One passphrase-less key signs ISOs and the pacman repo on a privileged self-hosted runner

Breadway commented

2026-09-26 07:28:38 +08:00

Owner

Problem

GPG_PRIVATE_KEY (no passphrase) is imported by both release-iso.yml and signed-repo.yml. The ISO job runs --privileged --network=host on a self-hosted runner. A compromise of that runner (or of any workflow that can read the secret) gives an attacker signed pacman updates, which every BOS install trusts with lsign (full trust), plus signed ISOs.

Fix

Split into separate keys: an ISO-release key and a repo key, each with a narrow purpose (release key = SHA256SUMS only).
Keep the repo signing key off the ISO runner. Sign on a separate, non-privileged job or runner, or use a hardware-backed/offline signing step.
Give the key an expiry and document rotation in docs/signed-repo.md.
Restrict which workflows and branches can access the secret (Forgejo secret scoping, or a protected-branch-only environment).

Acceptance

There are two fingerprints in the docs, the installed system trusts only the repo key for [breadway], and the ISO workflow can't read the repo key.

Source: BOS v0.6.2 source review (tag dated 2026-09-19). Read AGENTS.md first. One issue per branch/PR.

## Problem `GPG_PRIVATE_KEY` (no passphrase) is imported by both `release-iso.yml` and `signed-repo.yml`. The ISO job runs `--privileged --network=host` on a self-hosted runner. A compromise of that runner (or of any workflow that can read the secret) gives an attacker signed pacman updates, which every BOS install trusts with `lsign` (full trust), plus signed ISOs. ## Fix - Split into separate keys: an ISO-release key and a repo key, each with a narrow purpose (release key = SHA256SUMS only). - Keep the repo signing key off the ISO runner. Sign on a separate, non-privileged job or runner, or use a hardware-backed/offline signing step. - Give the key an expiry and document rotation in `docs/signed-repo.md`. - Restrict which workflows and branches can access the secret (Forgejo secret scoping, or a protected-branch-only environment). ## Acceptance There are two fingerprints in the docs, the installed system trusts only the repo key for `[breadway]`, and the ISO workflow can't read the repo key. --- Source: BOS v0.6.2 source review (tag dated 2026-09-19). Read AGENTS.md first. One issue per branch/PR.

Breadway added the

labels

2026-09-26 07:28:38 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-09-30 18:58:06 +08:00

Isolate BOS signing from privileged Actions runners #75

Breadway commented

2026-09-30 18:58:09 +08:00

Author

Owner

PR: #75

Prepared signing isolation in an isolated branch. Actions has no signing-key references and creates unsigned ISO drafts/repository artifacts. Offline scripts require pinned, expiring identities, reject the shared identity for new ISO checksums, and refuse Actions environments. Real throwaway-key ISO and pacman package/database signatures, tamper/checksum-list rejection, YAML/shell syntax and diff checks pass.

This is a reviewable migration, not an activated production trust change. Before adoption, independently provision the new ISO public key/fingerprint, move repository private material to a non-runner host, remove the old shared secret everywhere, and approve candidate publication. The docs explicitly record the missing second fingerprint and activation gate. Actual configs, desktop and live signing material were untouched.

PR: https://git.breadway.dev/Breadway/bos/pulls/75 Prepared signing isolation in an isolated branch. Actions has no signing-key references and creates unsigned ISO drafts/repository artifacts. Offline scripts require pinned, expiring identities, reject the shared identity for new ISO checksums, and refuse Actions environments. Real throwaway-key ISO and pacman package/database signatures, tamper/checksum-list rejection, YAML/shell syntax and diff checks pass. This is a reviewable migration, not an activated production trust change. Before adoption, independently provision the new ISO public key/fingerprint, move repository private material to a non-runner host, remove the old shared secret everywhere, and approve candidate publication. The docs explicitly record the missing second fingerprint and activation gate. Actual configs, desktop and live signing material were untouched.

