Skip to content

Commit d4b9b8f

Browse files
mpdudempdude
authored
Stop adding GitHub SSH keys (#171)
We need to fix the SSH keys shipped with this action: https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ But, we have another issue (#108) with regards to host keys: On self-hosted runners which are not ephemeral the known_host file fills up with repeated entries, because every action run adds a new line with the same host keys. Also, on those machines, the old key will still be in the `known_hosts` file. IMHO this action should not be repsonsible for shipping SSH host keys, that's too much responsibility. This section in the code is a leftover from early days when GitHub provided runners did not include SSH keys at all. For a long time already, GH takes care of placing their SSH keys in their runner images. For self-hosted runners, those people setting up the runner should fetch and verify SSH keys themselves and put it into the `known_hosts` file. I know this is a breaking change and is going to annoy users. But on the other hand, there is no better opportunity to drop this feature than with an emergency-style key revocation as today. Closes #106, closes #129, closes #169, closes #170, closes #172.
1 parent ea17a05 commit d4b9b8f

File tree

4 files changed

+73
-55
lines changed

4 files changed

+73
-55
lines changed

Diff for: ‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -272,4 +272,4 @@ developer looking for new challenges, we'd like to hear from you!
272272
- <https://www.webfactory.de>
273273
- <https://twitter.com/webfactory>
274274

275-
Copyright 2019 – 2022 webfactory GmbH, Bonn. Code released under [the MIT license](LICENSE).
275+
Copyright 2019 – 2023 webfactory GmbH, Bonn. Code released under [the MIT license](LICENSE).

Diff for: ‎dist/cleanup.js

+36-21
Original file line numberDiff line numberDiff line change
@@ -292,13 +292,14 @@ var __importStar = (this && this.__importStar) || function (mod) {
292292
return result;
293293
};
294294
Object.defineProperty(exports, "__esModule", { value: true });
295-
exports.issueCommand = void 0;
295+
exports.prepareKeyValueMessage = exports.issueFileCommand = void 0;
296296
// We use any as a valid input type
297297
/* eslint-disable @typescript-eslint/no-explicit-any */
298298
const fs = __importStar(__webpack_require__(747));
299299
const os = __importStar(__webpack_require__(87));
300+
const uuid_1 = __webpack_require__(62);
300301
const utils_1 = __webpack_require__(82);
301-
function issueCommand(command, message) {
302+
function issueFileCommand(command, message) {
302303
const filePath = process.env[`GITHUB_${command}`];
303304
if (!filePath) {
304305
throw new Error(`Unable to find environment variable for file command ${command}`);
@@ -310,7 +311,22 @@ function issueCommand(command, message) {
310311
encoding: 'utf8'
311312
});
312313
}
313-
exports.issueCommand = issueCommand;
314+
exports.issueFileCommand = issueFileCommand;
315+
function prepareKeyValueMessage(key, value) {
316+
const delimiter = `ghadelimiter_${uuid_1.v4()}`;
317+
const convertedValue = utils_1.toCommandValue(value);
318+
// These should realistically never happen, but just in case someone finds a
319+
// way to exploit uuid generation let's not allow keys or values that contain
320+
// the delimiter.
321+
if (key.includes(delimiter)) {
322+
throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`);
323+
}
324+
if (convertedValue.includes(delimiter)) {
325+
throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
326+
}
327+
return `${key}<<${delimiter}${os.EOL}${convertedValue}${os.EOL}${delimiter}`;
328+
}
329+
exports.prepareKeyValueMessage = prepareKeyValueMessage;
314330
//# sourceMappingURL=file-command.js.map
315331

316332
/***/ }),
@@ -1668,7 +1684,6 @@ const file_command_1 = __webpack_require__(102);
16681684
const utils_1 = __webpack_require__(82);
16691685
const os = __importStar(__webpack_require__(87));
16701686
const path = __importStar(__webpack_require__(622));
1671-
const uuid_1 = __webpack_require__(62);
16721687
const oidc_utils_1 = __webpack_require__(742);
16731688
/**
16741689
* The code to exit an action
@@ -1698,20 +1713,9 @@ function exportVariable(name, val) {
16981713
process.env[name] = convertedVal;
16991714
const filePath = process.env['GITHUB_ENV'] || '';
17001715
if (filePath) {
1701-
const delimiter = `ghadelimiter_${uuid_1.v4()}`;
1702-
// These should realistically never happen, but just in case someone finds a way to exploit uuid generation let's not allow keys or values that contain the delimiter.
1703-
if (name.includes(delimiter)) {
1704-
throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`);
1705-
}
1706-
if (convertedVal.includes(delimiter)) {
1707-
throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
1708-
}
1709-
const commandValue = `${name}<<${delimiter}${os.EOL}${convertedVal}${os.EOL}${delimiter}`;
1710-
file_command_1.issueCommand('ENV', commandValue);
1711-
}
1712-
else {
1713-
command_1.issueCommand('set-env', { name }, convertedVal);
1716+
return file_command_1.issueFileCommand('ENV', file_command_1.prepareKeyValueMessage(name, val));
17141717
}
1718+
command_1.issueCommand('set-env', { name }, convertedVal);
17151719
}
17161720
exports.exportVariable = exportVariable;
17171721
/**
@@ -1729,7 +1733,7 @@ exports.setSecret = setSecret;
17291733
function addPath(inputPath) {
17301734
const filePath = process.env['GITHUB_PATH'] || '';
17311735
if (filePath) {
1732-
file_command_1.issueCommand('PATH', inputPath);
1736+
file_command_1.issueFileCommand('PATH', inputPath);
17331737
}
17341738
else {
17351739
command_1.issueCommand('add-path', {}, inputPath);
@@ -1769,7 +1773,10 @@ function getMultilineInput(name, options) {
17691773
const inputs = getInput(name, options)
17701774
.split('\n')
17711775
.filter(x => x !== '');
1772-
return inputs;
1776+
if (options && options.trimWhitespace === false) {
1777+
return inputs;
1778+
}
1779+
return inputs.map(input => input.trim());
17731780
}
17741781
exports.getMultilineInput = getMultilineInput;
17751782
/**
@@ -1802,8 +1809,12 @@ exports.getBooleanInput = getBooleanInput;
18021809
*/
18031810
// eslint-disable-next-line @typescript-eslint/no-explicit-any
18041811
function setOutput(name, value) {
1812+
const filePath = process.env['GITHUB_OUTPUT'] || '';
1813+
if (filePath) {
1814+
return file_command_1.issueFileCommand('OUTPUT', file_command_1.prepareKeyValueMessage(name, value));
1815+
}
18051816
process.stdout.write(os.EOL);
1806-
command_1.issueCommand('set-output', { name }, value);
1817+
command_1.issueCommand('set-output', { name }, utils_1.toCommandValue(value));
18071818
}
18081819
exports.setOutput = setOutput;
18091820
/**
@@ -1932,7 +1943,11 @@ exports.group = group;
19321943
*/
19331944
// eslint-disable-next-line @typescript-eslint/no-explicit-any
19341945
function saveState(name, value) {
1935-
command_1.issueCommand('save-state', { name }, value);
1946+
const filePath = process.env['GITHUB_STATE'] || '';
1947+
if (filePath) {
1948+
return file_command_1.issueFileCommand('STATE', file_command_1.prepareKeyValueMessage(name, value));
1949+
}
1950+
command_1.issueCommand('save-state', { name }, utils_1.toCommandValue(value));
19361951
}
19371952
exports.saveState = saveState;
19381953
/**

Diff for: ‎dist/index.js

+36-27
Original file line numberDiff line numberDiff line change
@@ -292,13 +292,14 @@ var __importStar = (this && this.__importStar) || function (mod) {
292292
return result;
293293
};
294294
Object.defineProperty(exports, "__esModule", { value: true });
295-
exports.issueCommand = void 0;
295+
exports.prepareKeyValueMessage = exports.issueFileCommand = void 0;
296296
// We use any as a valid input type
297297
/* eslint-disable @typescript-eslint/no-explicit-any */
298298
const fs = __importStar(__webpack_require__(747));
299299
const os = __importStar(__webpack_require__(87));
300+
const uuid_1 = __webpack_require__(62);
300301
const utils_1 = __webpack_require__(82);
301-
function issueCommand(command, message) {
302+
function issueFileCommand(command, message) {
302303
const filePath = process.env[`GITHUB_${command}`];
303304
if (!filePath) {
304305
throw new Error(`Unable to find environment variable for file command ${command}`);
@@ -310,7 +311,22 @@ function issueCommand(command, message) {
310311
encoding: 'utf8'
311312
});
312313
}
313-
exports.issueCommand = issueCommand;
314+
exports.issueFileCommand = issueFileCommand;
315+
function prepareKeyValueMessage(key, value) {
316+
const delimiter = `ghadelimiter_${uuid_1.v4()}`;
317+
const convertedValue = utils_1.toCommandValue(value);
318+
// These should realistically never happen, but just in case someone finds a
319+
// way to exploit uuid generation let's not allow keys or values that contain
320+
// the delimiter.
321+
if (key.includes(delimiter)) {
322+
throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`);
323+
}
324+
if (convertedValue.includes(delimiter)) {
325+
throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
326+
}
327+
return `${key}<<${delimiter}${os.EOL}${convertedValue}${os.EOL}${delimiter}`;
328+
}
329+
exports.prepareKeyValueMessage = prepareKeyValueMessage;
314330
//# sourceMappingURL=file-command.js.map
315331

