fix: harden the workflows — spoofable actor check and overly broad permissions

.github/workflows/codeql-analysis.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/hugo.yml

@@ -5,10 +5,10 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+# Nothing by default. pages: write and id-token: write belong to the deploy
+# job alone; at the top they were also handed to the build job, which only
+# needs to read the checkout.
+permissions: {}
 
 concurrency:
   group: "pages"
@@ -21,13 +21,16 @@ defaults:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       HUGO_VERSION: 0.165.0
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -49,11 +52,14 @@ jobs:
           HUGO_CACHEDIR: ${{ runner.temp }}/hugo_cache
           HUGO_ENVIRONMENT: production
           TZ: Europe/Amsterdam
+          # Through env rather than straight into the script: an expression
+          # interpolated into run: is expanded before bash ever sees it.
+          BASE_URL: ${{ steps.pages.outputs.base_url }}
         run: |
           cd src && hugo \
             --gc \
             --minify \
-            --baseURL "${{ steps.pages.outputs.base_url }}/"
+            --baseURL "${BASE_URL}/"
 
       - name: Upload artifact
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
@@ -65,6 +71,9 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-checks.yml

@@ -4,16 +4,19 @@ on:
   pull_request:
     branches: [main, development]
 
-permissions:
-  contents: read
-  pull-requests: write
+# Nothing by default; each job asks for exactly what it needs. Granting
+# pull-requests: write at the top handed it to every job, including the ones
+# that only read the checkout.
+permissions: {}
 
 jobs:
 
   # ── 1. PR title follows conventional commits ────────────────────────────────
   pr-title:
     name: Conventional commit title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
@@ -33,8 +36,12 @@ jobs:
   markdown:
     name: Markdown lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
         with:
           globs: "src/content/**/*.md"
@@ -43,8 +50,12 @@ jobs:
   python-security:
     name: Python security (bandit)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
@@ -56,8 +67,14 @@ jobs:
   image-format:
     name: No PNG/JPG in static/images
     runs-on: ubuntu-latest
+    # pull-requests: write for the comment this job posts when it finds a PNG.
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Find non-AVIF images
         id: check
@@ -127,8 +144,12 @@ jobs:
   bilingual:
     name: EN/NL file parity
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check every .md has a matching .nl.md
         run: |
           missing=""
@@ -151,12 +172,15 @@ jobs:
   hugo-build:
     name: Hugo build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       HUGO_VERSION: 0.165.0
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
@@ -183,6 +207,8 @@ jobs:
   link-check:
     name: Broken link check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: hugo-build
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -231,6 +257,9 @@ jobs:
   update-checklist:
     name: Update PR checklist
     runs-on: ubuntu-latest
+    # pull-requests: write to rewrite the description's checklist.
+    permissions:
+      pull-requests: write
     if: always()
     needs: [pr-title, bilingual, image-format, hugo-build, link-check]
     steps:

.github/workflows/python-checks.yml

@@ -9,11 +9,18 @@ on:
     - cron: '0 5 * * 0'
   workflow_dispatch:
 
+# Without this the workflow inherits whatever the repository default is.
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

.github/workflows/trivy-scan.yml

@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run Trivy filesystem scan
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0

.github/workflows/update-checksums.yml

@@ -28,14 +28,27 @@ jobs:
     runs-on: ubuntu-latest
     # Only Renovate's own branches. Running this on a human's pull request
     # would mean pushing commits to a branch someone is actively working on.
-    if: startsWith(github.head_ref, 'renovate/') && github.actor == 'renovate[bot]'
+    #
+    # The author of the pull request, not github.actor. actor is whoever
+    # triggered the most recent event, which on a synchronize is whoever pushed
+    # last; comparing that to a bot name is a check zizmor rightly calls
+    # spoofable. The author is fixed when the pull request is opened and cannot
+    # be set to another account.
+    if: >-
+      startsWith(github.head_ref, 'renovate/') &&
+      github.event.pull_request.user.login == 'renovate[bot]'
     permissions:
       contents: write
     steps:
+      # persist-credentials: false, even though this job pushes. Otherwise the
+      # token sits in .git/config for the whole job, including while the script
+      # below downloads release tarballs off the internet. The push step gets
+      # the token explicitly instead, for exactly one command.
       - name: Check out the pull request branch
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.head_ref }}
+          persist-credentials: false
 
