Audit trail for CI

[orangemocha]

Based on discussion at the last Build WG meeting, we might want to implement an audit trail to record commits that are run through CI, so that we can actively or re-actively identify potential malicious actions.

Let us discuss here how we could implement that.

[orangemocha]

Here's an idea... Jenkins already provides a (limited) job history, but the job parameters only include git references that can be deleted after the job is run. I am thinking we could push every change that gets submitted to a dedicated repo, with a tag name that includes:

• The jenkins run id
• The user id that started the Jenkins job.
• Timestamp

Problems to solve:

1. The audit repo would get big. Is there a way to push to it without having to fetch the whole thing each time?
2. How to ensure this push is performed for any CI job, without doing it multiple times for the same change. Keep in mind that users can launch node-test-commit, node-test-commit-linux, or just any subjob.

[joaocgreis]

Most of the changes will be just a tag to a commit that would be there otherwise, or with a very insignificant size after compressed. The problem here is binaries.

1. Not a problem, git push works with a url without fetching. But it would be smarter to fetch master before, or it will have to upload everything.
2. Without a better plan, we'd have to save on every job that has slaves (not the compile-only jobs, unless anyone can see a way of hijacking those). Most of them will be just a tag for the same object, so I don't see a problem there. The problem is the binaries, can we somehow restrict the binary-test jobs to be run only from the fanned counterpart?

[orangemocha]

Restricting the binary jobs to be only invokeable from their intended parents sounds like the way to go.

I guess a good place to inject this would be in the rebase scripts. Do we still use the git-rebase job?

[joaocgreis]

For both fanned jobs, yes.

[Trott]

Is this still an issue? Should it remain open?

[maclover7]

Closing for now as something that would be nice to have, but seems to not currently be within our means. If someone wants to tackle this, please feel free to reopen.