316332
/***/ }),
@@ -343,13 +359,7 @@ try {
343359
}
344360

345361
const homeSsh = homePath + '/.ssh';
346-
347-
console.log(`Adding GitHub.com keys to ${homeSsh}/known_hosts`);
348-
349362
fs.mkdirSync(homeSsh, { recursive: true });
350-
fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=\n');
351-
fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl\n');
352-
fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==\n');
353363

354364
console.log("Starting ssh-agent");
355365

@@ -1755,7 +1765,6 @@ const file_command_1 = __webpack_require__(102);
17551765
const utils_1 = __webpack_require__(82);
17561766
const os = __importStar(__webpack_require__(87));
17571767
const path = __importStar(__webpack_require__(622));
1758-
const uuid_1 = __webpack_require__(62);
17591768
const oidc_utils_1 = __webpack_require__(742);
17601769
/**
17611770
* The code to exit an action
@@ -1785,20 +1794,9 @@ function exportVariable(name, val) {
17851794
process.env[name] = convertedVal;
17861795
const filePath = process.env['GITHUB_ENV'] || '';
17871796
if (filePath) {
1788-
const delimiter = `ghadelimiter_${uuid_1.v4()}`;
1789-
// These should realistically never happen, but just in case someone finds a way to exploit uuid generation let's not allow keys or values that contain the delimiter.
1790-
if (name.includes(delimiter)) {
1791-
throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`);
1792-
}
1793-
if (convertedVal.includes(delimiter)) {
1794-
throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
1795-
}
1796-
const commandValue = `${name}<<${delimiter}${os.EOL}${convertedVal}${os.EOL}${delimiter}`;
1797-
file_command_1.issueCommand('ENV', commandValue);
1798-
}
1799-
else {
1800-
command_1.issueCommand('set-env', { name }, convertedVal);
1797+
return file_command_1.issueFileCommand('ENV', file_command_1.prepareKeyValueMessage(name, val));
18011798
}
1799+
command_1.issueCommand('set-env', { name }, convertedVal);
18021800
}
18031801
exports.exportVariable = exportVariable;
18041802
/**
@@ -1816,7 +1814,7 @@ exports.setSecret = setSecret;
18161814
function addPath(inputPath) {
18171815
const filePath = process.env['GITHUB_PATH'] || '';
18181816
if (filePath) {
1819-
file_command_1.issueCommand('PATH', inputPath);
1817+
file_command_1.issueFileCommand('PATH', inputPath);
18201818
}
18211819
else {
18221820
command_1.issueCommand('add-path', {}, inputPath);
@@ -1856,7 +1854,10 @@ function getMultilineInput(name, options) {
18561854
const inputs = getInput(name, options)
18571855
.split('\n')
18581856
.filter(x => x !== '');
1859-
return inputs;
1857+
if (options && options.trimWhitespace === false) {
1858+
return inputs;
1859+
}
1860+
return inputs.map(input => input.trim());
18601861
}
18611862
exports.getMultilineInput = getMultilineInput;
18621863
/**
@@ -1889,8 +1890,12 @@ exports.getBooleanInput = getBooleanInput;
18891890
*/
18901891
// eslint-disable-next-line @typescript-eslint/no-explicit-any
18911892
function setOutput(name, value) {
1893+
const filePath = process.env['GITHUB_OUTPUT'] || '';
1894+
if (filePath) {
1895+
return file_command_1.issueFileCommand('OUTPUT', file_command_1.prepareKeyValueMessage(name, value));
1896+
}
18921897
process.stdout.write(os.EOL);
1893-
command_1.issueCommand('set-output', { name }, value);
1898+
command_1.issueCommand('set-output', { name }, utils_1.toCommandValue(value));
18941899
}
18951900
exports.setOutput = setOutput;
18961901
/**
@@ -2019,7 +2024,11 @@ exports.group = group;
20192024
*/
20202025
// eslint-disable-next-line @typescript-eslint/no-explicit-any
20212026
function saveState(name, value) {
2022-
command_1.issueCommand('save-state', { name }, value);
2027+
const filePath = process.env['GITHUB_STATE'] || '';
2028+
if (filePath) {
2029+
return file_command_1.issueFileCommand('STATE', file_command_1.prepareKeyValueMessage(name, value));
2030+
}
2031+
command_1.issueCommand('save-state', { name }, utils_1.toCommandValue(value));
20232032
}
20242033
exports.saveState = saveState;
20252034
/**

Diff for: ‎index.js

-6
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,7 @@ try {
2323
}
2424

2525
const homeSsh = homePath + '/.ssh';
26-
27-
console.log(`Adding GitHub.com keys to ${homeSsh}/known_hosts`);
28-
2926
fs.mkdirSync(homeSsh, { recursive: true });
30-
fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=\n');
31-
fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl\n');
32-
fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==\n');
3327

3428
console.log("Starting ssh-agent");
3529

0 commit comments

Comments
 (0)