Infra security nerd at Shopify. Previously GitHub (Dependabot+Actions), ApolloGraphQL, Fitbit. Hack the planet.
Joined November 2012
- Tweets118
- Following88
- Followers35
- Likes1.5K
bonus: most of my tweets are "i built a thing + screenshot"
shiptalkers.dev/compare?gith…
my PR to trivy made its way to trivy-action, so now my SBOM dependency diffs include the golang stdlib for any detected binaries. neat. github.com/aquasecurity/triv…
if you're trying the shiny new `gh attestation verify` with reusable workflows, don't get sniped into debugging the CLI like I did: github.com/cli/cli/issues/90…
Early adopters of github attestions:
github.com/search?q=path%3A.… (shout out @StackLokHQ !)
I don't see anyone signing a .deb yet, I was hoping to adapt some `cosign verify-blob` based stuff.
I wanted this enough to build it again: a service to generate Debian repositories in-memory from a bunch of debs. It can source packages directly from GitHub release assets and verify Rekor records produced by cosign sign-blob.
i spilled making a pourover and knew i had exactly 23.5g of coffee to clean up off the counter.
ever catch yourself napkin mathing literal napkin math.
the SSD rule of thumb is literal: once you have several thumbdrives larger than a 2.5" SSD, that SSD is probably waste.
New GitHub Actions workflow: periodically rebuild, compare SBOMs to the base branch, and open a PR if there is any drift.
Now I get a ping when my unpinned dependencies change, and I can decide to upgrade -
github.com/thepwagner-org/ac…
You can sort of see it in action here - github.com/thepwagner-org/de…
The best demo is when an update affects bullseye-slim. Previously I'd have to read debian-security and open my own PR like a chump example - github.com/thepwagner-org/de…
I use Renovate's regex manager to pin my ko base images, like github.com/thepwagner/github…
configuration gist.github.com/thepwagner/3…
Pete Wagner retweeted
Curious about exploiting VMs or memory bugs in a safe language? Read my new blog post, where I attack Firecracker, AWS' VMM written in Rust. Learn about the various layers of virtualization + the attack surface, and how design decisions impact security.
graplsecurity.com/post/attac…
GitHub's API docs say `organization_packages` is a valid permission for creating an installation access token, but I can't seem to configure it as part of my app - any ideas?
I generalized the solution for generating GitHub tokens from OIDC identities, added tiered policy enforcement via Rego (an organization or individual repositories can grant access), and tidied things up enough to publish - github.com/thepwagner/github…
ALT A GitHub Actions run matches an organization-wide Rego policy, which grants permissions that typically require a personal access token.
Pete Wagner retweeted
Hahahahaha
The House passed a defense spending bill saying you can't sell software to the DoD that has *any* known CVEs in it.
congress.gov/bill/117th-cong…
