Description
@grmpyninja pointed out that our pulumi config was injecting the wrong variable into our azure variable group
@beckermr reports:
The binstar token in azure was always supposed to be the staging one. When the pulumi stuff was done, someone put in the prod one.
And we missed it on code review.
The reason the variable name was kept was to be backwards compatible with smithy.
This bug meant that any feedstock maintainer could upload a package to the conda-forge channel, bypassing our feedstock-token + upload process.
Investigation
@jaimergp checked the security logs on anaconda.org to check for any packages that were not copied from the cf-staging to the conda-forge channel. We found NONE. This check is not completely robust, but it does indicate that nothing was obviously compromised.
beckermr Remediation developer
jaimergp Remediation developer
grmpyninja Finder
Description
@grmpyninja pointed out that our pulumi config was injecting the wrong variable into our azure variable group
@beckermr reports:
This bug meant that any feedstock maintainer could upload a package to the conda-forge channel, bypassing our feedstock-token + upload process.
Investigation
@jaimergp checked the security logs on anaconda.org to check for any packages that were not copied from the
cf-stagingto theconda-forgechannel. We found NONE. This check is not completely robust, but it does indicate that nothing was obviously compromised.