https://cloudposse.com logo
Join Slack
Powered by
This Trivy compromise is insane to me. I've been t...
# random
m
This Trivy compromise is insane to me. I've been trying to spread the word that this is probably more widespread than people realize: https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html
e
Thanks for the write up!
Let’s discuss in #CHDR1EWNA
Can you make it?
This is the fundamental problem with Git tags: they’re just pointers. You can move them whenever you want, and anyone pulling that tag gets whatever it points to now, not what it pointed to yesterday
We use tag protection rules to make this impossible without admin overrides
m
I love it, and I'll be there!
r
yea but you can still get compromised through supply chain attack, such as one of your actions depends on an action that gets compromised
this is another reason to always pin your github actions to SHAs instead of mutable version tags
same goes for terraform modules
e
to always pin your github actions to SHAs instead of mutable version tags
@RB check this out:
CleanShot 2026-03-25 at 14.28.59@2x.png
It appears totally innocuous
Copy code
uses: actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0
It's pinning to a sha
But it turns out that dangling commits in forks are associated with the main repo namespace: 
actions/checkout
What scares me so much about this is how opaque the SHAs are. When they are pinned, unless every single sha is interrogated, we can't even be sure it's pinning to the same repo!!!
What can/should we do about this do you think?
r
Oh I did not know that, good to know
Coderabbit to check the SHA is in the main repository
Would that work?
That is frightening that the commit hash would be related back to the primary repo when the hash is of a fork 🤦‍♂️
e
Yea, totally breaks trust
CleanShot 2026-03-25 at 14.35.48@2x.png
r
Well not use-less but not as useful as it could be 🙃
2 Views
Open in Slack
PreviousNext
Powered by