July 2022 Summaries

GitHub's CODEOWNERS feature allows developers to specify users or teams responsible for certain files in a repository, but misconfigurations can lead to unexpected behavior. This blog post explores various scenarios and their results when using the "Require review from Code Owners" branch protection policy setting. Some key points include: 1. An empty CODEOWNERS file allows any approval by any non-author user with Write permission to merge code into a protected branch, regardless of the "Require review from Code Owners" setting. 2. A misconfigured Team in CODEOWNERS can block merging even if an approver has Write access directly. 3. If a user is assigned as a code owner but does not have effective Write permission, their approval will still count towards the required check to merge code into a protected branch. 4. Assigning Teams instead of users in CODEOWNERS files can prevent misconfigurations when reviewers leave the organization. 5. Using Arnica's solution can help identify and fix misconfigured CODEOWNERS across all organizations for free, regardless of the number of users and repositories scanned.

Maintaining developer access and privileges across code repositories is crucial for ensuring source code security, especially with the rise of cloud-based services like GitHub. Implementing effective strategies such as security scans, archiving, and branch protections are essential to securing your software supply chain. Stale repositories can become a significant security risk due to excessive access permissions and potentially outdated or unknown dependencies. To secure these repositories, companies should activate GitHub's Dependabot security scans, use advanced security scans for code and configurations, archive unused repositories, and enforce branch protections. By addressing the security holes in stale repositories, organizations can improve their overall security posture without impeding developers' day-to-day work.

The text discusses the difference between application security and software supply chain security in the context of a DevOps process. It highlights an example where the author needed a library to parse OpenSSH keys for their free secret scanning service, leading them to conduct an in-depth security review of openssh_key_parser. The author explains how they used static analysis and fuzzing tools to guide manual code review, ultimately discovering a vulnerability that could lead to key leakage if exploited by an attacker who can modify the first field length in the key file or read exception logs. The text emphasizes the importance of paying due care for maintaining open source software and the need for better ways to secure the software supply chain.