April 2022 Summaries

GitHub has introduced search-based code navigation for the Elixir programming language, marking the first instance of a language community contributing their own code for such functionality. This initiative aims to provide best-in-class support for all programming languages on GitHub by empowering language communities to integrate with GitHub's code navigation systems. By leveraging Tree-sitter grammar tools, contributors can develop and contribute tag queries that help extract essential information from syntax trees for features like jump-to-definition and find-all-references. GitHub encourages community involvement in this process and provides documentation and examples to assist contributors in developing and testing their implementations. This venture differs from GitHub code search, focusing on enhancing the experience of reading code within individual repositories rather than across the entire platform. GitHub is committed to collaborating with language maintainers and contributors to ensure the continuous improvement and relevance of these navigation tools.

Amidst a rapidly evolving threat landscape, maintaining security for projects is increasingly challenging, particularly with the complexity of dependency management in software projects. Research highlighted in the Octoverse report reveals that while a typical JavaScript project on GitHub directly uses about ten open-source dependencies, it indirectly relies on an average of 683 transitive dependencies, underscoring the importance of automated tools in managing security risks. GitHub offers built-in tools such as the dependency graph and dependency review to help users understand and manage their dependencies, providing insights into vulnerabilities, licenses, and usage. Dependabot further enhances security by automatically monitoring dependency files for outdated requirements, issuing pull requests with suggested fixes, and allowing users to customize notifications for dependency alerts. These features empower developers to address vulnerabilities efficiently, ensuring they work with the most secure and up-to-date software releases.

GitHub Desktop 3.0 introduces significant updates aimed at simplifying version control workflows for developers, with enhanced support for git operations like squashing and reordering commits, and new features that integrate GitHub more closely with local development. This version allows users to view and manage pull request checks directly, and provides notifications only for critical events, reducing unnecessary distractions. The update also improves the process of addressing pull request reviews by notifying users of any comments or requested changes, facilitating quicker responses and enabling smoother collaboration. GitHub Desktop's development is driven by a small team at GitHub, but its open-source nature allows for widespread community contributions, resulting in a robust platform with over 32,000 commits and 1,000 merged pull requests from external contributors.

A friendly fork is a long-term fork of a software repository that complements its upstream repository with customizations aimed at a specific group of users, and it often collaborates with the original project by contributing features back through a process known as upstreaming. Unlike divergent forks, which arise from irreconcilable differences and often lead to significant deviations, friendly forks maintain a cooperative relationship with the upstream repository, facilitating a mutual exchange of features to benefit both user bases. The blog post explores the concept of friendly forks through examples such as git-for-windows/git, microsoft/git, and github/git, each serving unique purposes while maintaining a connection with the original git/git repository. These forks address specific needs—like Windows compatibility, monorepo support, and GitHub's infrastructure requirements—while also acting as testing grounds for new features before they are considered for upstream integration. The post emphasizes that friendly forks can be public or private, with private forks offering organizations a controlled environment to develop and test new features independently of the upstream release schedule.

The ZX Spectrum, affectionately known as "Speccy," celebrates its 40th anniversary, showcasing a vibrant community dedicated to preserving and innovating its legacy. Enthusiasts continue to create and share new content, from emulators like Rustzx and JSSpeccy 3 to development tools such as DeZog for Z80 assembly. Projects like SkoolKit aid in disassembling Spectrum software, while Txtools and zx-spec enhance file processing and testing capabilities. The Spectrum's influence extends into music composition with tools like fluidcore and image conversion via Image Spectrumizer. The ZX Spectrum Next, a modern iteration launched in 2017, maintains compatibility with its predecessor and supports new content, exemplified by The Level 9 Compilation of text adventures. A noteworthy initiative for this milestone is the ZX Spectrum 40th Birthday Game Mix Tape, offering 40 new games to benefit the charity Special Effect.

A CVE, or Common Vulnerabilities and Exposures identifier, is a tracking number assigned to security vulnerabilities, aimed at facilitating information search and transparency in software security. Despite misconceptions that CVEs signify serious problems or harm reputations, they are merely identifiers without inherent severity ratings. GitHub Security Lab emphasizes transparency by encouraging the request and publication of CVEs, even for low-severity vulnerabilities, through their Security Advisory system. This approach allows maintainers to provide detailed, authoritative advisories, helping users make informed decisions. CVEs can be contested if incorrectly assigned, but disagreement over severity is not sufficient grounds for contestation. GitHub, as a CVE Numbering Authority, handles CVE requests efficiently, ensuring compliance with CVE Program rules and facilitating accurate vulnerability reporting. Providing comprehensive information about vulnerabilities aids in creating accurate advisories, fostering trust and enabling users to assess risks effectively. Transparency in disclosing potential vulnerabilities is advocated as a means to demonstrate a commitment to security and maintain project credibility.

