<urja[m]>
Apparently, when you're reading through the codebase to understand how to write applets, eventually you will find something lol (as in, i wasnt intending to touch ice40_flash, i was just reading it...)
<asjackson>
^ i saw a while back that there may have been plans to remove the analyzer applet, but i still use it a lot, and do find it quite handy for getting a quick trace of things.
<whitequark[cis]>
we had a bunch of bulk editing done recently to port stuff to amaranth 0.5
<whitequark[cis]>
i built a system that reproducibly builds Glasgow firmware and ensures nobody can check in a blob that doesn't exactly match the soruce in the repository
<whitequark[cis]>
but! the github action that i've used to detect whether the code matches had been maliciously modified with a credential stealer that prints the token (in base64) in the logs https://github.com/advisories/GHSA-mrrh-fwg8-r2c3
<whitequark[cis]>
i manually checked it and the token for GlasgowEmbedded org was in fact exposed in the logs in two builds triggered during March 15
<whitequark[cis]>
they have a SW1kcGRHaDFZbDkwYjJ0bGJpSTZleUoyWVd4MVpTSTZJbWRvYzE5U1NVaDRlVUoyVGxKMVpuTnJXSFpWUjFaRFNsZzJWR04yYWs1UU0xTXpPVnBaTkVVaUxDSnBjMU5sWTNKbGRDSTZkSEoxWlgwS0luTjVjM1JsYlM1bmFYUm9kV0l1ZEc5clpXNGlPbnNpZG1Gc2RXVWlPaUpuYUhOZlVrbEllSGxDZGs1U2RXWnphMWgyVlVkV1EwcFlObFJqZG1wT1VETlRNemxhV1RSRklpd2lhWE5UWldOeVpYUWlPblJ5ZFdWOUNnPT0= blob in them
<_whitenotifier-2>
[glasgow] github-merge-queue[bot] created branch gh-readonly-queue/main/pr-779-d32e89038c9a1c770a51ff83079b1c865144c93e - https://github.com/GlasgowEmbedded/glasgow
galibert[m] has joined #glasgow
<galibert[m]>
Ouch
<whitequark[cis]>
i did a little incident response just now and the conclusion is that it's fine; the token didn't have enough privileges to do anything but push to the repository, and pushes to even the main branch are gated on pull requests (and are logged in this IRC channel), so it's not like anybody could have done anything with it
GNUmoon has quit [Remote host closed the connection]
GNUmoon has joined #glasgow
<asjackson>
please excuse my noobiness... i wanted to see if i could add triggering to the analyzer applet, is what im doing possible in the way i am trying to do it?