How exactly does kcl mod add work and how does it differ from kcl mod pull?

[karlhepler]

I'm asking this question because I was playing around with kcl and added a couple of modules using kcl mod add. I ran kcl a few times to compile my .k files and all of the sudden, SentinelOne flagged kcl as a threat and quarantined and killed everything.

After looking into it, it was flagged because kcl was initializing docker-credential-osxkeychain over and over again - presumably each time I ran kcl.

That leads me to believe that kcl mod add simply tells kcl where to look for images and that maybe they are downloaded with each run of kcl, perhaps with some in-memory caching? I'm not sure exactly, which is why I'm reaching out. When I run kcl mod add, what exactly does it do and what exactly does it cause kcl to do when run?

If I run kcl mod pull after running kcl mod add, then will those images just live on my machine? Would this prevent kcl from constantly hammering docker-credential-osxkeychain?

[zong-zhe]

Hi @karlhepler 😄

Welcome ! Your question is very helpful, this is a problem we have not encountered before.

Some more information may be useful, the official three-party dependencies provided by kcl is stored in OCI Registry ghcr.io and docker.io. kcl uses docker-credential-osxkeychain through oras to save authentication credentials. So every call to kcl will access the docker-credential-osxkeychain.

I need some more detailed information to determine if there is a problem.

1. Can you use tools like docker, helm or oras normally ?
2. Try logging in to ghcr.io using the kcl registry login command to see if it helps:

• • kcl registry login: https://www.kcl-lang.io/docs/tools/cli/package-management/command-reference/login
• • you need a token to login ghcr.io: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic

3. Is there any more detailed information about this? Is this problem caused by too many times docker-credential-osxkeychain is accessed, or is an error occurring whenever docker-credential-osxkeychain is accessed.

SentinelOne flagged kcl as a threat and quarantined and killed everything.

Currently known issues that may have an impact :

• [WIP] Redownloads of dependencies when use kcl run: Issues with kcl modules about the package re-downloading and local package deps kpm#320

[karlhepler]

Hi @zong-zhe 😄

Thank you for the quick and thoughtful response. I will do my best to answer your questions to the best of my ability. I also wanted to let you know that I have fixed my development environment since this happened, so everything is back to the way it was before the problem occurred. (Thank's Nix Home Manager!)

1. Yes - I can use tools like Docker and Helm normally. I don't know what Orcas is.
2. I was able to create a token and log in to ghcr using this command: kcl registry login ghcr.io -u <username> -p <token>. I didn't try anything out yet because I don't have direct access or control over SentinelOne, its logs, or how it behaves. I can try again, but I probably want to let my security team know before I do.
3. After asking my security team, it seems to be a problem of calling docker-credential-osxkeychain too many times within a certain time period. Because of this behavior, it was automatically flagged as a threat. They went on to say, "since the file was also unsigned, it shares many similar indicators of malware". Another person said that it "tipped over the threshold of things a single program can do before it gets flagged".

---

Here is some more information from SentinelOne:

INDICATORS

Discovery

• Process attempted to discover files and directories
• Local user accounts were queried

Credential Access

• Keychain was queried

General

• Process attempted to execute suspicious MachO

---

Further, I have a general rundown of the processes that it discovered, in order of operation:

1. fish shell invoked kclvm_cli
2. kcl invoked docker-credential-osxkeychain
3. docker-credential-osxkeychain invoked docker-credential-desktop

In the logs, this happens over and over again in succession - presumably as I simply run kcl.

[zong-zhe]

Hi @karlhepler 😄

I tried to reduce the number of docker-credential-osxkeychain calls in this PR kcl-lang/kpm#330, which you can try in a later version to see if it helps.

And thanks for you feedback, I'll continue to learn more about helm and docker to see if there's a better way to make my program look less like a password thief. 😁

[karlhepler]

Thank you!