GitHub offers a range of native tools and features that assist developers in ensuring their code is secure without needing to be security experts. Tools like CodeQL, a static code analysis engine, automate the detection of vulnerabilities in code, while Dependabot helps keep dependencies up to date by scanning for known vulnerabilities and suggesting updates. Additionally, developers can enhance security by using protected branches to control code changes and defining permissions for GitHub Actions to limit access and mitigate risks from bad actors. By leveraging features such as GITHUB_TOKEN, developers can manage authentication securely, ensuring that security becomes an integral, yet unobtrusive part of their development workflow. These tools ensure that developers can maintain fast-paced coding practices while staying ahead in security.

GitHub significantly improved the performance of their pre-receive hooks, which run during every Git push operation, by rewriting them from Ruby to Go. Originally implemented in 2013 within a Ruby on Rails application, the hooks had accumulated numerous dependencies over time, causing slow startup times that affected user experience. Despite attempts to optimize within the existing framework, a more substantial improvement was achieved by extracting and rewriting the hooks in Go, reducing the median execution time from 880 milliseconds to just 10 milliseconds. This rewrite not only enhances user experience by speeding up push operations but also represents an architectural shift towards a more efficient service design. The change has been successfully implemented on GitHub's main platform and in GitHub Enterprise Server 3.4, reflecting both a technical and user-focused priority.

GitHub InFocus is a virtual event occurring from April 26-29, designed to equip software development teams with tools and expertise in accelerating development, enhancing security, and boosting efficiency. Each day has a distinct theme: the first day features a keynote by GitHub leadership discussing the company's direction, product innovations, and productivity frameworks like SPACE. The second day focuses on accelerating software development through DevOps practices, led by GitHub experts Jon Peck and Glenn Wester, who emphasize integrating security and compliance for improved code quality and deployment speed. The third day, centered on developer-first security, includes insights from GitHub's Shlomi Shaki and Pierluigi Cau on building a seamless application security program. The final day addresses organizational efficiency, with Bas Peters and Maya Van Vliet focusing on reducing process waste to enhance developer productivity. The sessions aim to provide practical steps for improving software development practices, with no registration required, allowing participants to gain insights from industry leaders and GitHub professionals.

GitHub has introduced a new feature allowing organizations to create private READMEs visible only to their members, enhancing internal communication by displaying relevant information on the organization's Overview page. This member-only README is similar to the public README but is housed in a private .github-private repository, enabling organizations to share important internal details while maintaining public and private information accessibility through a toggle feature. Additionally, organizations can now curate and pin public or private repositories specifically for their members, distinguishing between repositories that are valuable to the public and those crucial for internal use. This functionality is available to all GitHub users, with additional capabilities for organizations on the GitHub Enterprise plan, such as pinning internal repositories.

GitHub has released updates to Codespaces, its cloud-powered development environments, enhancing support for multi-repository projects and monorepos to boost productivity by minimizing setup times. Initially focused on cloud-native applications in singular repositories, the updates address the needs of more complex projects by allowing users to configure permissions for multiple repositories directly in their devcontainer.json file. This eliminates the need for personal access tokens and simplifies the process of working with interconnected microservices. For monorepos, the update allows multiple devcontainer.json files, enabling teams to customize environments according to their specific needs, such as setting up lightweight configurations for documentation teams. An advanced creation flow now offers greater flexibility by allowing users to select branch, region, machine type, and dev container configuration, while a one-click creation option remains available for those preferring simplicity. These improvements aim to facilitate smoother onboarding and scaling for larger organizations using Codespaces, with the added benefit of customizable configurations for repository administrators and developers.

The blog post discusses the importance of using CodeQL, an analytics tool for identifying security vulnerabilities in code, and how to share this expertise with the community to enhance open-source software security. By creating and publishing CodeQL query packs, developers can share their specific security queries, such as those detecting vulnerabilities like Windows binary planting in GitHub Actions, allowing others to apply these patterns to their codebases. CodeQL packaging, currently in beta, enables developers to bundle and distribute their queries, encouraging widespread use and protection against known vulnerabilities. The post provides detailed instructions on setting up, creating, and publishing a CodeQL pack, highlighting the benefits of sharing security knowledge through GitHub's registry and the CodeQL CLI. It emphasizes the ease of contributing queries to the open-source community, either through the CodeQL query repository or by creating domain-specific packs, thereby aiding in the prevention of security issues across diverse codebases.

