Repository navigation
GitHub audit logs should be archived #249
Description
GitHub audit logs only go back 180 days. As we discovered during the response to GHSA-67f2-674w-6g63, that can be exceptionally inconvenient when a long‐dormant security risk comes to light.
GitHub Enterprise lets us stream audit logs to S3 for long‐term storage. It seems like it shouldn’t be hard for @NixOS/org and @NixOS/infra to arrange to get these stored for the long term. I believe we should also consider enabling audit log streaming of security‐sensitive API requests.
I expect that the size of these logs will not be significant compared to the growth of the cache; if it is, we could look into doing some kind of filtering, or potentially use the audit log API to cook up a custom solution.
Additionally, only org owners have any access to the audit logs, which can slow down incident response and reduces transparency. Given the wide importance of repositories in the NixOS organization, I think it would make sense for at least the security team to have access to the S3 bucket, but even better would be if we had publicly‐accessible logs for at least a subset of actions by privileged users (e.g. at least org owners, probably repository admins, perhaps even committers in general?). These should of course be filtered to remove personal information like location. This would make it easier to ensure that org owner actions are logged publicly as required, and reduce the toil in doing so.
Activity
mweinelt commentedon May 11, 2026
I'll put this on the infra meeting notes for this Thursday. I think we want to set up streaming to S3 with OpenID Connect.
Open questions around this are GDPR related, because we'll be storing PII (Github username, E-Mail addresses, IP addresses and correlated events). With audit logging for security purposes we do have a legitimate interest.
emilazy commentedon May 11, 2026
I suspect we want to keep at least some subset of logs indefinitely, because you can always find out about a potential compromise years after the fact. (It was a year and a half this time around, but there’s no reason it’s necessarily bounded.)
I feel that the ideal solution would probably be to keep unredacted logs for a certain period, and erase the IP address/location information from ones older than that, but that would require custom code. Though I suppose if even storing GitHub account identifiers counts, we’ll just need a disclosure regardless.
Perhaps the notice could go in a
README.mdin NixOS/.github, which would show up on the organization page? (@nixos-test-org for an example.)arianvp commentedon May 11, 2026
Apparently source ip information is not available for events generated from public repos anyway
https://blog.bored.engineer/github-canarytokens-5c9e36ad7ecf mentions this as an annoying limitation (for defenders)
mweinelt commentedon May 11, 2026
arianvp commentedon May 11, 2026
You don't need to configure a thumbprint anymore. AWS made that parameter optional a few years ago
aws-actions/configure-aws-credentials#763
also note that Github Actions and Github Audit config OIDC urls are different!
mweinelt commentedon May 14, 2026
Infra is fine with setting this up, given a privacy policy being put in place that explains the data collected and the retention duration.
mweinelt commentedon Jun 6, 2026
@infinisil Can the board draft that privacy policy? I think we want to keep audit logs for 3 years or so and possibly keep IP information.
infinisil commentedon Jun 6, 2026
I'll make a note of it, can't promise any timeline though
infinisil commentedon Jun 12, 2026
@mweinelt We have a privacy policy here: https://nixos.org/privacy/
mweinelt commentedon Jun 22, 2026
Not a lawyer, but this is a website privacy policy that does not cover what we're planning to do here.
We need something suitable for this specific purpose, that describes that audit logging exists for some legitimate interest and that we store the data for N years.
And do we have a data processing agreement with AWS?