Protect your open source project from supply chain attacks

From executive orders to key signing parties, 2021 has been the year of supply chain security. If you’re an open source maintainer, learning about the attack surface of your project and the threat vectors throughout your project’s supply chain can feel overwhelming, maybe even insurmountable. The good news is that 2021 has also been the year of supply chain security solutions. While there’s still plenty of work to be done, and plenty of room for improvement in existing solutions, there are preventative controls you can apply to your project now to harden your supply chain and prevent compromise.

At All Things Open 2021, the audience learned about best practices for supply chain security through a quiz game. This blog post walks through the quiz questions, answers, and options for prevention, and can serve as a beginner's guide for anyone who wants to protect their open source project from supply chain attacks. These recommendations follow the SLSA framework and OpenSSF Scorecards rubric, and many can be implemented automatically by using the Allstar project.

An example of a typical software supply chain and examples of attacks that can occur at every link in the chain.

Q1: What should you do to protect your developer accounts from takeover?

1. ANSWER: Use multi-factor auth (with a security key if possible)
2. Use a shared account for core maintainers
3. Make sure to write all your passwords in rot13
4. Use an IP allowlist

Why and how: A malicious actor with access to a developer account can pretend to be a known contributor and submit bad code. Encourage contributors to use multi-factor authentication (MFA) not only for platforms where they send commits, but also for accounts associated with contributions, such as email. Where possible, security keys are the recommended form of MFA.

Q2: What should you do to avoid merging malicious commits?

1. ANSWER: Require all commits to be reviewed by someone who is not the commit author
2. Auto-run tests on all commits
3. Scan for the word ‘bitcoin’ in all commits
4. Only accept commits from contributors who have accounts older than 1 year

Why and how: Self-merging (also known as a unilateral change) introduces two risks: 1) An attacker who has compromised a contributor’s account can inject malicious code directly into the project, or 2) A well-intentioned person can merge a commit that accidentally introduces a security risk. A second set of authenticated eyes can help avoid malicious submissions and accidental weaknesses. Set this up as an automated requirement if possible (such as using GitHub’s Branch Protection settings); tools like Allstar can help enforce this requirement. This corresponds to SLSA level 4.

Q3: How can you protect secrets used by your CI/CD pipeline?

1. ANSWER: Use a secret manager tool
2. Appoint a maintainer to control secrets access
3. Store secrets as environment variables
4. Store secrets in a separate repo

Why and how: The “defense in depth” security concept is about applying multiple, different layers of defense to protect systems and sensitive data, such as secrets*. A secret manager tool (like Secret Manager for GCP users, HashiCorp Vault, CyberArk Conjur, or Keywhiz) removes the need for hard-coding secrets in source code, provides centralization and audit capabilities, and introduces an authorization layer to prevent leaking secrets.

*When storing sensitive data in a CI system, ensure it is truly for CI/CD purposes, and not data that is better suited for a password or identity manager.

Q4: What should you do to protect your CI/CD system from abuse?

1. ANSWER: Use access controls following the principle of least privilege
2. Run integration tests on all pull requests/commits
3. Mark all contributors as “Collaborators” through GitHub roles
4. Run CI/CD systems locally

Why and how: Defaulting to “the least amount of access necessary” for your project repository protects your CI/CD system from both unintended access and abuse. While running tests is important, running tests on all commits/pull requests by default—before they’ve been reviewed—can lead to unintentional and malicious abuse of your CI/CD system’s compute resources.

Q5: What should you do to avoid compromise during build time?

1. ANSWER: Define build definitions and configurations as code, eg build.yaml
2. Make your builds run as quickly as possible so attackers have no time to compromise your code
3. Only use LEGO brand components in your build system, accept no substitutes
4. Delete build logs to avoid leaving clues for attackers

Why and how: Using a build script—a file that defines the build and its steps, like build.yaml—removes the need to manually run build steps, which could possibly introduce an accidental misconfiguration. It also reduces the opportunity for a malicious actor to tamper with the build or insert unreviewed changes. This corresponds to SLSA levels 1-4.

Q6: How should you evaluate dependencies before use?

1. ANSWER: Assess risk and transitive changes with tools like Scorecards and deps.dev
2. Check for a little ‘lock’ icon next to the package url
3. Only use dependencies that have a minimum of 1,000 GitHub stars
4. Only use dependencies that have never changed maintainers

Why and how: There isn’t one definitive measure that can tell you a package is “good” or “bad;” every project has different security profiles and risk tolerances. Gathering information about a dependency, and what changes it might introduce transitively, will help you decide if a dependency is “safe” for your project. Tools like Open Source Insights (deps.dev) map first layer and transitive dependencies, while Scorecards gives packages a score for multiple risk assessment metrics, including use of security policies, MFA, and branch protection.

Once you determine what dependencies you’re using, running a vulnerability scanning tool such as Open Source Vulnerabilities regularly will help you stay up to date on the latest releases and patches. Many vulnerability scanning tools can also apply automatic upgrades.

Q7: What should you do to ensure your build is the build you think it is (aka verification)?

1. ANSWER: Use a build service that can generate authenticated provenance
2. Check the last commit to be sure it’s from a trusted committer
3. Use steganography to embed your project logo into the build
4. Run conformance tests for each release

Why and how: Showing the origin and artifacts of a build (the build’s provenance) demonstrates to the user that the build has not been tampered with, and is the correct build. There are many components to provenance; one method to deliver these components is to use a build service that generates and authenticates the data needed to show provenance. This corresponds to SLSA levels 2-4.

Q8: What should you look for when selecting artifacts from a registry?

1. ANSWER: That artifacts have been cryptographically and verifiably signed
2. That artifacts are not cursed (through being stolen from tombs)
3. Timestamps: only use the most recent artifact created
4. Official endorsement: look for the logo of a trusted brand or standards body

Why and how: Just as you should generate provenance and sign builds for your projects (SLSA levels 2-4), you should also look for the same verification when using artifacts from others. Logos and other brand-based forms of endorsement can be falsified and are used by typosquatters to fake legitimacy; look for tamper-proof verification like signatures. For example, Sigstore helps OSS projects sign their builds, and validate the builds of others.

Improving your project’s security is a continuous journey. Some of these recommendations may not be feasible for your project today, but every step you can take to increase your project’s security is a step in the right direction.

Resources for open source project security:

• SLSA: A framework for levels of supply chain security
• Scorecards: A measurement of security best practices use
• Allstar: A GitHub app for enforcing security best practices
• Open Source Insights: A searchable visualization of open source project dependencies
• OSV: A vulnerability database and automation infrastructure for open source

By Anne Bertucio, Google Open Source Programs Office