Breadway commented

2026-09-30 23:57:43 +08:00

Author

Owner

Independent source and isolated integration review PASS at 1c6e242f6e. Offline signing tests independently verify distinct expiring temporary identities, ISO checksum-only signing, tamper rejection, signed pacman packages/database, and Actions refusal. Reviewed and requested removal of mutable draft rebuilds; revised workflow refuses all existing candidates and checks draft state before each fresh upload. Mocked workflow checks confirm existing tags and API failures cause no mutation, fresh candidates upload exactly two assets, and a changed draft state stops the next upload. YAML, every workflow shell block, signing Python/shell and diff checks pass. No configured CI statuses.

This is a reviewed migration implementation, with production activation outstanding. The second ISO public fingerprint is not provisioned; private material relocation, deletion of old Actions secrets, protected policy/source, provenance approval and publication exclusion remain required as explicitly documented. No production keys or trust were changed, and this review does not claim the security migration is activated.
PR: #75

Independent source and isolated integration review PASS at 1c6e242f6e0aa6301d382edb18a84a4519e6e43a. Offline signing tests independently verify distinct expiring temporary identities, ISO checksum-only signing, tamper rejection, signed pacman packages/database, and Actions refusal. Reviewed and requested removal of mutable draft rebuilds; revised workflow refuses all existing candidates and checks draft state before each fresh upload. Mocked workflow checks confirm existing tags and API failures cause no mutation, fresh candidates upload exactly two assets, and a changed draft state stops the next upload. YAML, every workflow shell block, signing Python/shell and diff checks pass. No configured CI statuses. This is a reviewed migration implementation, with production activation outstanding. The second ISO public fingerprint is not provisioned; private material relocation, deletion of old Actions secrets, protected policy/source, provenance approval and publication exclusion remain required as explicitly documented. No production keys or trust were changed, and this review does not claim the security migration is activated. PR: https://git.breadway.dev/Breadway/bos/pulls/75

Breadway commented

2026-09-30 23:59:30 +08:00

Author

Owner

Review rework is on the same PR #75 at 1c6e242. ISO candidates are now immutable: any existing release or draft for the tag refuses all mutation, each new upload rechecks draft state, and offline signer/publication activity must wait for a successful completed build with an exclusive handoff. This removes stale-signature replacement paths. The inventory labels private-key placement as the intended activation target, not current deployed state. Workflow YAML/shell and diff checks pass; no production material or config was touched.

Review rework is on the same PR #75 at 1c6e242. ISO candidates are now immutable: any existing release or draft for the tag refuses all mutation, each new upload rechecks draft state, and offline signer/publication activity must wait for a successful completed build with an exclusive handoff. This removes stale-signature replacement paths. The inventory labels private-key placement as the intended activation target, not current deployed state. Workflow YAML/shell and diff checks pass; no production material or config was touched.

Breadway commented

2026-10-01 00:01:08 +08:00

Author

Owner

Read-only activation audit after independent code review: BOS repository secret-name metadata still contains GPG_PRIVATE_KEY, and its branch-protection API currently returns no rules. Existing ISO/repository public files still contain the shared fingerprint 56203B86A110695AE7F310934AF3323D678EB5E2 (expires 2028-07-03). No secret values were read and no production setting was changed.

PR #75 at 1c6e242 is accepted as reviewable code migration, but actual issue acceptance remains pending: provision and review a distinct expiring ISO public key/fingerprint, isolate private signing material on non-runner hosts, remove the former shared secret from all applicable stores/runners, activate reviewed-main protection, and verify an approved candidate. Keep the issue open until those gates are verified.

Read-only activation audit after independent code review: BOS repository secret-name metadata still contains GPG_PRIVATE_KEY, and its branch-protection API currently returns no rules. Existing ISO/repository public files still contain the shared fingerprint 56203B86A110695AE7F310934AF3323D678EB5E2 (expires 2028-07-03). No secret values were read and no production setting was changed. PR #75 at 1c6e242 is accepted as reviewable code migration, but actual issue acceptance remains pending: provision and review a distinct expiring ISO public key/fingerprint, isolate private signing material on non-runner hosts, remove the former shared secret from all applicable stores/runners, activate reviewed-main protection, and verify an approved candidate. Keep the issue open until those gates are verified.

Breadway closed this issue

2026-10-02 14:34:11 +08:00

Rows
Columns

One passphrase-less key signs ISOs and the pacman repo on a privileged self-hosted runner #39

Problem

Fix

Acceptance