How can developers give neurocontainers' CI access to their repositories?

[civier]

@stebo85 @aswinnarayanan
I am working on container where the code needs to be downloaded from a private repository (https://github.com/pelednoam/mmvt). Despite what is stated on the README, the developer is ok with including it in Neurodesk, and he invited me (@civier) to the repository so I can clone it for installation, but I wonder if it is possible to invite the Github user that is used in the CI? (or if there is another way for the developer to invite the CI to access the code?)
Also, after the invitation I had to log in to Github and accept it. How is it done for the CI Github user? If I just need to log in and accept, please send me the username and password (my mobile is in my signature), or I can let you know when the invitation is sent.
Also -- does the CI use a Github personal access code, or how does it work exactly?
(I think that it will be good that I know more about the CI for this, for the talk, and in general, so if you want to send me some explanation on how you set up things, that would be great)

Thanks ahead,
Oren

[stebo85]

I would say that it is not a good idea to grant access to the CI for security reasons (e.g. our CI could cause damage in an external repo if compromised).

[civier]

Isn't the invitation I got to the repo is read-only? It says that I need to fork it to make changes:

The invitation of the CI will be read-only as well. Isn't it?

[stebo85]

ok, if it's read-only access, then this would cause less potential problems. However, our CI would be able to read the code and expose it to anyone.

[aswinnarayanan]

Hi @civier. Agreed.
The CI service user can have a personal access token with read-only on the private repo. This would mitigate most risks of the CI damaging the repo.

But risk of code exposure cannot be mitigated, as this could happen accidentally and anyone with write in neurocontainers can cause this.

Also, depending on how the package installs, parts or whole source code may be in the container) (on dockerhub, github registry, cvmfs, mirrors etc). It'll not be possible to scrub from the internet once uploaded.

The developer might need to know this risk profile before making an informed decision.

[aswinnarayanan]

On a side note, this is an interesting case. Maybe we need to write out this policy and information alongside the sustainability page @stebo85

[civier]

OK. I will ask the developer if he's ok with it.
When you say "expose it to anyone", do you mean in case of a security breach, or do you mean it will be exposed to anyone on the Neurodesk project? If the latter, why is it so? (I thought the CI is administrated by you and Aswin only)

If the developer is ok with it, what user should he invite exactly?

[stebo85]

The CI could be manipulated with a pull request to download the code and send it somewhere I believe without much work required.

In addition, the code will be publicly visible in the container after it was built.

[aswinnarayanan]

@civier Didn't see this new thread. Just copying my answer over.

The CI service user can have a personal access token with read-only on the private repo. This would mitigate most risks of the CI damaging the repo.

But risk of code exposure cannot be mitigated, as this could happen accidentally and anyone with write in neurocontainers can cause this.
Also, depending on how the package installs, parts or whole source code may be in the container) (on dockerhub, github registry, cvmfs, mirrors etc). It'll not be possible to scrub from the internet once uploaded.

I had quick look at the mmvt policy (below). It looks like one of the reason's the repo is private is to enable commercial access to commercial users while giving private access to academic users.
Please Note: Neurodesk doesn't currently have any mechanisms to control the user access, so commercial user will be technically able to use Neurodesk to run mmvt with our existing configuration once uploaded.

[civier]

@pelednoam
Hi Noam,
I thought of providing the Neurodesk's CI access to MMVT, so we can build MMVT on our CI (this is our standard container building practice).
However, Steffen Bollmann (the brain behind Neurodesk; @stebo85) advised me that the MMVT code could be breached if we provide to the CI access, even if it's read only. See Steffen's comment above.
Are you ok with that? If not, we could consider other solutions I guess.
Best,
Oren

[aswinnarayanan]

Hi @pelednoam

Thanks for providing the mmvt tool onto to the Neurodesk platform

Please note the discussion above #157 (comment)
If you're happy for the code to be deployed onto publicly accessible containers...

I think all we is the following user https://github.com/vnm-neurodesk to have readonly access to the mmvt repository.
Then @civier will be able to integrate it to the container CI pipeline.

Let us know if you have any queries

[civier]

@stebo85 @aswinnarayanan

After vnm-neurodesk is invited to the MVTT repository, and we approve the invitation, I just wonder how do I access it in the scripts that run on the CI.
I checked how we access OUR copy of neurodocker in main_setup.sh, and I see that there is no password/certificate/token provided (or do you make it available through some environment variable, etc.?):
python -m pip install --no-cache-dir https://github.com/NeuroDesk/neurodocker/tarball/master --upgrade
Would I be able to access mvtt similarly, i.e.:
git clone https://vnm-neurodesk@github.com/mmvt/mmvt.git
Or is it different because it is still a repository EXTERNAL to our organisation?

Thanks ahead,
Oren

[aswinnarayanan]

Hi @civier, I'll take a look and get back to you on this

[civier]

Hi @aswinnarayanan The developer will be busy until the week of the 25/4, so hopefully you can look at it by then.
Thanks ahead,
Oren

[civier]

@stebo85 @aswinnarayanan
I spoke with the developer, and he's happy with giving the CI a read-only access to his repository.
Can you post here instructions for how he should do it exactly, and what should I do to approve it?
Thanks.

[pelednoam]

Thanks! Let me first remove several proprietary algorithms from the repo. Best, Noam

…

On Wed, Mar 16, 2022 at 8:44 PM Aswin Narayanan ***@***.***> wrote: Hi @pelednoam <https://github.com/pelednoam> Thanks for providing the mmvt tool onto to the Neurodesk platform Please note the discussion above #157 (comment) <#157 (comment)> If you're happy for the code to be deployed onto publicly accessible containers... I think all we is the following user https://github.com/vnm-neurodesk to have readonly access to the mmvt repository. Then @civier <https://github.com/civier> will be able to integrate it to the container CI pipeline. Let us know if you have any queries — Reply to this email directly, view it on GitHub <#157 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAMRKKZCP3IMBIPNSMEUEK3VAJ57JANCNFSM5Q2R3XUA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.Message ID: <NeuroDesk/neurodesk.github.io/repo-discussions/157/comments/2376906@ github.com>