| 1 | //! Trusting the certificate a sandbox's HTTPS is re-signed with. |
| 2 | //! |
| 3 | //! When a sandbox's network is restricted by its project's guardrails (or a |
| 4 | //! workflow job may be given brokered secrets), its HTTP and HTTPS pass the |
| 5 | //! runner Worker, which re-signs HTTPS with a certificate Cloudflare puts in |
| 6 | //! the sandbox. The network list, the credentials a sandbox holds, and |
| 7 | //! branch protection on g1t's side are what bound a sandbox's work. |
| 8 | |
| 9 | use std::path::Path; |
| 10 | use std::process::{Command, Stdio}; |
| 11 | |
| 12 | /// The certificate the sandbox's HTTPS is re-signed with, when it is guarded. |
| 13 | const EGRESS_CA: &str = "/etc/cloudflare/certs/cloudflare-containers-ca.crt"; |
| 14 | |
| 15 | /// Runs a command as root without asking. False where that is not allowed. |
| 16 | fn sudo(args: &[&str]) -> bool { |
| 17 | Command::new("sudo") |
| 18 | .arg("-n") |
| 19 | .args(args) |
| 20 | .stdin(Stdio::null()) |
| 21 | .stdout(Stdio::null()) |
| 22 | .stderr(Stdio::null()) |
| 23 | .status() |
| 24 | .is_ok_and(|status| status.success()) |
| 25 | } |
| 26 | |
| 27 | /// Trusts the certificate a guarded sandbox's HTTPS is re-signed with, so |
| 28 | /// that git, package managers and this program can reach allowed hosts. |
| 29 | /// Does nothing in a sandbox whose network is open. Called first thing, |
| 30 | /// before any request is made. |
| 31 | pub fn trust_egress_ca() { |
| 32 | const TRUSTED: &str = "/usr/local/share/ca-certificates/cloudflare-containers-ca.crt"; |
| 33 | // Once per sandbox. |
| 34 | if !Path::new(EGRESS_CA).exists() || Path::new(TRUSTED).exists() { |
| 35 | return; |
| 36 | } |
| 37 | let trusted = sudo(&["cp", EGRESS_CA, TRUSTED]) && sudo(&["update-ca-certificates"]); |
| 38 | if !trusted { |
| 39 | eprintln!("g1t-runner: could not trust the sandbox's egress certificate; HTTPS will fail"); |
| 40 | } |
| 41 | } |