4 ms·
Hello! We are using pnpm (which as I understand it has some overlap with what turborepo can do when it comes to monorepo management). Some teams are considerin
by forty 5y ago
Hello! We are using pnpm (which as I understand it has some overlap with what turborepo can do when it comes to monorepo management).
Some teams are considering turborepo for the remote caching feature. I'm a security guy, and I'm a little worried that remote caching basically means that all dev are able to run arbitrary code on other devs computer (by poising the cache). Am I missing something? Or are there security workarounds? Would, for example, only allow master build from the CI to push to the remote cache and only read only access for the devs work and still provide enough benefits? (I expect most dev to branch from master, so I'd assume the cache would be good enough?)
Thanks and congrats on the release!
- leerob 5y agoHey! Yeah, we recommend using pnpm. Excellent tool. You might be interested in this feature from 1.2: "You can enable Turborepo to sign artifacts with a secret key before uploading them to the Remote Cache. Turborepo uses HMAC-SHA256 signatures on artifacts using a secret key you provide. Turborepo will verify the remote cache artifacts' integrity and authenticity when they're downloaded. Any artifacts that fail to verify will be ignored and treated as a cache miss by Turborepo" https://turborepo.org/docs/features/remote-caching https://turborepo.org/docs/features/remote-caching
- forty 5y agoHMAC are symmetric signatures, which means that anyone who can check the signature can also poison the cache (so pushing only from the CI are reading/checking on the dev machines would not be possible)