Overview
This article explores how Palantir secures its source control as part of its software supply chain security strategy. It discusses various risk considerations and mitigations, including commit signing, code review enforcement, and permission management.
What You'll Learn
1
How to implement git commit signing using hardware keys
2
Why code reviews are essential for preventing malicious code introduction
3
How to enforce role-based access control in GitHub Enterprise
Prerequisites & Requirements
- Understanding of source control and security principles
- Familiarity with GitHub Enterprise and commit signing processes(optional)
Key Questions Answered
How does Palantir implement commit signing for source control?
Palantir implements commit signing by requiring cryptographic signatures from hardware keys, specifically YubiKeys, which must be physically touched to authorize signing. This process ensures that only authenticated users can commit code, thereby enhancing security against unauthorized access.
What role does code review play in source control security?
Code review serves as a critical control against malicious code introduction by requiring trusted reviewers to examine changes. This process helps identify vulnerabilities regardless of the author's intentions, thereby enhancing overall code integrity.
What security measures are in place for GitHub Enterprise permissions?
Palantir employs a role-based access control model in GitHub Enterprise, prohibiting developers from holding owner roles to prevent bypassing security settings. Developers are granted maintainer permissions, allowing them to approve PRs without compromising security configurations.
How does Palantir ensure the integrity of its release process?
Palantir uses an internal tool called Autorelease to manage tagging and releasing code. This tool enforces rules on which branches can be tagged and who can trigger releases, ensuring that only compliant code is deployed to production environments.
Technologies & Tools
Security
Yubikey
Used for hardware-backed commit signing to enhance security.
Source Control
Github Enterprise
Platform used for managing source code and implementing security measures.
Static Analysis
Codeql
Tool used for scanning pull requests and releases to identify vulnerabilities.
Key Actionable Insights
1Implement hardware-backed commit signing to enhance source control security.Using hardware keys like YubiKeys for commit signing ensures that only authorized users can perform commits, significantly reducing the risk of unauthorized code changes.
2Enforce strict code review policies to catch vulnerabilities early.By requiring code reviews from trusted individuals, organizations can mitigate risks associated with insider threats and ensure code quality before merging changes.
3Utilize role-based access control to limit permissions in GitHub Enterprise.Restricting developer roles to maintainer status prevents unauthorized changes to security settings, thereby maintaining a secure development environment.
Common Pitfalls
1
Relying solely on commit signing without additional security measures.
Commit signing does not prevent malicious code from being introduced by insiders or compromised machines. It is essential to combine it with code reviews and static analysis to mitigate these risks.