Skip to content

Safe Taskcluster scope proof - #6559

Open
LucasM0ntes wants to merge 2 commits into
mozilla:masterfrom
LucasM0ntes:master
Open

Safe Taskcluster scope proof#6559
LucasM0ntes wants to merge 2 commits into
mozilla:masterfrom
LucasM0ntes:master

Safe Taskcluster scope proof 2

7aa1738
Select commit
Loading
Failed to load commit list.
Community-TC Integration / safe external PR scope proof succeeded Aug 10, 2026 in 5s

Community-TC (pull_request)

Safe proof that an external PR task receives the secret-read scope without reading the secret.

Details

View task in Taskcluster | View logs in Taskcluster | View task group in Taskcluster

Task Status

Started: 2026-08-10T12:07:52.036Z
Resolved: 2026-08-10T12:07:56.835Z
Task Execution Time: 4 seconds, 799 milliseconds
Task Status: completed
Reason Resolved: completed
TaskId: L9AJmsVeTPmHD7nGEq_OfA
RunId: 0

Artifacts

- public/logs/live_backing.log
- public/logs/live.log

[taskcluster 2026-08-10T12:07:52.119Z] Worker Type (proj-bugbug/batch) settings:
[taskcluster 2026-08-10T12:07:52.119Z]   {
[taskcluster 2026-08-10T12:07:52.119Z]     "generic-worker": {
[taskcluster 2026-08-10T12:07:52.119Z]       "config": {
[taskcluster 2026-08-10T12:07:52.119Z]         "headlessTasks": false
[taskcluster 2026-08-10T12:07:52.119Z]       },
[taskcluster 2026-08-10T12:07:52.119Z]       "engine": "multiuser",
[taskcluster 2026-08-10T12:07:52.119Z]       "go-arch": "amd64",
[taskcluster 2026-08-10T12:07:52.119Z]       "go-os": "linux",
[taskcluster 2026-08-10T12:07:52.119Z]       "go-version": "go1.26.2",
[taskcluster 2026-08-10T12:07:52.119Z]       "release": "https://github.com/taskcluster/taskcluster/releases/tag/v99.1.0",
[taskcluster 2026-08-10T12:07:52.119Z]       "revision": "c76d61efe4bdc1a05bcec848739cd41ebf061f01",
[taskcluster 2026-08-10T12:07:52.119Z]       "source": "https://github.com/taskcluster/taskcluster/commits/c76d61efe4bdc1a05bcec848739cd41ebf061f01",
[taskcluster 2026-08-10T12:07:52.119Z]       "version": "99.1.0"
[taskcluster 2026-08-10T12:07:52.119Z]     },
[taskcluster 2026-08-10T12:07:52.119Z]     "image": "projects/community-tc-workers/global/images/generic-worker-ubuntu-24-04-aaynirqnxlbwcojgnbeo",
[taskcluster 2026-08-10T12:07:52.119Z]     "instance-id": "8135717768844804202",
[taskcluster 2026-08-10T12:07:52.119Z]     "instance-type": "projects/757942385826/machineTypes/n2-standard-2",
[taskcluster 2026-08-10T12:07:52.119Z]     "local-ipv4": "10.142.0.4",
[taskcluster 2026-08-10T12:07:52.119Z]     "machine-setup": {
[taskcluster 2026-08-10T12:07:52.119Z]       "maintainer": "taskcluster-notifications+workers@mozilla.com",
[taskcluster 2026-08-10T12:07:52.119Z]       "script": "https://raw.githubusercontent.com/taskcluster/community-tc-config/b5b7c2ad856c144a6759e6e72280c4a958f8a930/imagesets/generic-worker-ubuntu-24-04/bootstrap.sh"
[taskcluster 2026-08-10T12:07:52.119Z]     },
[taskcluster 2026-08-10T12:07:52.119Z]     "project-id": "community-tc-workers",
[taskcluster 2026-08-10T12:07:52.119Z]     "public-hostname": "proj-bugbug-batch-pgunja84rjotwvc-dbgizw.c.community-tc-workers.internal",
[taskcluster 2026-08-10T12:07:52.119Z]     "public-ipv4": "34.74.46.221",
[taskcluster 2026-08-10T12:07:52.119Z]     "region": "us-east1",
[taskcluster 2026-08-10T12:07:52.119Z]     "zone": "us-east1-b"
[taskcluster 2026-08-10T12:07:52.119Z]   }
[taskcluster 2026-08-10T12:07:52.119Z] Task ID: L9AJmsVeTPmHD7nGEq_OfA
[taskcluster 2026-08-10T12:07:52.119Z] === Task Starting ===
[taskcluster 2026-08-10T12:07:53.888Z] [d2g] Loading docker image
[taskcluster 2026-08-10T12:07:55.136Z] [d2g] Loaded docker image "docker.io/curlimages/curl:latest"
[taskcluster 2026-08-10T12:07:55.137Z] Executing command 0: docker run -t --name taskcontainer_EnLLN5TdTfiRbKlUY-CszA --memory-swap -1 --pids-limit -1 --pull=never --log-driver=none '--add-host=localhost.localdomain:127.0.0.1' --add-host=taskcluster:host-gateway --env-file 'env.list' curlimages/curl:latest /bin/sh -c 'echo "SAFE POC: checking effective scopes only"
[taskcluster 2026-08-10T12:07:55.137Z] echo "This task does NOT read the secret value"
[taskcluster 2026-08-10T12:07:55.137Z] curl -sS "$TASKCLUSTER_PROXY_URL/api/auth/v1/scopes/current" > scopes.json
[taskcluster 2026-08-10T12:07:55.137Z] echo "Looking for the sensitive scope:"
[taskcluster 2026-08-10T12:07:55.137Z] grep -F "secrets:get:project/bugbug/integration" scopes.json
[taskcluster 2026-08-10T12:07:55.137Z] echo "Done"
[taskcluster 2026-08-10T12:07:55.137Z] '
SAFE POC: checking effective scopes only
This task does NOT read the secret value
Looking for the sensitive scope:
    "secrets:get:project/bugbug/integration",
Done
[taskcluster 2026-08-10T12:07:56.255Z]                        Exit Code: 0
[taskcluster 2026-08-10T12:07:56.255Z]                        User Time: 8.342ms
[taskcluster 2026-08-10T12:07:56.255Z]                      Kernel Time: 17.612ms
[taskcluster 2026-08-10T12:07:56.255Z]                        Wall Time: 1.117382892s
[taskcluster 2026-08-10T12:07:56.255Z]  Average Available System Memory: 7.03 GiB
[taskcluster 2026-08-10T12:07:56.255Z]       Average System Memory Used: 733.23 MiB
[taskcluster 2026-08-10T12:07:56.255Z]          Peak System Memory Used: 737.34 MiB
[taskcluster 2026-08-10T12:07:56.255Z]              Total System Memory: 7.75 GiB
[taskcluster 2026-08-10T12:07:56.255Z]                           Result: SUCCEEDED
[taskcluster 2026-08-10T12:07:56.256Z] === Task Finished ===
[taskcluster 2026-08-10T12:07:56.256Z] Task Duration: 1.118615627s
View more details on Community-TC Integration