Security Overview

devops-lib is a Jenkins Shared Library — not a web service. It has no HTTP endpoints, no user-facing auth, and no persistent storage. Security properties concern how secrets are handled, what trust boundaries exist, and what rules new code must follow.

Trust boundaries

Build trigger gate

Every build is hard-rejected unless triggered by one of:

ringmaster-bot — Ringmaster's automated trigger
turbo-turtle — Turbo-Turtle's CI callback trigger
A hardcoded allowedUsers list of DevOps engineer email addresses

The gate runs at vars/eksCICD.groovy:call before any pipeline logic. There is no warning mode — unauthorized triggers abort immediately.

Supply chain boundary (highest risk)

devops-lib@main is loaded via @Library('devops-lib@main') by every Meesho microservice on every build. A malicious or buggy merge to main affects all 100+ consumer services' CI/CD pipelines. Any change to vars/eksCICD.groovy or src/com/meesho/utilities/constructParam.groovy must be treated as Tier-1 code — these files control every build.

Whitelist repo boundary

Policy exceptions (sonar skip, multizone, AppConfig, CAC) are fetched from Meesho/whitelists at build time via the cicd-github-app credential. If the whitelist repo is compromised, an attacker could grant or revoke policy exceptions for any service. See ADR-0003 for why exceptions live in a separate repo.

Credential handling

All secrets are injected via Jenkins withCredentials — never hardcoded, never in env.* beyond the immediate operation:

Credential ID	Used for
`cicd-github-app`	Cloning `Meesho/whitelists`, `devops-argo-config`, `devops-helm-charts`
`svc-devops-meesho`	GitHub API, JFrog Artifactory
`ringmaster-token`	Ringmaster callback API
`argocd-{bu}-prd-creds` / `argocd-dev-creds`	ArgoCD CLI login
`vault-prd-token` / `vault-dev-token`	Vault secret fetch
`sonar-token-prod` / `sonar-token-{bu}-dev`	SonarQube analysis

set +x guard: deployArgoCD.groovy:493 uses set +x before any sh() that includes a credential argument. Without this, Jenkins echoes the full shell command — including the credential value — to the build log.

Vault token lifecycle: env.VAULT_TOKEN is set temporarily at src/com/meesho/stages/buildNode.groovy:548–553 and cleared immediately after the Vault fetch completes. It is not stored beyond the immediate use.

Outbound calls

All external calls go FROM Jenkins agents TO external services. Protocol classification:

Service	Protocol	Risk
ArgoCD	HTTPS + gRPC	Low — `set +x` guards password
Ringmaster	HTTPS	Low — auth via `ringmaster-token`
SonarQube, Vault, GitHub	HTTPS	Low
Turbo-Turtle, Deployment Tracker	HTTP (plain)	Low — internal VPC, accepted risk
Security scanner (`172.31.5.29:63232`)	HTTP (plain)	Low — internal, hardcoded IP

Security rules for new code

Credentials: Use withCredentials only. Never assign credential values outside a withCredentials block. Never interpolate credentials into log statements.
Shell guard: Use set +x before any sh() that includes a credential as an argument.
Policy enforcement: Never add inline repo-level policy exceptions — all exceptions go through Meesho/whitelists (see ADR-0003).
Supply chain hygiene: Extra scrutiny for vars/eksCICD.groovy and src/com/meesho/utilities/constructParam.groovy — changes affect every Meesho microservice build.
DinD image: Must use the internal GAR-hosted DinD image, not Docker Hub docker:N-dind.

Data classification

devops-lib handles no end-user PII. All data is build metadata (repo name, image tag, environment, team). Credential values are never logged.

Known security debt

ID	Gap	Severity
SEC-DL-001	`allowedUsers` list has no expiry — stale access risk for departed engineers	Low
SEC-DL-002	No `.github/CODEOWNERS` — supply chain protection depends on repo settings not auditable from source	Medium
SEC-DL-003	Security scanner endpoint hardcoded as `172.31.5.29:63232` — silent failure if IP changes	Low
SEC-DL-004	`env.VAULT_TOKEN` briefly in Jenkins serialized state during fetch	Low
SEC-DL-005	Turbo-Turtle and Deployment Tracker callbacks over plain HTTP	Low

Full details: docs/SECURITY.md

ADR index — architectural decisions that drive security properties (ADR-0003, ADR-0004, ADR-0006)
Whitelist system — policy exception enforcement
Ringmaster integration — trigger gate flow
Config and Policy — constructParam and credential injection

5.2 KiB Raw Blame History Unescape Escape