Harden GitHub workflows

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>

.github/workflows/codeql.yml

@@ -40,7 +40,9 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/nightly.yml

@@ -5,34 +5,49 @@ on:
     - cron: '0 2 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   nightly:
     name: Deploy nightly
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
         refs: [main, development]
     runs-on: ubuntu-latest
+    env:
+      SIGNING_KEY_PATH: ${{ github.workspace }}/../private.pem
     steps:
+      - name: Validate signing secret
+        run: |
+          test -n "${{ secrets.PRIVATE_KEY_B64 }}" || {
+            echo "PRIVATE_KEY_B64 is required for nightly signed releases." >&2
+            exit 1
+          }
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           ref: ${{ matrix.refs }}
           submodules: 'recursive'
+          persist-credentials: false
       - name: Restore private key
         run: |
-          echo "${{ secrets.PRIVATE_KEY_B64 }}" | base64 -d > private.pem
+          echo "${{ secrets.PRIVATE_KEY_B64 }}" | base64 -d > "${SIGNING_KEY_PATH}"
-          chmod 600 private.pem
+          chmod 600 "${SIGNING_KEY_PATH}"
       - name : Build
         env:
           PICO_SDK_PATH: ../pico-sdk
-          SECURE_BOOT_PKEY: ../private.pem
+          SECURE_BOOT_PKEY: ${{ github.workspace }}/../private.pem
         run: |
            ./workflows/autobuild.sh pico
            ./build_pico_fido.sh --no-eddsa
            ./workflows/autobuild.sh esp32
       - name: Delete private key
-        run: rm private.pem
+        if: always()
+        run: rm -f "${SIGNING_KEY_PATH}"
       - name: Update nightly release
         uses: pyTooling/Actions/releaser@v6.7.0
         with:

.github/workflows/test.yml

@@ -21,16 +21,22 @@ on:
     - cron: '23 5 * * 4'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - name: Checkout repository and submodules
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         submodules: recursive
+        persist-credentials: false
     - name: Build in container
       run: ./tests/build-in-docker.sh
     - name: Start emulation and test

src/fido/cbor.c

@@ -34,9 +34,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next);
 
 const uint8_t aaguid[16] = { 0x89, 0xFB, 0x94, 0xB7, 0x06, 0xC9, 0x36, 0x73, 0x9B, 0x7E, 0x30, 0x52, 0x6D, 0x96, 0x81, 0x45 }; // First 16 bytes of SHA256("Pico FIDO2")
 
-const uint8_t *cbor_data = NULL;
+static const uint8_t *volatile cbor_data = NULL;
-size_t cbor_len = 0;
+static volatile size_t cbor_len = 0;
-uint8_t cbor_cmd = 0;
+static volatile uint8_t cbor_cmd = 0;
 
 int cbor_parse(uint8_t cmd, const uint8_t *data, size_t len) {
     if (len == 0 && cmd == CTAPHID_CBOR) {
@@ -108,7 +108,10 @@ void *cbor_thread(void *arg) {
         if (m == EV_EXIT) {
             break;
         }
-        apdu.sw = (uint16_t)cbor_parse(cbor_cmd, cbor_data, cbor_len);
+        const uint8_t *data = (const uint8_t *)cbor_data;
+        size_t len = cbor_len;
+        uint8_t cmd = cbor_cmd;
+        apdu.sw = (uint16_t)cbor_parse(cmd, data, len);
         if (apdu.sw == 0) {
             DEBUG_DATA(res_APDU, res_APDU_size);
         }