Repository intelligence
rust-lang/simpleinfra
GitHubA collection of tools, automation scripts, Ansible playbooks, and Terraform configurations created and maintained by the Rust infrastructure team to manage their services and cloud resources safely.
CLOUDM0N decision
REVIEW BEFORE ADOPTION
Trust REVIEW · 30/100
Good fit if
Members of the Rust infrastructure team who have the necessary privileges to manage Rust project services.
Watch out for
Several of the included tools require administrative privileges held exclusively by members of the Rust infrastructure team.
Practical intelligence
What matters before you adopt it
Problem it solves
The security risks of using unscoped Personal Access Tokens (PATs) for automated CI/CD deployments and the risk of compromise when storing sensitive release signing keys on host disks.
Best for
Members of the Rust infrastructure team who have the necessary privileges to manage Rust project services.
Developers looking to automate the generation, configuration, and secure usage of scoped GitHub deploy keys for CI/CD pipelines.
Release managers needing to execute commands or sign Git releases using the Rust release signing key securely without persisting it to disk.
Main trade-offs
Several of the included tools require administrative privileges held exclusively by members of the Rust infrastructure team.
While with-rust-key.sh leaves no trace on disk, any program running with the same user privileges can interact with the signing key while the script is active.
Why it stands out
Automates the manual generation, encoding, and GitHub registration process for scoped repository deploy keys.
Eliminates disk storage of critical release signing keys by retrieving them dynamically from 1Password and leaving no traces after script execution.
Licensed under the permissive MIT license for open-source reuse.
Trust & CVEs
Security evidence without the noise
Trust remains a decision signal; CVEs and scanner evidence explain what is driving the risk.
Security findings
4
CLOUDM0N scanner findings
Critical
0
High
2
Medium
2
Low
0
View trust evidence & security findings▼
Why this score
No trust rationale was stored for this scan.
CLOUDM0N findings
HIGH
Remote download piped or chained into a shell requires manual review. 2 sample match(es) found.
HIGH
Container configuration requests host-level control or isolation bypass. 1 sample match(es) found.
MEDIUM
The project can spawn operating-system processes; review command construction and input handling. 5 sample match(es) found.
MEDIUM
Broad permission or elevated-command pattern detected. 5 sample match(es) found.
Architecture from code7 modules · 0 edges▼
Structural evidence
Modules and dependency edges extracted from repository code. This is code evidence, not README inference.
Code files
19
Modules
7
Dependency edges
0
Core modules
(root)
ansible
github-actions
release-scripts
terraform
terragrunt
Dependency flow
No dependency edges were extracted.
Detected languages
Shell · Python · Rust · JavaScript
Detected frameworks
—
Architecture evidence details
flowchart TD
%% repo — high-level architecture (DRAFT, refine me)
n0["(root) · 3 files"]
n1["ansible · 2 files"]
n2["github-actions · 1 file"]
n3["release-scripts · 1 file"]
n4["terraform · 3 files"]
n5["terragrunt · 9 files"]Evidence, security & integrations▼
Integrations
AnsibleTerraformGitHub ActionsGitHubAWS1Password CLIjqgit2
Security notes
• Personal Access Tokens should be avoided for CI deployments to GitHub Pages because they cannot be scoped to a single repository, whereas deploy keys can be.
• The with-rust-key.sh script prevents signing keys from being stored on disk to limit theft, but remains vulnerable to other local programs running with the user's privileges while active.
Still unknown
• The README does not provide the exact command-line invocation syntax or executable names for running setup-deploy-keys.
• Does not detail the exact structure or contents of the Ansible playbooks and Terraform configurations.
• Does not explain how the AWS 2-factor authentication login credentials (aws-creds) are processed or configured.
Adoption guidance▼
Adopt if
+ You are a member of the Rust infrastructure team needing to maintain Rust project servers and cloud deployments.
+ You require an automated utility to safely configure scoped repository deploy keys to avoid the security issues of Personal Access Tokens.
+ You need to sign software releases with a highly sensitive key using a 1Password-backed temporary GPG environment.
Avoid if
– You are an external developer intending to use these tools for general-purpose infrastructure without having Rust infra team privileges.
– You cannot use Zulip or are unwilling to coordinate with the t-infra team prior to opening issues or PRs.
How it works & getting started▼
How it works
1.The user configures authentication credentials such as a GITHUB_TOKEN or 1Password CLI on the host system.
2.For deploy keys, the automation generates an ed25519 or RSA key and automatically registers the public portion with GitHub.
3.The private portion is output as an encoded environment variable (GITHUB_DEPLOY_KEY).
4.A local Rust deployment program (deploy.rs) is compiled and run inside the target repository to execute the deployment using this key.
5.For secure signing, the with-rust-key.sh script pulls the release key from 1Password at runtime into a temporary GPG environment, runs the requested command, and cleans up completely.
Getting started
→ Contact t-infra on Zulip before proposing contributions if you are outside the Rust Project.
→ To set up deploy keys, export your GITHUB_TOKEN environment variable and run the setup-deploy-keys tool.
→ To download the deploy.rs script for deployment tasks, fetch it from raw.githubusercontent.com/rust-lang/simpleinfra/master/setup-deploy-keys/src/deploy.rs
Agent handoff
Use with any agent