Git 2.36 introduces several notable features and improvements, reflecting contributions from over 96 developers. One of the key enhancements is the introduction of the `--remerge-diff` option, which simplifies merge conflict resolution by showing the differences between files with conflicts and their resolutions, leveraging the faster ort engine. Additionally, Git now offers more flexible fsync configurations through new variables, core.fsync and core.fsyncMethod, to improve data durability. Security has been tightened with stricter repository ownership checks, and the release also includes improvements to commands like git cat-file, git ls-tree, and git bisect for better usability and scripting flexibility. The update supports partial bundles and enhances partial clone features, allowing for more efficient repository management. Furthermore, a bug fix addresses synchronization issues with multi-pack reachability bitmaps to ensure accurate results. These enhancements collectively bolster Git's performance, security, and user experience, catering to both casual users and server operators.

In April 2022, GitHub identified a security incident involving the misuse of OAuth tokens issued to third-party services Heroku and Travis CI, which were used by an attacker to access private repositories on GitHub.com. The attack began on April 12 when GitHub Security detected unauthorized access to npm's production infrastructure using a compromised AWS API key, believed to have been obtained through the compromised OAuth tokens. GitHub immediately contacted Heroku and Travis CI to initiate security investigations, revoke the affected OAuth tokens, and notify users. The affected tokens were not stored by GitHub in their original format, indicating that the breach did not occur through GitHub's systems directly. GitHub has notified the known victims of the attack and continues to monitor the situation while advising users to review their authorized OAuth applications for any anomalies. The company remains committed to protecting its ecosystem and is working closely with Heroku and Travis CI to mitigate the impact of the breach.

GitHub Discussions has been enhanced to streamline software development communication by providing a centralized platform for conversations, questions, and decision documentation directly within repositories. Initially scoped to individual repositories, Discussions now supports organization-level interactions, allowing for centralized communication across multiple projects, as seen in the Homebrew community. New features include the ability to create polls, which has been a highly requested addition, enabling users to gather community feedback efficiently. Integration with Slack and Microsoft Teams has been introduced to ensure that notifications about new or answered discussions are seamlessly communicated across platforms. Additionally, a new feature improves the visibility of Q&A responses by highlighting the accepted answer at the top of the thread. These updates aim to reduce context switching and enhance collaboration for developers and communities using GitHub Free, Team, and Enterprise accounts.

New versions of Git have been released to address two security vulnerabilities, CVE-2022-24765 and CVE-2022-24767, although GitHub is unaffected by these issues. CVE-2022-24765 affects users on multi-user machines, where a malicious actor could create a .git directory in a shared location to execute arbitrary commands, and upgrading to Git v2.35.2 mitigates this risk by changing directory traversal behavior. CVE-2022-24767 involves the Git for Windows uninstaller, which, due to default permissions in the temporary directory, could allow malicious .dll files to be loaded, and upgrading to Git for Windows v2.35.2 addresses this vulnerability. For both vulnerabilities, users are advised to upgrade to the latest versions, and in the interim, take precautions such as redefining environment variables and avoiding certain operations on multi-user machines. These vulnerabilities were discovered by 俞晨东 and the Lockheed Martin Red Team, respectively.

GitHub has been enhancing its application performance by incorporating a feature called rack.after_reply into its Unicorn-powered web servers, resulting in significant improvements in response times. Previously, the process of sending telemetry metrics during requests was causing delays, with up to 65ms added per request. By implementing rack.after_reply, GitHub can now batch and flush telemetry data only after users receive a response, reducing the response time by 30ms at the median (p50) and more than 50ms at the 99th percentile (p99). Although this approach initially posed challenges, such as blocking new HTTP requests until the rack.after_reply code execution completed, GitHub mitigated these issues with a timeout feature. This development not only enhances performance but also contributes a valuable tool to the Unicorn web server, with potential inclusion in the official Rack specification.

In March, several open-source projects released major updates, showcasing advancements across various fields, from web rendering to background processing. Babylon.js 5.0 introduced features like infinite morph targets and an animation curve editor, gaining broader adoption in web rendering applications. Mantine 4.0, a React Hooks and components library, added new components and design improvements, while Axentix 2.0 enhanced its framework with additional CSS variables and dark mode. Mitmproxy 8.0, an interactive HTTPS proxy, now supports asynchronous webhooks and offers significant web UI improvements. JobRunr 5.0 made strides in Java background processing with support for scheduling recurring jobs and Spring Native. LDtk 1.0 debuted as a 2D level editor, appealing to game developers, and Neo.mjs 4.0 improved browser performance with ServiceWorkers. Front Matter 7.0 enhanced its platform with new snippet support and a dashboard, and FeedbackFin 1.0 introduced a customizable feedback collection tool for websites. These updates highlight the continuous innovation and collaboration within the open-source community.

