April 2021 Summaries

Harness is a Continuous Deployment platform that allows automating the deployment of software to infrastructure and environments. To set up a private Cloudsmith repository as an artifact source for a Harness pipeline, users log into the Harness Manager, navigate to "Setup", and configure the Cloud Provider, Connectors, and Applications. The user adds their Cloudsmith registry URL, username, encrypted password, and Cloudsmith API key as an encrypted secret. They define an Application with Services, Environments, Workflows, Pipelines, Triggers, and Infrastructure Provisioners, including deploying a docker image to AWS ECS. After creating a pipeline that runs a workflow, the user pushes a docker image to their Cloudsmith repository and sets up a trigger to start the pipeline when a new artifact is pushed. Once the pipeline executes, it deploys the docker image to AWS ECS successfully.

Continuous Packaging is a software development practice that involves packaging source code, dependencies, and containers into logical, versioned units for enhanced security in cloud-based supply chains. This approach requires a significant refresh of how engineers package their software, particularly in light of the growing importance of security in 2021. Continuous Packaging offers on-demand delivery, enabling developers to secure their delivery pipelines from development through to deployment.

Harness CD is used to deploy a Docker image from a private Cloudsmith repository to an AWS ECS cluster. The deployment process involves creating a pipeline in Harness CD, which automates the build and deployment of the Docker image. The pipeline uses the Cloudsmith API to retrieve the Docker image from the private repository and then deploys it to the AWS ECS cluster. This allows developers to automate their CI/CD pipelines and deploy their applications quickly and efficiently.

The Codecov software auditing tool was targeted by malicious actors who inserted malicious code into its bash uploader script, allowing them to scrape environment variables and send them to an unknown third party. The intrusion occurred due to a leaked secret credential in a Docker image creation process, which allowed attackers to update the bash uploader script. This malicious code added a line that sent environment variables to an unknown recipient if the script was run as part of a CI process. Codecov discovered the unauthorized access on April 1st after a customer noticed discrepancies between publicly posted and calculated checksums. The issue highlights the importance of provenance and isolation in ensuring software integrity, particularly in Continuous Packaging environments. Affected users are advised to re-roll credentials, tokens, or keys located in environment variables and perform an audit of their use.

The Drone CI platform is an open-source Continuous Integration tool with a container-first approach, utilizing Docker containers to execute build pipeline steps. The Drone server manages and configures build pipelines and settings, while the drone runners poll the server for pipelines to execute. To integrate Cloudsmith with Drone, users connect their source repositories using OAuth and set up environment variables, including the Cloudsmith API Key and Docker credentials. A `.drone.yml` file is used to define pipeline steps, which can include building and pushing packages to a private Cloudsmith repository. The use of a custom Docker image and environment variables provides a secure and centralized way to manage package builds and deployments.