Re: [eclipse.org-committers] Malicious executable content in Gerrit cont

[Shawn Pearce <sop@xxxxxxxxxx>]

On Wed, Dec 10, 2014 at 7:35 AM, Mike Milinkovich <mike.milinkovich@xxxxxxxxxxx> wrote:

Denis,

Surely this is an issue that affects Gerrit as a whole? Have you also addressed this concern to their community mailing list? I would expect that other projects that use Gerrit (e.g. Android, OpenStack) would be even larger targets that Eclipse, and may have already arrived at an approach.

Android certainly has. Android runs each change in its own, brand new, network isolated virtual machine. The system is built on top of Google Compute Engine to spin-up and tear-down new VMs rapidly.

I don't know what OpenStack does.

Chromium OS has taken the approach of requiring a trusted committer to review the change and +1 it before it goes to the build farm.

 

On 10/12/2014 8:54 AM, Denis Roy wrote:

Well, the moment I've been dreading has finally come... malicious virus/malware is now in our Gerrit database.

_______________________________________________
eclipse.org-committers mailing list
eclipse.org-committers@eclipse.org
https://dev.eclipse.org/mailman/listinfo/eclipse.org-committers

IMPORTANT: Membership in this list is generated by processes internal to the Eclipse Foundation.  To be permanently removed from this list, you must contact emo@xxxxxxxxxxx to request removal.