       # The script verifies each download against the checksum the project
       # publishes next to the release before writing anything, so a hash only
@@ -44,6 +57,9 @@ jobs:
         run: .github/scripts/update-tool-checksums.sh --apply
 
       - name: Commit updated checksums
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH: ${{ github.head_ref }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -52,5 +68,6 @@ jobs:
             echo "Checksums are already up to date, nothing to commit."
           else
             git commit -m "chore: update tool SHA256 checksums"
-            git push
+            git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+              "HEAD:refs/heads/${BRANCH}"
           fi

src/content/docs/networking/eduroam-network-installation.md

@@ -30,7 +30,15 @@ The guide at [linux.datanose.nl](https://linux.datanose.nl/linux/eduroam/) (UvA/
 
 ## What does work
 
-PEAP/MSCHAPv2 with CA validation via the system trust store and `domain-suffix-match` (the modern replacement for the deprecated `altsubject-matches`).
+PEAP/MSCHAPv2 validated against Saxion's own certificate authority, pinned inside the
+script, plus `domain-suffix-match` (the modern replacement for the deprecated
+`altsubject-matches`).
+
+The script used to point at the system trust store, which meant any of the roughly 150
+public CAs your distribution ships could vouch for a server calling itself
+`ise.infra.saxion.net`. It now trusts only the chain Saxion publishes through eduroam
+CAT — USERTrust RSA Certification Authority and GEANT OV RSA CA 4 — which is what the
+official CAT installers do.
 
 **Requirements:**
 - Python 3.10+
@@ -44,7 +52,7 @@ PEAP/MSCHAPv2 with CA validation via the system trust store and `domain-suffix-m
 | Authentication | Protected EAP (PEAP) |
 | PEAP version | Automatic |
 | Inner authentication | MSCHAPv2 |
-| CA certificate | System CA bundle (`/etc/pki/tls/certs/ca-bundle.crt`) |
+| CA certificate | Saxion's published chain, written to `~/.config/saxion-eduroam/saxion-eduroam-ca.pem` |
 | Domain validation | `domain-suffix-match: ise.infra.saxion.net` |
 | Phase2 domain validation | `phase2-domain-suffix-match: ise.infra.saxion.net` |
 | Anonymous identity | `anonymous@saxion.nl` |
@@ -59,13 +67,13 @@ A Python script automates the full `nmcli` connection setup for Saxion:
 curl -LO https://zephyrus-linux.stensel.nl/scripts/saxion-eduroam.py
 
 # 2. Verify checksum
-echo "bef16a8ce91644a26cdd428f8dd0300de8e49ed72d9cbf4b6d39efea6d8facc1  saxion-eduroam.py" | sha256sum -c
+echo "b1a9b7ee4a55f77e118d40e886979ca96c8db8e145d593027f0bde0a578c46bc  saxion-eduroam.py" | sha256sum -c
 
 # 3. Run
 python3 saxion-eduroam.py
 ```
 
-**SHA256:** `bef16a8ce91644a26cdd428f8dd0300de8e49ed72d9cbf4b6d39efea6d8facc1`
+**SHA256:** `b1a9b7ee4a55f77e118d40e886979ca96c8db8e145d593027f0bde0a578c46bc`
 
 The script removes any existing eduroam profile, prompts for your **username** via a GUI dialog (zenity, kdialog, or yad) or terminal fallback, and activates the connection. Your password is never asked by the script; it is requested by your GNOME Keyring at connection time and stored securely, never in plaintext.
 
@@ -100,7 +108,7 @@ nmcli connection add \
   802-1x.identity "user@institution.tld" \
   802-1x.password "your-password" \
   802-1x.anonymous-identity "anonymous@saxion.nl" \
-  802-1x.ca-cert file:///etc/pki/tls/certs/ca-bundle.crt \
+  802-1x.ca-cert file://$HOME/.config/saxion-eduroam/saxion-eduroam-ca.pem \
   802-1x.domain-suffix-match "ise.infra.saxion.net" \
   802-1x.phase2-domain-suffix-match "ise.infra.saxion.net"
 ```

src/content/docs/networking/eduroam-network-installation.nl.md

@@ -30,7 +30,15 @@ De handleiding op [linux.datanose.nl](https://linux.datanose.nl/linux/eduroam/)
 