In response to increasing concerns about supply chain security, particularly following incidents like the Log4j vulnerability and Solarwinds attack, GitHub has introduced new tools and workflows to enhance software build security and meet the SLSA Level 3 compliance standard. This involves leveraging GitHub Actions and Sigstore's tools to automatically generate non-forgeable provenance metadata, ensuring the authenticity and origin of software artifacts. These measures allow developers to verify not only the authenticity of the software they receive but also details about its build environment. The Sigstore project comprises tools such as Cosign, Fulcio, and Rekor, which help in signing software, issuing short-lived certificates, and maintaining a secure log of signing events. This initiative aligns with the NIST framework, emphasizing the need for provenance verification to bolster security against supply chain attacks. By integrating these tools with GitHub Actions, developers can achieve a higher level of transparency and security in their build processes without managing their own signing keys, providing a significant advancement in ensuring the integrity of software development workflows.

Git Credential Manager (GCM) serves as a universal authentication solution designed to simplify and secure access to remote Git repositories, replacing previous versions specifically for Windows, Mac, and Linux. The project, now housed under its own GitHub organization, emphasizes open and agnostic support for various Git hosting services, including recent integration with GitLab. To enhance user experience, GCM supports graphical authentication on macOS and Linux through Avalonia, alongside its traditional terminal prompts, and offers various credential storage options for different platforms. The project also incorporates advanced security features, such as multi-factor authentication, conditional access policies, and experimental brokered authentication on Windows using Web Account Manager (WAM), to protect credentials and comply with evolving security standards. With a focus on expanding compatibility and performance, GCM aims to support a broader range of Linux distributions and architectures while continuously improving its security measures, particularly in light of increased remote work and cybersecurity threats.

Security for developers often takes a back seat due to competing priorities and unclear ownership, leading to vulnerabilities in application layers, as evidenced by the Log4j incident and a significant rise in software supply chain attacks. GitHub aims to address these challenges by offering automated, integrated security solutions that enhance productivity and minimize risks without disrupting the developer workflow. Tools like Dependabot, CodeQL, and secret scanning are embedded into the workflow to help identify and fix vulnerabilities efficiently, leveraging the extensive GitHub Advisory Database. Dependabot, in particular, offers customizable alerts and automatic updates for vulnerable dependencies, supporting the community with free, open security data to ensure robust software supply chains.

In March, GitHub faced several incidents that impacted the availability of core services, largely due to resource contention in the mysql1 database cluster during peak load times, affecting write operations and causing delays in GitHub Actions. The company responded by proactively managing loads, optimizing queries, and increasing database capacity, which significantly reduced query rates and transaction volumes. They also implemented maintenance windows and paused certain operations to minimize user impact, while accelerating efforts to shard the problematic cluster and improve alerting thresholds. A subsequent incident during a database migration for GitHub Actions highlighted misconfigurations, which led to temporary job delays, prompting a reevaluation of operational workflows and permissions checks. GitHub continues to focus on transparency and resilience, sharing updates to reinforce customer trust and accountability.

Understanding the security of your software supply chain is vital, and GitHub's dependency review action enhances this by proactively blocking pull requests that introduce dependencies with known vulnerabilities. This GitHub Action automates the detection of vulnerabilities, which would otherwise only appear in the rich diff of a pull request, by scanning new dependency changes against the GitHub Advisory Database. If a vulnerability is found, the action raises an error with details, allowing developers to address the issue with contextual intelligence. The action is supported by an API that compares dependencies across revisions and is available on GitHub Marketplace for all public repositories and private ones with GitHub Advanced Security. Currently in public beta, the action is set to expand with more customizable failure criteria based on factors like vulnerability severity and license type, along with improvements in the user interface to enhance usability. Feedback from users is encouraged to help refine the tool and its documentation further.

GitHub employs its own platform, GitHub Actions, to automate a wide range of tasks, showcasing its versatility in both technical and non-technical workflows. The platform has been utilized for tasks such as automating vulnerability reporting processes within the GitHub Security Lab, running large-scale regression tests for CodeQL implementation changes, and streamlining the release process for GitHub Mobile updates. GitHub Actions also aids in everyday operations, including sharing company updates via the intranet, compiling weekly program status reports, and turning team photos into GIFs. With over 12,000 community-built actions available in the GitHub Marketplace, GitHub Actions enables the automation of workflows to enhance efficiency and focus on coding and innovation.

GitHub addresses the ongoing issue of credential misuse by enhancing its secret scanning capabilities as part of GitHub Advanced Security, aiming to shift from reactive to proactive security measures. The platform has detected over 200,000 secrets across private repositories and offers free scanning for partner patterns in public repositories. A new feature, push protection, scans for secrets before code is committed, preventing leaks without disrupting productivity by focusing on token types that can be detected accurately. This feature supports 69 high-confidence patterns to minimize false positives, ensuring developers can trust the results and maintain their workflow. If a secret is identified during a push, developers can review and remove it, or resolve it as a false positive, test case, or real instance to address later. Organizations can enable push protection at both the repository and organization levels easily, enhancing their overall security posture with GitHub's comprehensive security features, including code scanning and supply chain security tools.