nodejs / nodejs/node-core-utils
Consider encrypting .ncurc with a passphrase
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 314
- Forks
- 137
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 24
Description
Since it contains tokens (though in general just read permissions of the org and the jenkins), it would be safer if we encrypt it with a passphrase (in case some malicious code gets access to the user's home directory), and perhaps warn if the read permission of it is too generous, similar to how the ssh keys are protected.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating how .ncurc is read and how the existing SSH-key permission protection works. Determine the expected passphrase workflow and warning behavior for overly permissive file access. Done means the security approach is agreed and implemented with coverage for encrypted credentials and permission warnings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100