Skip to content

Commit 48fc7c4

Browse files
chore: remove dead build scripts containing supply-chain vulnerability
Remove the entire .buildscript/ directory and release.sh — all dead code from a legacy CircleCI/Bintray era with zero references from active CI. e2e.sh downloaded and executed a remote script from the unowned rudderio GitHub org via wget|bash, which exfiltrates system info to an attacker endpoint. release.sh sent credentials to the defunct Bintray API whose domain could be re-registered. deploy_snapshot.sh hardcoded rudderio as the authorised deployer. The remaining files (cli.sh, bootstrap.sh, settings.xml) were orphaned. Also removes the commented-out settings.xml reference from pom.xml. 🔒 Scanned for secrets using gitleaks 8.28.0
1 parent 3b11c8c commit 48fc7c4

7 files changed

Lines changed: 0 additions & 91 deletions

File tree

.buildscript/bootstrap.sh

Lines changed: 0 additions & 25 deletions
This file was deleted.

.buildscript/cli.sh

Lines changed: 0 additions & 5 deletions
This file was deleted.

.buildscript/deploy_snapshot.sh

Lines changed: 0 additions & 28 deletions
This file was deleted.

.buildscript/e2e.sh

Lines changed: 0 additions & 15 deletions
This file was deleted.

.buildscript/settings.xml

Lines changed: 0 additions & 9 deletions
This file was deleted.

pom.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -337,7 +337,6 @@
337337
<!--<autoVersionSubmodules>true</autoVersionSubmodules>
338338
<checkModificationExcludes>
339339
<checkModificationExclude>pom.xml</checkModificationExclude>
340-
<checkModificationExclude>.buildscript/settings.xml</checkModificationExclude>
341340
</checkModificationExcludes>
342341
<autoReleaseAfterClose>true</autoReleaseAfterClose>-->
343342
</configuration>

release.sh

Lines changed: 0 additions & 8 deletions
This file was deleted.

0 commit comments

Comments
 (0)