Allow egress to gitweb.git.savannah.gnu.org

[opohorel]

Savannah patch URLs redirect to gitweb.git.savannah.gnu.org. Explicitly allow this hostname to prevent the egress firewall from blocking redirected patch downloads.

[qodo-for-packit]

PR Summary by Qodo

Allow redirected Savannah patch downloads through egress firewall

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Allows outbound access to Savannah’s gitweb redirect hostname.
• Prevents redirected patch downloads from being blocked by the egress firewall.

High-Level Assessment

The explicit DNS allowlist entry is the appropriate approach because the redirect target is distinct from existing Savannah hosts and may resolve outside allowed CIDRs. Broader domain or CIDR access would unnecessarily expand the egress surface.

Files changed (1) +3 / -0

Other (1) +3 / -0

tenant-egress.ymlAllow egress to Savannah gitweb host +3/-0

Allow egress to Savannah gitweb host

• Adds an explicit DNS-based allow rule for gitweb.git.savannah.gnu.org so Savannah patch redirects can complete under the default-deny egress policy.

openshift/tenant-egress.yml

[qodo-for-packit]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

1. Savannah dependency undocumented 📘 Rule violation § Compliance

Description

The PR allows agents to download redirected patches from the external gitweb.git.savannah.gnu.org
service without documenting that dependency in THREAT_MODEL.md. The documentation should identify
its patch-hosting purpose, data handled, and downstream role.

Code

openshift/tenant-egress.yml[R123-125]

+    - type: Allow
+      to:
+        dnsName: gitweb.git.savannah.gnu.org

Relevance

●●● Strong

Recent precedent accepts documenting newly introduced external service dependencies in
THREAT_MODEL.md.

PR-#757
PR-#760

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Rule 3951 requires every new agent service dependency to be documented in THREAT_MODEL.md. The
changed egress policy introduces access to gitweb.git.savannah.gnu.org, while the threat model
describes the egress boundary and attacker-influenced patch downloads only generically and contains
no corresponding Savannah service entry.

Rule 3951: Document new agent service dependencies in THREAT_MODEL.md
openshift/tenant-egress.yml[123-125]
THREAT_MODEL.md[19-23]
THREAT_MODEL.md[82-82]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new external dependency on `gitweb.git.savannah.gnu.org` is allowed by the agent egress policy but is not documented in `THREAT_MODEL.md`.

## Issue Context
Document the service identifier, its role as a downstream redirect target for Savannah patch downloads, and the data exchanged, such as patch URLs and patch content.

## Fix Focus Areas
- THREAT_MODEL.md[17-23]
- THREAT_MODEL.md[75-83]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 8 rules

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[lbarcziova]

🙏