snuyanzin commented on code in PR #29294:
URL: https://github.com/apache/flink/pull/29294#discussion_r4106456044
##########
.github/workflows/docs-legacy.yml:
##########
@@ -76,20 +76,24 @@ jobs:
bash -c "./build_docs.sh"
- name: Build documentation
+ # The build runs as root, the upload below as the runner user, hence
the chmod
run: |
docker run --rm \
--volume "$PWD:/root/flink" \
--volume "$HOME/.m2/repository:/root/.m2/repository" \
apache/flink-ci-docker:java_8_11_17_21_25_maven_386_3916_noble \
- bash -c "apt-get update && apt-get install -y rsync && cd
/root/flink && ./.github/workflows/docs.sh"
+ bash -c "apt-get update && apt-get install -y rsync && cd
/root/flink && ./.github/workflows/docs.sh && chmod -R a+rX docs/target"
- name: Upload documentation
- uses:
burnett01/rsync-deployments@66257cad6bfeb2171d3b6bfa6c9a22279dd9c3a1 # 8.0.5
- with:
- switches: --archive --compress --delete --omit-dir-times
- path: docs/target/
- remote_path: ${{ secrets.NIGHTLIES_RSYNC_PATH
}}/flink/flink-docs-${{ env.flink_branch }}/
- remote_host: ${{ secrets.NIGHTLIES_RSYNC_HOST }}
- remote_port: ${{ secrets.NIGHTLIES_RSYNC_PORT }}
- remote_user: ${{ secrets.NIGHTLIES_RSYNC_USER }}
- remote_key: ${{ secrets.NIGHTLIES_RSYNC_KEY }}
+ env:
+ NIGHTLIES_RSYNC_HOST: ${{ secrets.NIGHTLIES_RSYNC_HOST }}
+ NIGHTLIES_RSYNC_KEY: ${{ secrets.NIGHTLIES_RSYNC_KEY }}
+ NIGHTLIES_RSYNC_PATH: ${{ secrets.NIGHTLIES_RSYNC_PATH }}
+ NIGHTLIES_RSYNC_PORT: ${{ secrets.NIGHTLIES_RSYNC_PORT }}
+ NIGHTLIES_RSYNC_USER: ${{ secrets.NIGHTLIES_RSYNC_USER }}
+ run: |
+ eval "$(ssh-agent -s)"
Review Comment:
There is check that the docs server is the real one.
By default it is `StrictHostKeyChecking=no` which means it makes SSH connect
without verifying the server, so anyone who hijacks DNS/network can impersonate
it.
How about adding host key something like
`NIGHTLIES_RSYNC_HOST_KEY: ${{ secrets.NIGHTLIES_RSYNC_HOST_KEY }}`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
