Similar issue here:

https://design.wikimedia.org/style-guide/.git/config

I think we can fix it by adding to the miscweb chart a file to add under /etc/apache2/conf-enabled/git-deny.conf as a subPath volumemount from a configmap that contains

<DirectoryMatch /\.git>
  Require all denied
</DirectoryMatch>

Thanks for raising this issue. I think it makes sense to block that folder in apache. However we should avoid putting this file in the container image at all by fixing the blubber config. Because even if we are blocking the path in apache, you could just pull the image and extract the token locally.

I'm currently trying the find the correct way to revoke that token, which is not obvious.

A first test using this token returns a 404, which is the default behavior for unauthorized requests according to the docs

I tried to use the token but I get Access denied:

remote: HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password. See https://gitlab.wikimedia.org/help/topics/git/troubleshooting_git#error-on-git-fetch-http-basic-access-denied
fatal: Authentication failed for 'https://gitlab.wikimedia.org/repos/sre/miscweb/design-landing-page.git/'

Also when I try to use the token in API I get a 404:

curl --request POST --form "token=$CI_JOB_TOKEN" --form ref=master "https://gitlab.wikimedia.org/api/v4/projects/1933/trigger/pipeline"
{"message":"404 Not Found"}j

I'm still trying to find the token in the GitLab API to properly revoke it/verify it's expired/revoked

I was not able to find the linked API key in GitLab. Unfortunately the Token information API is not available in 17.4 (our version) and needs at least 17.5.

However I'm pretty sure the token included above is a "GitLab CI/CD job token": see https://docs.gitlab.com/ee/ci/jobs/ci_job_token.html

The job tokens are "valid only while the job is running. After the job finishes, the token access is revoked and you cannot use the token anymore", see docs.
That's also the reason why I can't find anything about the token in GitLab and can't use it anymore.

I'll prepare a MR which excludes .git from the blubber pipeline in all miscweb images and a fix for the apache config.

@dancy @brennen is it necessary for kokurri to persist the token to the git config? This issue might happen again for other projects and I'm wondering if it's possible to prevent that on kokurri level.

I opened https://gitlab.wikimedia.org/repos/sre/miscweb/design-landing-page/-/merge_requests/4 which uses a dedicated builder variant to remove the .git folder and to fix the apache config.

For clarity, as you noticed: these tokens are useless by the time the image is published. I wonder if the presence in the .git dir is gitlab's doing vs kokkuri's? @dancy or @dduvall would know for sure.

Fixes for the remaining two design miscweb sites:

https://gitlab.wikimedia.org/repos/sre/miscweb/design-strategy/-/merge_requests/11
https://gitlab.wikimedia.org/repos/sre/miscweb/design-style-guide/-/merge_requests/5

Fixing the leaked git config here:
https://design.wikimedia.org/style-guide/.git/config
https://design.wikimedia.org/strategy/.git/config

The other miscweb services are not affected because they do not use source: ./.

In T382230#10406193, @thcipriani wrote:

For clarity, as you noticed: these tokens are useless by the time the image is published. I wonder if the presence in the .git dir is gitlab's doing vs kokkuri's? @dancy or @dduvall would know for sure.

Gitlab-CI performs the clone of the repository. It runs git clone https://gitlab-ci-token:thetempjobtoken@gitlab.wikimedia.org/<repo-path>.git. Git always stores the repo URL in .git/config.

@Jelto I opened https://gitlab.wikimedia.org/repos/sre/miscweb/design-landing-page/-/merge_requests/5 with a simpler approach.

In T382230#10406800, @dancy wrote:

@Jelto I opened https://gitlab.wikimedia.org/repos/sre/miscweb/design-landing-page/-/merge_requests/5 with a simpler approach.

Thanks @dancy, this looks much cleaner! I wasn't aware that Blubber recognizes the .dockerignore file.

I've also updated the MRs in https://gitlab.wikimedia.org/repos/sre/miscweb/design-strategy/-/merge_requests/11 and https://gitlab.wikimedia.org/repos/sre/miscweb/design-style-guide/-/merge_requests/5.

https://design.wikimedia.org/.git/config returns a 404 for me, design-strategy and design-style-guide need a few more hours I guess.

curl -I https://design.wikimedia.org/.git/config
HTTP/2 404 
date: Tue, 17 Dec 2024 09:32:07 GMT
server: istio-envoy
content-length: 282
content-type: text/html; charset=iso-8859-1
age: 364
x-cache: cp3071 miss, cp3071 hit/2
x-cache-status: hit-front

Just to be sure I'll add a similar .dockerignore to the other miscweb image repos as well.

I added .dockerignore files to all miscweb projects.

For design-strategy and design-style-guide, the Git config is still cached. Once the files are out of cache, I'll resolve this task.

dani opened https://gitlab.wikimedia.org/repos/sre/miscweb/design-landing-page/-/merge_requests/6

Remove and restrict config files from image build

dani merged https://gitlab.wikimedia.org/repos/sre/miscweb/design-landing-page/-/merge_requests/6

Remove and restrict config files from image build

dani merged https://gitlab.wikimedia.org/repos/sre/miscweb/research-landing-page/-/merge_requests/39

exclude .git folder from image build

dani merged https://gitlab.wikimedia.org/repos/sre/miscweb/wikiworkshop/-/merge_requests/25

exclude .git folder from image build