 ## Wat wel werkt
 
-PEAP/MSCHAPv2 met CA-validatie via de systeem-truststore en `domain-suffix-match` (de moderne vervanging voor het verouderde `altsubject-matches`).
+PEAP/MSCHAPv2, gevalideerd tegen Saxion's eigen certificaatautoriteit die in het script
+is vastgelegd, plus `domain-suffix-match` (de moderne vervanging voor het verouderde
+`altsubject-matches`).
+
+Het script wees eerder naar de systeem-truststore. Daarmee kon elk van de ongeveer 150
+publieke CA's die je distributie meelevert instaan voor een server die zich
+`ise.infra.saxion.net` noemt. Nu wordt alleen de keten vertrouwd die Saxion via eduroam
+CAT publiceert — USERTrust RSA Certification Authority en GEANT OV RSA CA 4 — precies
+wat de officiële CAT-installers doen.
 
 **Vereisten:**
 - Python 3.10+
@@ -44,7 +52,7 @@ PEAP/MSCHAPv2 met CA-validatie via de systeem-truststore en `domain-suffix-match
 | Authenticatie | Protected EAP (PEAP) |
 | PEAP-versie | Automatisch |
 | Interne authenticatie | MSCHAPv2 |
-| CA-certificaat | Systeem-CA-bundel (`/etc/pki/tls/certs/ca-bundle.crt`) |
+| CA-certificaat | De door Saxion gepubliceerde keten, geschreven naar `~/.config/saxion-eduroam/saxion-eduroam-ca.pem` |
 | Domeinvalidatie | `domain-suffix-match: ise.infra.saxion.net` |
 | Fase-2-domeinvalidatie | `phase2-domain-suffix-match: ise.infra.saxion.net` |
 | Anonieme identiteit | `anonymous@saxion.nl` |
@@ -59,13 +67,13 @@ Een Python-script automatiseert de volledige `nmcli`-verbindingsconfiguratie voo
 curl -LO https://zephyrus-linux.stensel.nl/scripts/saxion-eduroam.py
 
 # 2. Controleer de checksum
-echo "bef16a8ce91644a26cdd428f8dd0300de8e49ed72d9cbf4b6d39efea6d8facc1  saxion-eduroam.py" | sha256sum -c
+echo "b1a9b7ee4a55f77e118d40e886979ca96c8db8e145d593027f0bde0a578c46bc  saxion-eduroam.py" | sha256sum -c
 
 # 3. Uitvoeren
 python3 saxion-eduroam.py
 ```
 
-**SHA256:** `bef16a8ce91644a26cdd428f8dd0300de8e49ed72d9cbf4b6d39efea6d8facc1`
+**SHA256:** `b1a9b7ee4a55f77e118d40e886979ca96c8db8e145d593027f0bde0a578c46bc`
 
 Het script verwijdert een eventueel bestaand eduroam-profiel, vraagt je **gebruikersnaam** via een GUI-dialoog (zenity, kdialog of yad) of terminal-fallback, en activeert de verbinding. Je wachtwoord wordt nooit door het script gevraagd; dat wordt bij het verbinden opgevraagd door je GNOME Keyring en veilig opgeslagen, nooit in platte tekst.
 
@@ -100,7 +108,7 @@ nmcli connection add \
   802-1x.identity "gebruiker@instelling.nl" \
   802-1x.password "je-wachtwoord" \
   802-1x.anonymous-identity "anonymous@saxion.nl" \
-  802-1x.ca-cert file:///etc/pki/tls/certs/ca-bundle.crt \
+  802-1x.ca-cert file://$HOME/.config/saxion-eduroam/saxion-eduroam-ca.pem \
   802-1x.domain-suffix-match "ise.infra.saxion.net" \
   802-1x.phase2-domain-suffix-match "ise.infra.saxion.net"
 ```