From 7eb307b4656bdfebe115c5ed0338ed95d3326b89 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 20:32:55 -0500 Subject: [PATCH] egress: allow motd.ubuntu.com, esm.ubuntu.com and *.amazontrust.com:80 (#218) Ubuntu's MOTD news and Ubuntu Pro (ESM) hooks reach motd.ubuntu.com and esm.ubuntu.com; TLS revocation checks for Amazon-issued certificates go to *.amazontrust.com over plain HTTP. Every Harden-Runner allow list now names them. --- .github/workflows/ast-grep.yml | 3 +++ .github/workflows/gate.yml | 3 +++ .github/workflows/house-rules.yml | 3 +++ .github/workflows/packaging-lint.yml | 3 +++ .github/workflows/sonarcloud.yml | 8 ++++++++ .github/workflows/test-ast-grep.yml | 3 +++ .github/workflows/test-freebsd.yml | 3 +++ .github/workflows/test-house-rules.yml | 3 +++ .github/workflows/test-install-apt-packages.yml | 3 +++ .github/workflows/windows-arm64.yml | 6 ++++++ 10 files changed, 38 insertions(+) diff --git a/.github/workflows/ast-grep.yml b/.github/workflows/ast-grep.yml index cc8c605..182eb5d 100644 --- a/.github/workflows/ast-grep.yml +++ b/.github/workflows/ast-grep.yml @@ -40,6 +40,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 api.github.com:443 github.com:443 objects.githubusercontent.com:443 diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index 40a2473..fa7b934 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -123,6 +123,9 @@ jobs: with: egress-policy: audit allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 *.crates.io:443 *.github.com:443 *.githubusercontent.com:443 diff --git a/.github/workflows/house-rules.yml b/.github/workflows/house-rules.yml index b9f9796..9aa449a 100644 --- a/.github/workflows/house-rules.yml +++ b/.github/workflows/house-rules.yml @@ -35,6 +35,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 api.github.com:443 github.com:443 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml index c0ca676..f6783d9 100644 --- a/.github/workflows/packaging-lint.yml +++ b/.github/workflows/packaging-lint.yml @@ -24,6 +24,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 *.github.com:443 *.githubusercontent.com:443 *.microsoft.com:443 diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 9ad1a17..cd69c9a 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -100,6 +100,8 @@ jobs: # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > + *.amazontrust.com:80 + motd.ubuntu.com:443 *.amazonaws.com:443 *.crates.io:443 *.s3.amazonaws.com:443 @@ -176,6 +178,8 @@ jobs: # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > + *.amazontrust.com:80 + motd.ubuntu.com:443 *.amazonaws.com:443 *.crates.io:443 *.s3.amazonaws.com:443 @@ -302,6 +306,8 @@ jobs: # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > + *.amazontrust.com:80 + motd.ubuntu.com:443 *.amazonaws.com:443 *.crates.io:443 *.s3.amazonaws.com:443 @@ -453,6 +459,8 @@ jobs: # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > + *.amazontrust.com:80 + motd.ubuntu.com:443 *.amazonaws.com:443 *.crates.io:443 *.s3.amazonaws.com:443 diff --git a/.github/workflows/test-ast-grep.yml b/.github/workflows/test-ast-grep.yml index d3e078e..1b35848 100644 --- a/.github/workflows/test-ast-grep.yml +++ b/.github/workflows/test-ast-grep.yml @@ -27,6 +27,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 api.github.com:443 github.com:443 objects.githubusercontent.com:443 diff --git a/.github/workflows/test-freebsd.yml b/.github/workflows/test-freebsd.yml index 95e6a75..7e4535d 100644 --- a/.github/workflows/test-freebsd.yml +++ b/.github/workflows/test-freebsd.yml @@ -28,6 +28,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 api.github.com:443 github.com:443 archive.ubuntu.com:80 diff --git a/.github/workflows/test-house-rules.yml b/.github/workflows/test-house-rules.yml index 1d3848b..4f0d69e 100644 --- a/.github/workflows/test-house-rules.yml +++ b/.github/workflows/test-house-rules.yml @@ -29,6 +29,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 api.github.com:443 github.com:443 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/test-install-apt-packages.yml b/.github/workflows/test-install-apt-packages.yml index 4e38ecb..335bfc6 100644 --- a/.github/workflows/test-install-apt-packages.yml +++ b/.github/workflows/test-install-apt-packages.yml @@ -40,6 +40,9 @@ jobs: with: egress-policy: block allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 api.github.com:443 github.com:443 archive.ubuntu.com:80 diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml index fe3aa96..148c6cc 100644 --- a/.github/workflows/windows-arm64.yml +++ b/.github/workflows/windows-arm64.yml @@ -60,6 +60,9 @@ jobs: with: egress-policy: audit allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 *.crates.io:443 *.github.com:443 *.githubusercontent.com:443 @@ -114,6 +117,9 @@ jobs: with: egress-policy: audit allowed-endpoints: > + *.amazontrust.com:80 + esm.ubuntu.com:443 + motd.ubuntu.com:443 *.crates.io:443 *.github.com:443 *.githubusercontent.com:443