by szarate 9 months ago

  • Sprint set to QE-Core: May Sprint 25 (May 07 - Jun 04)
Actions
Copy link
 #4

Updated by szarate 8 months ago

  • Status changed from New to In Progress
Actions
Copy link
 #5

Updated by szarate 8 months ago

  • Status changed from In Progress to Workable
Actions
Copy link
 #6

Updated by szarate 8 months ago

  • Priority changed from Normal to Low
Actions
Copy link
 #7

Updated by szarate 6 months ago

  • Sprint changed from QE-Core: May Sprint 24 (May 07 - Jun 04) to QE-Core: August Sprint 24 (Aug 14 - Aug 28)
Actions
Copy link
 #8

Updated by tinawang123 5 months ago

  • Status changed from Workable to In Progress
  • Assignee set to tinawang123
Actions
Copy link
 #9

Updated by szarate 5 months ago

  • Sprint changed from QE-Core: August Sprint 24 (Aug 14 - Aug 28) to QE-Core: September Sprint 24 (Sep 05 - Oct 03)
Actions
Copy link
 #11

Updated by tinawang123 5 months ago

  • Subtask #166439 added
Actions
Copy link
 #12

Updated by tinawang123 5 months ago

  • Status changed from In Progress to Blocked

Need remove passwords on data folder first.
Blocked by ticket: https://progress.opensuse.org/issues/166439

Actions
Copy link
 #14

Updated by JERiveraMoya 3 months ago

Please don't forget to provide a way to disable the check in the CI for some specific folder for example, so testing for agama will not be stopped, at the moment there is no way to set encrypted password in profiles: https://progress.opensuse.org/issues/168853 is work in progress:

Actions
Copy link
 #15

Updated by szarate 3 months ago

  • Sprint changed from QE-Core: September Sprint 24 (Sep 05 - Oct 03) to QE-Core: November Sprint 24 (Nov 06 - Dec 04)
Actions
Copy link
 #16

Updated by tinawang123 2 months ago

Only two files include the hardcode password:
yutao-qa1:/var/lib/openqa/tests/sle # grep -r 'nots3cr3t' data/*
data/wsl/Autounattend_BIOS.xml: nots3cr3t
data/wsl/Autounattend_UEFI.xml: nots3cr3t

Actions
Copy link
 #17

Updated by tinawang123 2 months ago

  • Related to action #173938: Remove hardcode password for wsl/Autounattend_BIOS.xml and wsl/Autounattend_UEFI.xml added
Actions
Copy link
 #18

Updated by mgrifalconi about 1 month ago

  • Sprint changed from QE-Core: November Sprint 24 (Nov 06 - Dec 04) to QE-Core: January Sprint 25 (Jan 09 - Feb 04)
  • Tags changed from password, security, qe-core-may-sprint, qe-core-august-sprint to password, security
Actions
Copy link
 #19

Updated by mgrifalconi 5 days ago

  • Sprint changed from QE-Core: January Sprint 25 (Jan 09 - Jan 31) to QE-Core: February Sprint 25 (Feb 03 - Feb 28)
  • Status changed from Blocked to Workable
Actions
Copy link
 #20

Updated by tinawang123 1 day ago

https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/21136
Have ignored some files still include plain password on data directory.

Actions
Copy link
 #21

Updated by tinawang123 1 day ago

  • Status changed from Workable to In Progress
Actions
Copy link

Also available in: Atom PDF