Security/Reviews/ReleaseKickOffSys
Item Reviewed
| Release Kickof System | |
| Target | <bugzilla>
{ "id":"763929,810472" } </bugzilla> http://rail:isawesome@dev-master01.build.scl1.mozilla.com:5000 http://git.mozilla.org/?p=build/release-kickoff.git;a=summary |
{{#set:SecReview name=Release Kickof System |SecReview target=<bugzilla> { "id":"763929,810472" } </bugzilla> http://rail:isawesome@dev-master01.build.scl1.mozilla.com:5000 http://git.mozilla.org/?p=build/release-kickoff.git;a=summary }}
Introduce the Feature
Goal of Feature, what is trying to be achieved (problem solved, use cases, etc)
- This is currently done manually, this project is meant to automate the tasks for release automation
- builds Firefox, Fennec, Thunderbird
- webapp behind a vpn
- submit information to start a new release
- gathers info, bumps things, does all the build stuff and checks and starts the release
- should only be acessable by RelEng (for now)
What solutions/approaches were considered other than the proposed solution?
- cont to be a manual solution
Why was this solution chosen?
`
Any security threats already considered in the design and why?
- regular web security issues (CSRF considered)
- authentication - moving to LDAP based authentication using apache (new LDAP group ?)
Threat Brainstorming
- remote code execution
- cover off on web security
{{#set: SecReview feature goal=* This is currently done manually, this project is meant to automate the tasks for release automation
- builds Firefox, Fennec, Thunderbird
- webapp behind a vpn
- submit information to start a new release
- gathers info, bumps things, does all the build stuff and checks and starts the release
- should only be acessable by RelEng (for now)
|SecReview alt solutions=* cont to be a manual solution |SecReview solution chosen=' |SecReview threats considered=* regular web security issues (CSRF considered)
- authentication - moving to LDAP based authentication using apache (new LDAP group ?)
|SecReview threat brainstorming=* remote code execution
- cover off on web security
}}
Action Items
| Action Item Status | In Progress |
| Release Target | ` |
| Action Items | |
| <bugzilla>
{ "id":"812230,812232,812234" } </bugzilla> |
|
{{#set:|SecReview action item status=In Progress
|Feature version=` |SecReview action items=<bugzilla> { "id":"812230,812232,812234" } </bugzilla> }}