chore: security hardening for CI/CD and file permissions (#99)

Author: Stensel8

.github/workflows/update-checksums.yml

@@ -34,9 +34,15 @@ jobs:
     # last; comparing that to a bot name is a check zizmor rightly calls
     # spoofable. The author is fixed when the pull request is opened and cannot
     # be set to another account.
+    #
+    # Also require the head repo to be this repo, not a fork. This job checks
+    # out github.head_ref and runs a script from it with a write token, so a
+    # PR from a fork naming its branch renovate/* would otherwise get its
+    # attacker-controlled script executed with push access.
     if: >-
       startsWith(github.head_ref, 'renovate/') &&
-      github.event.pull_request.user.login == 'renovate[bot]'
+      github.event.pull_request.user.login == 'renovate[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write
     steps:

src/static/scripts/saxion-eduroam.py

@@ -288,7 +288,7 @@ def install_ca_bundle(self) -> str:
             os.makedirs(CA_DIR, mode=0o755, exist_ok=True)
             with open(CA_FILE, "w", encoding="ascii") as handle:
                 handle.write(SAXION_CA_PEM)
-            os.chmod(CA_FILE, 0o644)
+            os.chmod(CA_FILE, 0o600)
         except OSError as error:
             self.show_message(
                 f"Could not write the CA certificate to {CA_FILE}: {error}", True