https://pantsbuild.org/ logo
Join Slack
Powered by
seeing a 404 failure to download "trivy": ```E ...
# development
f
seeing a 404 failure to download "trivy":
Copy code
E       native_engine.IntrinsicError: Client error (404) downloading file trivy_0.57.0_Linux-64bit.tar.gz from <https://github.com/aquasecurity/trivy/releases/download/v0.57.0/trivy_0.57.0_Linux-64bit.tar.gz>
https://github.com/pantsbuild/pants/actions/runs/22559982451/job/65345984543?pr=23121#step:12:556 https://github.com/aquasecurity/trivy/releases/v0.57.0 doesn't have any assets in it besides the usual source code archive.
Apparently, an attacker gained control of their GitHub repository via a 
pull_request_target
workflow: https://github.com/aquasecurity/trivy/discussions/10265
And many prior releases were deleted.
Part of a larger attack on GitHub repositories: https://github.com/aquasecurity/trivy/discussions/10265
w
some irony here, given the target
So often, it's the 
pull_request_target
- I thought Github made changes to prevent some of the threats on that vector, but maybe I imagined it. Pants uses that too in a couple of places with a security note - but I dunno, the fact that so many GH attack vectors start with that specific job 🤷
I wonder if this is related to the hell of a time I've had building scie-pants since yesterday Not even 403's anymore, just : 
Error: io: Peer disconnected
h
A user reported hitting those a bunch
5 Views
Open in Slack
PreviousNext
Powered by