> Generated 2026-05-12 at base-sha d6708eca4236. Type: concept. 1 source. # Security Overview devops-lib is a Jenkins Shared Library — not a web service. It has no HTTP endpoints, no user-facing auth, and no persistent storage. Security properties concern how secrets are handled, what trust boundaries exist, and what rules new code must follow. ## Trust boundaries ### Build trigger gate Every build is hard-rejected unless triggered by one of: - `ringmaster-bot` — Ringmaster's automated trigger - `turbo-turtle` — Turbo-Turtle's CI callback trigger - A hardcoded `allowedUsers` list of DevOps engineer email addresses The gate runs at `vars/eksCICD.groovy:call` before any pipeline logic. There is no warning mode — unauthorized triggers abort immediately. ### Supply chain boundary (highest risk) `devops-lib@main` is loaded via `@Library('devops-lib@main')` by every Meesho microservice on every build. **A malicious or buggy merge to `main` affects all 100+ consumer services' CI/CD pipelines.** Any change to `vars/eksCICD.groovy` or `src/com/meesho/utilities/constructParam.groovy` must be treated as Tier-1 code — these files control every build. ### Whitelist repo boundary Policy exceptions (sonar skip, multizone, AppConfig, CAC) are fetched from `Meesho/whitelists` at build time via the `cicd-github-app` credential. If the whitelist repo is compromised, an attacker could grant or revoke policy exceptions for any service. See [ADR-0003](../adr/adr-index.md) for why exceptions live in a separate repo. ## Credential handling All secrets are injected via Jenkins `withCredentials` — never hardcoded, never in `env.*` beyond the immediate operation: | Credential ID | Used for | |---|---| | `cicd-github-app` | Cloning `Meesho/whitelists`, `devops-argo-config`, `devops-helm-charts` | | `svc-devops-meesho` | GitHub API, JFrog Artifactory | | `ringmaster-token` | Ringmaster callback API | | `argocd-{bu}-prd-creds` / `argocd-dev-creds` | ArgoCD CLI login | | `vault-prd-token` / `vault-dev-token` | Vault secret fetch | | `sonar-token-prod` / `sonar-token-{bu}-dev` | SonarQube analysis | **`set +x` guard**: `deployArgoCD.groovy:493` uses `set +x` before any `sh()` that includes a credential argument. Without this, Jenkins echoes the full shell command — including the credential value — to the build log. **Vault token lifecycle**: `env.VAULT_TOKEN` is set temporarily at `src/com/meesho/stages/buildNode.groovy:548–553` and cleared immediately after the Vault fetch completes. It is not stored beyond the immediate use. ## Outbound calls All external calls go FROM Jenkins agents TO external services. Protocol classification: | Service | Protocol | Risk | |---|---|---| | ArgoCD | HTTPS + gRPC | Low — `set +x` guards password | | Ringmaster | HTTPS | Low — auth via `ringmaster-token` | | SonarQube, Vault, GitHub | HTTPS | Low | | Turbo-Turtle, Deployment Tracker | **HTTP** (plain) | Low — internal VPC, accepted risk | | Security scanner (`172.31.5.29:63232`) | **HTTP** (plain) | Low — internal, hardcoded IP | ## Security rules for new code 1. **Credentials**: Use `withCredentials` only. Never assign credential values outside a `withCredentials` block. Never interpolate credentials into log statements. 2. **Shell guard**: Use `set +x` before any `sh()` that includes a credential as an argument. 3. **Policy enforcement**: Never add inline repo-level policy exceptions — all exceptions go through `Meesho/whitelists` (see [ADR-0003](../adr/adr-index.md)). 4. **Supply chain hygiene**: Extra scrutiny for `vars/eksCICD.groovy` and `src/com/meesho/utilities/constructParam.groovy` — changes affect every Meesho microservice build. 5. **DinD image**: Must use the internal GAR-hosted DinD image, not Docker Hub `docker:N-dind`. ## Data classification devops-lib handles no end-user PII. All data is build metadata (repo name, image tag, environment, team). Credential values are never logged. ## Known security debt | ID | Gap | Severity | |---|---|---| | SEC-DL-001 | `allowedUsers` list has no expiry — stale access risk for departed engineers | Low | | SEC-DL-002 | No `.github/CODEOWNERS` — supply chain protection depends on repo settings not auditable from source | Medium | | SEC-DL-003 | Security scanner endpoint hardcoded as `172.31.5.29:63232` — silent failure if IP changes | Low | | SEC-DL-004 | `env.VAULT_TOKEN` briefly in Jenkins serialized state during fetch | Low | | SEC-DL-005 | Turbo-Turtle and Deployment Tracker callbacks over plain HTTP | Low | Full details: [`docs/SECURITY.md`](../../../SECURITY.md) ## Related concepts - [ADR index](../adr/adr-index.md) — architectural decisions that drive security properties (ADR-0003, ADR-0004, ADR-0006) - [Whitelist system](../policy/whitelist-system.md) — policy exception enforcement - [Ringmaster integration](../deploy/ringmaster-integration.md) — trigger gate flow - [Config and Policy](../06-CONFIG-POLICY.md) — constructParam and credential injection ## Notes