From c9552bc7afdccf71ea2044f42b514e35f598456f Mon Sep 17 00:00:00 2001 From: RARS-oss <319612030+RARS-oss@users.noreply.github.com> Date: Fri, 11 Sep 2026 20:13:01 +0300 Subject: [PATCH 1/2] Security hardening: pin actions, least-privilege workflow permissions, ignore .env, SECURITY.md Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01YEpKM5jvAaoGNw5ATJgSNx --- .github/workflows/ci.yml | 7 +++++-- .github/workflows/release.yml | 16 ++++++++-------- .gitignore | 5 +++++ SECURITY.md | 18 ++++++++++++++++++ 4 files changed, 36 insertions(+), 10 deletions(-) create mode 100644 SECURITY.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e4cc6ad..fda7cda 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,14 +9,17 @@ env: CARGO_TERM_COLOR: always RUSTFLAGS: "-D warnings" +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: components: rustfmt, clippy diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 93d52a2..991d934 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,14 +12,14 @@ jobs: binary: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - run: cargo build --release -p sbx-cli - name: package run: | strip target/release/sbx tar -C target/release -czf "sbx-${GITHUB_REF_NAME}-x86_64-unknown-linux-gnu.tar.gz" sbx - - uses: softprops/action-gh-release@v2 + - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: files: sbx-*.tar.gz generate_release_notes: true @@ -27,21 +27,21 @@ jobs: container: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 - - uses: docker/login-action@v3 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/metadata-action@v5 + - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 id: meta with: images: ghcr.io/${{ github.repository }} tags: | type=ref,event=tag type=raw,value=latest - - uses: docker/build-push-action@v6 + - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . push: true diff --git a/.gitignore b/.gitignore index e97a2e4..1d104d8 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,8 @@ bench/out/figs-png/ bench/out/*.output bench/out/_*.json bench/scripts/_*.sh + +# local secrets +.env +.env.* +!.env.example diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..193ad99 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security policy + +## Reporting a vulnerability + +Please do not open a public issue for security problems. Use GitHub's private +vulnerability reporting for this repository (**Security → Report a +vulnerability**), or contact the maintainer directly through the profile +listed on the repository. You will get an acknowledgement within a few days. + +## Scope + +This is a personal open-source project. Reports about the code in this +repository, its build and release workflows, and its published artifacts are +in scope. Third-party services it talks to are not. + +## Supported versions + +Only the default branch and the latest release receive fixes. From 623934ff5edd6fa14de1499a1f67d6d94365ea6f Mon Sep 17 00:00:00 2001 From: RARS-oss <319612030+RARS-oss@users.noreply.github.com> Date: Fri, 11 Sep 2026 20:22:43 +0300 Subject: [PATCH 2/2] bootstrap.sh: fetch and clone by commit, not by branch; minimal rustup profile The documented one-liner ran whatever was on main at the time; it now points at an immutable commit with a checksum step, and the clone inside the script checks out the same ref (SBX_REF to override). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01YEpKM5jvAaoGNw5ATJgSNx --- bench/gpu/bootstrap.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/bench/gpu/bootstrap.sh b/bench/gpu/bootstrap.sh index c2ffd06..2c212e0 100644 --- a/bench/gpu/bootstrap.sh +++ b/bench/gpu/bootstrap.sh @@ -4,7 +4,12 @@ # Run on a fresh Ubuntu 22.04/24.04 pod that already has the NVIDIA driver + CUDA # (RunPod "PyTorch 2.x" template, or a Vast.ai CUDA image). One command: # -# curl -fsSL https://raw.githubusercontent.com/RARS-oss/sbx/main/bench/gpu/bootstrap.sh | bash +# curl -fsSL https://raw.githubusercontent.com/RARS-oss/sbx/8c38a4e54484102166f5a80947e2c40bed53663f/bench/gpu/bootstrap.sh -o bootstrap.sh +# sha256sum bootstrap.sh # compare with the checksum in the commit / release notes you reviewed +# bash bootstrap.sh +# +# Fetch by commit (or a reviewed tag), never by branch: a branch URL executes whatever +# is on that branch at the moment you run it. SBX_REF below pins the clone the same way. # # It: installs toolchains, builds `sbx`, creates a venv with vLLM + the harness deps, # downloads the model, and launches an OpenAI-compatible endpoint that the harness @@ -30,9 +35,10 @@ PKGS="git curl build-essential clang python3 python3-venv python3-pip pkg-config sudo apt-get install -y -qq $PKGS 2>/dev/null || apt-get install -y -qq $PKGS log "2/5 rust + build sbx" -if ! command -v cargo >/dev/null 2>&1; then curl -fsSL https://sh.rustup.rs | sh -s -- -y; fi +if ! command -v cargo >/dev/null 2>&1; then curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal; fi . "$HOME/.cargo/env" -[ -d sbx ] || git clone --depth 1 https://github.com/RARS-oss/sbx.git +SBX_REF="${SBX_REF:-8c38a4e54484102166f5a80947e2c40bed53663f}" # commit or tag to build; override to test a branch +[ -d sbx ] || { git clone https://github.com/RARS-oss/sbx.git && git -C sbx checkout -q "$SBX_REF"; } ( cd sbx && cargo build --release -p sbx-cli ) export PATH="$ROOT/sbx/target/release:$PATH" echo "sbx: $(sbx --version 2>/dev/null || echo built)"