At the moment, the only way to pass the secret Gitea token to the
runner CLI is directly through a CLI parameter. That's an issue on a
multi-user system where the CLI parameters are world-readable through
/proc/PID/cmdline. On a Linux system, there's sadly no way to hide the
cmdline parameters.
We usually go around this limitation by storing the secrets in a file
and protect it through tight ACL rules. Adding a way to inject the
secret token via a file during the register command.
As a nice side-effect, this improves the systemd integration by
allowing us to directly use the LoadCredential mechanism.
I'll upstream this Nixpkgs patch on the next release -- provided you find this pull request idea sound.
Hey!
```
At the moment, the only way to pass the secret Gitea token to the
runner CLI is directly through a CLI parameter. That's an issue on a
multi-user system where the CLI parameters are world-readable through
/proc/PID/cmdline. On a Linux system, there's sadly no way to hide the
cmdline parameters.
We usually go around this limitation by storing the secrets in a file
and protect it through tight ACL rules. Adding a way to inject the
secret token via a file during the register command.
As a nice side-effect, this improves the systemd integration by
allowing us to directly use the LoadCredential mechanism.
```
Some more context: I'm using this new flag on my NixOS personal setup with this Nixpkgs patch: https://github.com/NinjaTrappeur/nixpkgs/commit/0fe31acd33182de1d06ae164d0cc62e6514c5a03
I'll upstream this Nixpkgs patch on the next release -- provided you find this pull request idea sound.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Hey!
Some more context: I'm using this new flag on my NixOS personal setup with this Nixpkgs patch: https://github.com/NinjaTrappeur/nixpkgs/commit/0fe31acd33182de1d06ae164d0cc62e6514c5a03
I'll upstream this Nixpkgs patch on the next release -- provided you find this pull request idea sound.
Thanks for the PR!
@@ -256,0 +262,4 @@token_bytes, err := os.ReadFile(regArgs.TokenFile)if err != nil {return fmt.Errorf("Cannot read the token file: %s", regArgs.TokenFile, err)}This line is causing build to fail. I’m just making a note of it so I can update it when not on mobile.
Friendly bump. This is an easy change with a large security benefit.
internal/app/cmd/register.go:264:11: fmt.Errorf call needs 1 arg but has 2 argsView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.