Skip to content

Conversation

@fr4nc1sc0-r4m0n
Copy link
Contributor

What does this pull request do?

After a deep analysis, remove explicit cache usage in release related workflow to reduce the cache poisoning vector attack.

In the context of Docker builds, the docker/setup-buildx-action is caching binaries by default.
If a workflow running untrusted code has access to the cache, it can poison the cache with malicious content. For example, a compromised dependency could inject malicious code into a Golang binary or Docker image, which would then be included in subsequent builds using the same cache key.

This attack is particularly dangerous because the malicious artefact can be signed and distributed as part of an SLSA Level 3 build, leaving no trace in the source code or build logs.

@fr4nc1sc0-r4m0n fr4nc1sc0-r4m0n self-assigned this Jan 29, 2026
@fr4nc1sc0-r4m0n fr4nc1sc0-r4m0n requested review from a team as code owners January 29, 2026 12:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants