do not persist credentials after check out

https://docs.zizmor.sh/audits/#artipacked

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28982)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 2c595e2e09955f529d31ba8555f4e5e78a1e3673..7c548ed8f63cb76efa7771a03bff0bbbdff2b976 100644 (file)
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -45,6 +45,7 @@ jobs:
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
+        persist-credentials: false
     - name: cherry-pick
       if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
       run: |

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 18bc2d47e4080b0966a890e56c360967fb4a2a3e..1e9b606f35470a18c80e1dfb071c1bcae2ce07b8 100644 (file)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
     - name: make build_generated
@@ -48,6 +49,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
     - name: make build_generated
@@ -68,6 +71,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: CPPFLAGS='-std=c99 -D_XOPEN_SOURCE=1 -D_POSIX_C_SOURCE=200809L' ./config --strict-warnings --banner=Configured enable-sslkeylog no-asm no-secure-memory no-makedepend enable-buildtest-c++ enable-fips enable-lms && perl configdata.pm --dump
     - name: make
@@ -77,6 +82,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: localegen
@@ -109,6 +116,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -132,6 +141,8 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings enable-demos enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
@@ -155,6 +166,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0
       with:
@@ -197,6 +210,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -220,6 +235,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -243,6 +260,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -266,6 +285,8 @@ jobs:
     runs-on: macos-14
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -289,6 +310,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -316,6 +339,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -343,6 +368,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -371,6 +398,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -399,6 +428,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -426,6 +457,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: modprobe tls
@@ -451,6 +484,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: modprobe tls
@@ -482,6 +517,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -505,6 +542,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -535,6 +574,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         path: ./source
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
       working-directory: ./source
@@ -576,6 +616,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         path: ./source
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
       working-directory: ./source
@@ -617,6 +658,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         submodules: recursive
+        persist-credentials: false
     - name: package installs
       run: |
         sudo apt-get update
@@ -658,6 +700,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         submodules: recursive
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings --banner=Configured --debug enable-external-tests && perl configdata.pm --dump
     - name: make
@@ -677,6 +720,8 @@ jobs:
       run: |
         dnf install -y perl-FindBin perl-IPC-Cmd perl-File-Compare perl-File-Copy perl-Test-Simple perl-Test-Harness python3 make g++ perl git meson opensc expect kryoptic
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora and pkcs11-provider submodule
       run: |
         git config --global --add safe.directory /__w/openssl/openssl
@@ -708,6 +753,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         submodules: recursive
+        persist-credentials: false
     - name: package installs
       run: |
         sudo apt-get update

diff --git a/.github/workflows/compiler-zoo.yml b/.github/workflows/compiler-zoo.yml
index 55cfd71e1984664633551f298c6e9b77d8cac1da..77f1496ac11f38d5e04c5bdc5e46d1bd369579ec 100644 (file)
--- a/.github/workflows/compiler-zoo.yml
+++ b/.github/workflows/compiler-zoo.yml
@@ -25,6 +25,8 @@ jobs:
         sudo apt-get update
         sudo apt-get -y install ${{ matrix.gcc }}
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -59,6 +61,8 @@ jobs:
         sudo apt-get update || true
         sudo apt-get -y install ${{ matrix.clang }}
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config

diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml
index 9b73829f93d24aa79c99c83fb8beb3277541608c..dd1782e308a59883e8d8aea61463bcf478ed7cf9 100644 (file)
--- a/.github/workflows/coveralls.yml
+++ b/.github/workflows/coveralls.yml
@@ -88,6 +88,7 @@ jobs:
       with:
         submodules: recursive
         ref: ${{ matrix.branches.branch }}
+        persist-credentials: false
     - name: cache commit id
       run: |
         echo "githubid=`/usr/bin/git log -1 --format='%H'`" >>$GITHUB_ENV

diff --git a/.github/workflows/cross-compiles.yml b/.github/workflows/cross-compiles.yml
index 92f45dc01c116b55ac1ee75ebca4193791f2ede6..3d7bfb89a62834123161517cb6ff740b32111207 100644 (file)
--- a/.github/workflows/cross-compiles.yml
+++ b/.github/workflows/cross-compiles.yml
@@ -169,6 +169,8 @@ jobs:
             gcc-${{ matrix.platform.arch }} \
             ${{ matrix.platform.libs }}
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
 

diff --git a/.github/workflows/fips-checksums.yml b/.github/workflows/fips-checksums.yml
index be2b6c7672786ad2ce7cefc7dd3e3091d37fcdf7..22b7da2257ab6747bd4982df7dc398e660999d35 100644 (file)
--- a/.github/workflows/fips-checksums.yml
+++ b/.github/workflows/fips-checksums.yml
@@ -31,6 +31,7 @@ jobs:
           repository: ${{ github.event.pull_request.base.repo.full_name }}
           ref: ${{ github.event.pull_request.base.ref }}
           path: source-pristine
+          persist-credentials: false
       - name: config pristine
         run: ../source-pristine/config enable-fips
         working-directory: ./build-pristine
@@ -46,6 +47,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: source
+          persist-credentials: false
       - name: config
         run: ../source/config enable-fips
         working-directory: ./build
@@ -93,6 +95,7 @@ jobs:
           repository: ${{ github.event.pull_request.base.repo.full_name }}
           ref: ${{ github.event.pull_request.base.ref }}
           path: source-pristine
+          persist-credentials: false
       - name: config pristine
         run: ../source-pristine/config --banner=Configured $BUILD_OPTS && perl configdata.pm --dump
         working-directory: ./build-pristine
@@ -102,6 +105,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: source
+          persist-credentials: false
       - name: config
         run: ../source/config --banner=Configured $BUILD_OPTS && perl configdata.pm --dump
         working-directory: ./build

diff --git a/.github/workflows/fuzz-checker.yml b/.github/workflows/fuzz-checker.yml
index 7648785d5e222742dfeefc8f91531956f81464af..8d7dda78a12815ab916dd4cebe78b587b7fdd89d 100644 (file)
--- a/.github/workflows/fuzz-checker.yml
+++ b/.github/workflows/fuzz-checker.yml
@@ -53,6 +53,8 @@ jobs:
         sudo cat /proc/sys/vm/mmap_rnd_bits
         sudo sysctl -w vm.mmap_rnd_bits=28
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: config
       run: |

diff --git a/.github/workflows/interop-tests.yml b/.github/workflows/interop-tests.yml
index be57d934274626667b5b18d455deb6f978ee29e6..c34a6853b59536895586135a2ea343b6007fabde 100644 (file)
--- a/.github/workflows/interop-tests.yml
+++ b/.github/workflows/interop-tests.yml
@@ -25,6 +25,8 @@ jobs:
       COMPONENT: ${{ matrix.COMPONENT }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Display environment
         run: export
       - name : Install needed tools

diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index 1e2c7f25f7cb2ac3b93036940b6876c3103fbb98..6c3d453c81e62206e6f09999355eac2ee4e35f63 100644 (file)
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -25,6 +25,7 @@ jobs:
         repository: "openssl/openssl"
         token: ${{ secrets.GHE_TOKEN }}
         path: ${{ github.ref_name }}
+        persist-credentials: false
     - name: "Prepare assets"
       run: |
         cd ${{ github.ref_name }}

diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml
index a601018a1c1b0d20d58379f8505ea489b133bb01..9a9caf6c1a49457d6b95dc4e9c9afcc37ec137f9 100644 (file)
--- a/.github/workflows/os-zoo.yml
+++ b/.github/workflows/os-zoo.yml
@@ -37,6 +37,8 @@ jobs:
     - name: install packages
       run: apk --no-cache add build-base perl linux-headers ${{ matrix.cc }}
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: |
         ./config --strict-warnings --banner=Configured no-shared enable-fips \
@@ -87,6 +89,8 @@ jobs:
     container: ${{ matrix.zoo.image }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: install packages
       run: ${{ matrix.zoo.install }}
     - name: config
@@ -111,6 +115,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -139,6 +145,8 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
@@ -181,6 +189,8 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
@@ -197,6 +207,8 @@ jobs:
     if: github.repository == 'openssl/openssl'
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
@@ -215,6 +227,8 @@ jobs:
     if: github.repository == 'openssl/openssl'
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: ./config --strict-warnings enable-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
@@ -233,6 +247,8 @@ jobs:
     if: github.repository == 'openssl/openssl'
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       run: ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
@@ -251,6 +267,8 @@ jobs:
     if: github.repository == 'openssl/openssl'
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: config
       uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0
       with:

diff --git a/.github/workflows/perl-minimal-checker.yml b/.github/workflows/perl-minimal-checker.yml
index 11f4563dcbeeab0e5c4fbaeb05313caf98de53ad..73cdda3ec5e3142bdd921f9968dd5da840b36669 100644 (file)
--- a/.github/workflows/perl-minimal-checker.yml
+++ b/.github/workflows/perl-minimal-checker.yml
@@ -38,6 +38,8 @@ jobs:
         perl -MTest::More -e 'print "$Test::More::VERSION\n"'
         popd
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Build openssl
       run: ./config && make -j $(nproc)
     - name: Install sed

diff --git a/.github/workflows/prov-compat-label.yml b/.github/workflows/prov-compat-label.yml
index 63758d682bf32527532a9301363396e6b8149fe4..e2a5cbf7457e10fb0beceaf83aa8fd35207966aa 100644 (file)
--- a/.github/workflows/prov-compat-label.yml
+++ b/.github/workflows/prov-compat-label.yml
@@ -147,6 +147,7 @@ jobs:
           path: ${{ matrix.branch.dir }}
           repository: openssl/openssl
           ref: ${{ matrix.branch.name }}
+          persist-credentials: false
       - name: localegen
         run: sudo locale-gen tr_TR.UTF-8
 

diff --git a/.github/workflows/provider-compatibility.yml b/.github/workflows/provider-compatibility.yml
index dc4789acb55d6655635414f84f70e67143926db6..4da0d32f40cf0d53af53f3765b241fb8dcbf1e4d 100644 (file)
--- a/.github/workflows/provider-compatibility.yml
+++ b/.github/workflows/provider-compatibility.yml
@@ -159,6 +159,7 @@ jobs:
           path: ${{ matrix.branch.dir }}
           repository: openssl/openssl
           ref: ${{ matrix.branch.name }}
+          persist-credentials: false
       - name: localegen
         run: sudo locale-gen tr_TR.UTF-8
 

diff --git a/.github/workflows/riscv-more-cross-compiles.yml b/.github/workflows/riscv-more-cross-compiles.yml
index 98e85211e08accae7fec8ddc8e2dd873f970cb58..0b27a251b370235669640617f97568e10f41b582 100644 (file)
--- a/.github/workflows/riscv-more-cross-compiles.yml
+++ b/.github/workflows/riscv-more-cross-compiles.yml
@@ -195,6 +195,8 @@ jobs:
             gcc-${{ matrix.platform.arch }} \
             ${{ matrix.platform.libs }}
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
 

diff --git a/.github/workflows/run-checker-ci.yml b/.github/workflows/run-checker-ci.yml
index f2d2d16e595673662e157134ac1564a062b40359..3295c27547ee0cee2d409a1e5038f7e3b76dcddc 100644 (file)
--- a/.github/workflows/run-checker-ci.yml
+++ b/.github/workflows/run-checker-ci.yml
@@ -47,6 +47,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config

diff --git a/.github/workflows/run-checker-daily.yml b/.github/workflows/run-checker-daily.yml
index 1eaa9700d007bf3a189549f07d96eae1ebc35fba..9e55ba2c207575616220b65127f80d2976cef2e3 100644 (file)
--- a/.github/workflows/run-checker-daily.yml
+++ b/.github/workflows/run-checker-daily.yml
@@ -139,6 +139,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -159,6 +161,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Install Dependencies for sctp option
@@ -204,6 +208,8 @@ jobs:
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install brotli libbrotli1 libbrotli-dev
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -227,6 +233,8 @@ jobs:
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install zstd libzstd1 libzstd-dev
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -251,6 +259,8 @@ jobs:
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install zstd libzstd1 libzstd-dev
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -270,6 +280,8 @@ jobs:
     steps:
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Adjust ASLR for sanitizer
       run: |
         sudo cat /proc/sys/vm/mmap_rnd_bits
@@ -297,6 +309,8 @@ jobs:
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install brotli libbrotli1 libbrotli-dev
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -324,6 +338,8 @@ jobs:
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install zstd libzstd1 libzstd-dev
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer
@@ -349,6 +365,8 @@ jobs:
     runs-on: ${{matrix.os}}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -365,6 +383,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -383,6 +403,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer

diff --git a/.github/workflows/run-checker-merge.yml b/.github/workflows/run-checker-merge.yml
index eb98a00a2c1ac3612b984d03acb2a7806d203bbd..0a0b1f18e7e55adb013c68e11c9604dae1b468bb 100644 (file)
--- a/.github/workflows/run-checker-merge.yml
+++ b/.github/workflows/run-checker-merge.yml
@@ -44,6 +44,8 @@ jobs:
         sudo cat /proc/sys/vm/mmap_rnd_bits
         sudo sysctl -w vm.mmap_rnd_bits=28
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
@@ -64,12 +66,15 @@ jobs:
     steps:
     - name: checkout openssl
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout jitter
       uses: actions/checkout@v4
       with:
         repository: smuellerDD/jitterentropy-library
         ref: v3.5.0
         path: jitter
+        persist-credentials: false
     - name: build jitter
       run: make -C jitter/
     - name: checkout fuzz/corpora submodule
@@ -89,6 +94,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: Adjust ASLR for sanitizer

diff --git a/.github/workflows/static-analysis-on-prem.yml b/.github/workflows/static-analysis-on-prem.yml
index d346eab7973505c9324bf59b6cdd6ba9bd09bbd4..058782a15f494c41a8f42a656f30edf2ec233ea4 100644 (file)
--- a/.github/workflows/static-analysis-on-prem.yml
+++ b/.github/workflows/static-analysis-on-prem.yml
@@ -28,6 +28,8 @@ jobs:
         echo ${{ secrets.COVERITY_AUTH_KEY }} | base64 -d > /auth_key_file.txt
         chmod 0600 /auth_key_file.txt
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Config
       run: CC=gcc ./config --strict-warnings --banner=Configured --debug enable-lms enable-fips enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
     - name: Config dump

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index f9bb9b076e7c69976f272300280d531a8f8f867e..84d54cc934b237152da037bd5977305ec8e6e1c5 100644 (file)
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: tool download
       run: |
         wget https://scan.coverity.com/download/linux64 \

diff --git a/.github/workflows/style-checks.yml b/.github/workflows/style-checks.yml
index 69c9ca6c8ef6261b8a6595c1166988715f103627..fe0003b88494291852eb47971d194a8fd3486ad1 100644 (file)
--- a/.github/workflows/style-checks.yml
+++ b/.github/workflows/style-checks.yml
@@ -24,6 +24,7 @@ jobs:
       with:
         fetch-depth: 0
         path: openssl
+        persist-credentials: false
     - name: check style for each commit 
       working-directory: openssl
       shell: bash

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 89e53017f3ed25c58d5890316fff512f61ee31ab..5a2bdfa2974214ae88a2bcd961d66920530f36dc 100644 (file)
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -33,6 +33,8 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
@@ -103,6 +105,8 @@ jobs:
     runs-on: windows-2022
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: prepare the build directory
@@ -142,6 +146,8 @@ jobs:
     runs-on: windows-2022
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: prepare the build directory
@@ -198,6 +204,8 @@ jobs:
     steps:
 # Checkout before cygwin can mess with PATH...
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 #v5
       with:
          packages: perl git make gcc-core

diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml
index 7496c1b7e744bf67eea5601dd16eae79fe0605e3..29786a876d6eaf3b8ad9b84cc644ae8716b7b525 100644 (file)
--- a/.github/workflows/windows_comp.yml
+++ b/.github/workflows/windows_comp.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: windows-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
@@ -89,6 +91,8 @@ jobs:
     runs-on: windows-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm