Security Guidelines
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The security guidelines for sidekiq-unique-jobs focus on maintaining the integrity of the job locking lifecycle and ensuring a secure supply chain for gem distribution. The project prioritizes atomic operations in Redis via Lua scripts to prevent race conditions and utilizes modern cryptographic standards for digest generation.
These guidelines cover the automated release pipeline, which incorporates OIDC-based trusted publishing and Sigstore attestations, as well as internal application security measures like Content Security Policy (CSP) and thread-safe configuration management.
Supply Chain Security
The project employs a fully automated release pipeline via GitHub Actions designed to mitigate supply chain attacks. This pipeline replaces traditional long-lived API keys with short-lived credentials and public transparency logs.
Release Security Features
| Feature | Security Impact |
|---|---|
| Trusted publishing (OIDC) | Eliminates RUBYGEMS_API_KEY secrets by verifying GitHub Actions identity via OpenID Connect. |
| Sigstore attestation | Provides keyless signatures logged in public transparency logs for gem verification. |
| Checksum Verification | Attaches SHA-256 and SHA-512 files to GitHub releases for independent artifact validation. |
| MFA Requirement | Enforces rubygems_mfa_required in the gemspec, requiring Multi-Factor Authentication for manual pushes. |
| Gem Content Audit | CI unpacks the gem to ensure sensitive or unnecessary files (like specs) are not published. |
Sources: RELEASING.md:5-15, RELEASING.md:47-51
Automated Verification Flow
The following diagram illustrates how a release is secured and verified from the CI pipeline to the end user.
Sources: RELEASING.md:23-28, RELEASING.md:55-75
Operational Security
Operational security is maintained through atomic Redis interactions and thread-safe internal structures. The use of Lua scripts ensures that complex lock acquisitions and releases are performed as single atomic units, preventing partial states that could be exploited or cause inconsistency.
Redis Atomic Operations
All Redis operations are executed via Lua scripts located in lib/sidekiq_unique_jobs/lua/. This architectural choice ensures consistency across concurrent processes.
- Lock Management: Uses
digest:LOCKEDhashes anduniquejobs:digestssorted sets. - Algorithms: Support for
:modern(SHA3-256) digest algorithm to comply with FIPS environments, replacing the:legacyMD5 approach.
Sources: CLAUDE.md:126-130, CLAUDE.md:193-196, lib/sidekiq_unique_jobs/config.rb:299-309
Thread Safety and Configuration
Configuration is managed using Concurrent::MutableStruct to ensure thread-safe access to global settings across Sidekiq worker threads.
ThreadSafeConfig = Concurrent::MutableStruct.new(
"ThreadSafeConfig",
:lock_timeout,
:lock_ttl,
:enabled,
:lock_prefix,
# ... other attributes
:on_conflict,
)
Sources: lib/sidekiq_unique_jobs/config.rb:5-28
Web UI and Interface Security
The Sidekiq Web extension includes helpers to ensure safe data rendering and navigation.
Content Security Policy (CSP)
The project provides a template for Rails-based implementations to define a CSP, preventing unauthorized script execution and data injection.
Rails.application.configure do
config.content_security_policy do |policy|
policy.default_src :self, :https
policy.font_src :self, :https, :data
policy.img_src :self, :https, :data
policy.object_src :none
policy.script_src :self, :https
policy.style_src :self, :https
end
end
Sources: myapp/config/initializers/content_security_policy.rb:11-20
Parameter and Output Sanitization
The Web UI uses strict parameter filtering and HTML escaping when displaying job arguments to prevent Cross-Site Scripting (XSS).
- SAFE_CPARAMS: Only specific keys (
filter,count,cursor, etc.) are allowed in URL parameters. - Argument Truncation: Job arguments are truncated (default 2000 chars) and HTML escaped via the
h()helper before being rendered in views.
Sources: lib/sidekiq_unique_jobs/web/helpers.rb:14-17, lib/sidekiq_unique_jobs/web/helpers.rb:69-82
Summary
Security in sidekiq-unique-jobs is built on a foundation of supply chain integrity and atomic data management. By leveraging OIDC for releases and Lua for Redis operations, the system minimizes the surface area for credential theft and race condition exploits. Developers are encouraged to use the :modern digest algorithm for FIPS compliance and maintain the provided CSP configurations for Web UI deployments.