Security/Reviews/ReleaseKickOffSys
Item Reviewed
| Release Kickof System | |||||||||||||
| Target |
2 Total; 0 Open (0%); 2 Resolved (100%); 0 Verified (0%); http://rail:isawesome@dev-master01.build.scl1.mozilla.com:5000 http://git.mozilla.org/?p=build/release-kickoff.git;a=summary |
||||||||||||
{{#set:SecReview name=Release Kickof System
|SecReview target=
| ID | Summary | Priority | Status |
|---|---|---|---|
| 763929 | tracking bug for initial implementation + deployment of release kickoff and release runner | P3 | RESOLVED |
| 810472 | security review of release kickoff system | -- | RESOLVED |
2 Total; 0 Open (0%); 2 Resolved (100%); 0 Verified (0%);
http://rail:isawesome@dev-master01.build.scl1.mozilla.com:5000 http://git.mozilla.org/?p=build/release-kickoff.git;a=summary }}
Introduce the Feature
Goal of Feature, what is trying to be achieved (problem solved, use cases, etc)
- This is currently done manually, this project is meant to automate the tasks for release automation
- builds Firefox, Fennec, Thunderbird
- webapp behind a vpn
- submit information to start a new release
- gathers info, bumps things, does all the build stuff and checks and starts the release
- should only be acessable by RelEng (for now)
What solutions/approaches were considered other than the proposed solution?
- cont to be a manual solution
Why was this solution chosen?
`
Any security threats already considered in the design and why?
- regular web security issues (CSRF considered)
- authentication - moving to LDAP based authentication using apache (new LDAP group ?)
Threat Brainstorming
- remote code execution
- cover off on web security
{{#set: SecReview feature goal=* This is currently done manually, this project is meant to automate the tasks for release automation
- builds Firefox, Fennec, Thunderbird
- webapp behind a vpn
- submit information to start a new release
- gathers info, bumps things, does all the build stuff and checks and starts the release
- should only be acessable by RelEng (for now)
|SecReview alt solutions=* cont to be a manual solution |SecReview solution chosen=' |SecReview threats considered=* regular web security issues (CSRF considered)
- authentication - moving to LDAP based authentication using apache (new LDAP group ?)
|SecReview threat brainstorming=* remote code execution
- cover off on web security
}}
Action Items
| Action Item Status | In Progress | ||||||||||||||||
| Release Target | ` | ||||||||||||||||
| Action Items | |||||||||||||||||
3 Total; 0 Open (0%); 3 Resolved (100%); 0 Verified (0%); |
|||||||||||||||||
{{#set:|SecReview action item status=In Progress
|Feature version=`
|SecReview action items=
| ID | Summary | Priority | Status |
|---|---|---|---|
| 812230 | SecReview Item: Review WebAppSec Secure coding checklist | -- | RESOLVED |
| 812232 | SecReview Item: Log Retention review | -- | RESOLVED |
| 812234 | SecReview Item: Test release kickoff system | -- | RESOLVED |
3 Total; 0 Open (0%); 3 Resolved (100%); 0 Verified (0%);
}}