Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pass environment through to go language programs #1965

Merged
merged 1 commit into from
Sep 20, 2018

Conversation

justone
Copy link
Contributor

@justone justone commented Sep 20, 2018

This allows those programs to use authentication credentials that are
in the environment to perform extra work.

@justone
Copy link
Contributor Author

justone commented Sep 20, 2018

There are, of course, security implications for passing through the entire environment, especially in light of the scenario where someone is running a stack binary that they didn't create themselves (i.e. purchased from someone or downloaded from github).

This allows those programs to use authentication credentials that are
in the environment to perform extra work.
@swgillespie swgillespie self-requested a review September 20, 2018 22:08
@swgillespie
Copy link
Contributor

There are, of course, security implications for passing through the entire environment, especially in light of the scenario where someone is running a stack binary that they didn't create themselves (i.e. purchased from someone or downloaded from github).

Our threat model has been that a user's program is entirely trusted, since the user should be in control of their own system. I think this is fine if we assume that model.

Copy link
Contributor

@swgillespie swgillespie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you!

@swgillespie swgillespie merged commit 0ea261b into pulumi:master Sep 20, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants