You are viewing a plain text version of this content. The canonical link for it is here.
- Re: [I] Choose how to distinguish files for uploading to third party platforms (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/01 13:10:34 UTC, 3 replies.
- Re: [I] Project metadata to add to project database (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/01 13:15:00 UTC, 14 replies.
- Re: [I] Binary artifacts seem to be checked for "lightweight" licence check even if RAT only is used (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/01 14:10:32 UTC, 4 replies.
- Re: [I] Make email templating much clearer to users (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/01 15:09:56 UTC, 12 replies.
- [PR] Record automatic committee updates in audit log (tooling-trusted-releases) - posted by "developer-ravi-03 (via GitHub)" <gi...@apache.org> on 2026/01/01 16:03:40 UTC, 14 replies.
- Re: [I] Warn the user if the "Preserve download files" option is checked during announcing (tooling-trusted-releases) - posted by "developer-ravi-03 (via GitHub)" <gi...@apache.org> on 2026/01/01 17:00:40 UTC, 2 replies.
- [I] Valid NOTICE files are marked invalid (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/02 17:35:30 UTC, 8 replies.
- [I] Discuss identification of generated source files (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/02 17:42:25 UTC, 6 replies.
- [I] Checks track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/02 20:39:44 UTC, 0 replies.
- Re: [I] Record votes in the database (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/02 21:02:14 UTC, 0 replies.
- [I] Candidate phases track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/02 21:05:34 UTC, 3 replies.
- [I] Openapi endpoint is blocked by csp (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/03 02:50:02 UTC, 2 replies.
- [I] Projects don't have a chair (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/03 08:09:00 UTC, 3 replies.
- [I] Programming language should be a list (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/03 08:12:18 UTC, 3 replies.
- [I] Category should be a list (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/03 08:13:16 UTC, 2 replies.
- [I] PMCs have a charter; projects don't (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/03 08:26:42 UTC, 1 replies.
- [I] Add SHA512 generation to attestations (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/04 14:57:03 UTC, 1 replies.
- Re: [I] Prioritise SHA512, and allow signature corroborated generation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/04 14:57:32 UTC, 1 replies.
- [I] Improve RAT checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/04 15:37:36 UTC, 6 replies.
- Re: [I] Automatically exclude `.min.js` and other generated files from RAT and License Header checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/04 18:33:30 UTC, 5 replies.
- Re: [I] exclude leading dir with archive name paths from failed license header checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/04 18:33:41 UTC, 2 replies.
- Re: [I] New compose project options for license check excludes (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/04 18:39:06 UTC, 6 replies.
- Re: [I] DOAP files in port of projects.apache.org (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/04 20:33:20 UTC, 1 replies.
- [I] Committee/project auto update should only include data from Whimsy (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/04 20:50:26 UTC, 0 replies.
- [I] Project model track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/04 21:02:46 UTC, 2 replies.
- [I] Assure that Committee and Project metadata are validated (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/04 21:53:57 UTC, 0 replies.
- [I] Consider improving logging (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/05 14:26:33 UTC, 3 replies.
- [I] Add distribution directory template to finish release policy (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 17:26:03 UTC, 2 replies.
- [I] Finish option to automatically archive prior release (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 17:34:52 UTC, 1 replies.
- Re: [I] Implement RAO / Maven connectivity (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 17:51:29 UTC, 3 replies.
- Re: [I] Require two approvals for important actions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 18:10:25 UTC, 1 replies.
- [PR] Warn user when preserve download files is enabled during announce (tooling-trusted-releases) - posted by "developer-ravi-03 (via GitHub)" <gi...@apache.org> on 2026/01/05 18:44:29 UTC, 7 replies.
- [I] Allow files to be tagged in the compose phase according to a mapping (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 20:27:27 UTC, 9 replies.
- [I] Download rsync candidate files by a select tag (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 20:35:13 UTC, 2 replies.
- [I] Document identification of generated source files in lightweight and RAT license checks (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 20:44:54 UTC, 6 replies.
- Re: [I] Clarify and constrain permitted ASF TLP version numbers (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 20:49:03 UTC, 4 replies.
- [I] Catalog projects and releases for each PMC from current data (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 21:16:40 UTC, 0 replies.
- Meta bug report - posted by Jens Geyer <je...@apache.org> on 2026/01/05 21:22:20 UTC, 4 replies.
- [I] Watch svn dist releases and catalog changes to projects and releases (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 21:24:24 UTC, 1 replies.
- Re: [I] Allow Projects to be defined via .asf.yaml (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 21:31:59 UTC, 3 replies.
- Re: [I] Provide an api to artifact catalog (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 21:34:52 UTC, 1 replies.
- Re: [I] Tie ATR server into the rsync path of svn dist artifacts (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 21:44:06 UTC, 0 replies.
- Re: [I] Replace public release and committee pages with a catalog page (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 21:48:07 UTC, 0 replies.
- [I] Implement PyPi Distributions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/05 23:39:03 UTC, 3 replies.
- [GH] Record automatic committee updates in audit log (tooling-trusted-releases) - posted by "developer-ravi-03 (via GitHub)" <gi...@apache.org> on 2026/01/06 12:04:20 UTC, 0 replies.
- [PR] fixed issue 477 (tooling-trusted-releases) - posted by "sanjana2505006 (via GitHub)" <gi...@apache.org> on 2026/01/06 19:15:16 UTC, 31 replies.
- [INTRO] New contributor – documentation improvements - posted by Sanjana <sa...@gmail.com> on 2026/01/07 09:10:50 UTC, 0 replies.
- [I] Enforce consistency of enums in Sqlite3 migrations (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/07 14:25:32 UTC, 2 replies.
- Re: [I] ATR logo request (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/07 17:14:39 UTC, 2 replies.
- [I] Improve type validation of GET parameters (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/07 20:19:30 UTC, 0 replies.
- Re: [I] Add a tutorial explaining how to sign artifacts using OpenPGP (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/07 20:41:50 UTC, 1 replies.
- [I] Port should be 8080 (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/08 17:52:06 UTC, 2 replies.
- [I] Need some docs on how to use Docker for testing (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/08 17:53:22 UTC, 5 replies.
- [I] Improve documentation for external contributors (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/08 18:47:57 UTC, 5 replies.
- [I] `Multiple rows were found when one or none was required` when uploading a release via `upload-to-atr` (tooling-trusted-releases) - posted by "raboof (via GitHub)" <gi...@apache.org> on 2026/01/08 20:47:46 UTC, 4 replies.
- [PR] Initial stab at documenting Docker (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/08 21:16:37 UTC, 3 replies.
- [I] PR labeler fails with permission issue (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/08 21:28:27 UTC, 6 replies.
- [I] analyze.yml pre-commit hook now always fails (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/09 00:23:08 UTC, 6 replies.
- [I] Remove the Ubuntu Docker container (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/09 15:25:08 UTC, 2 replies.
- [PR] New year (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/09 16:58:49 UTC, 2 replies.
- [PR] Doc tweaks (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/09 17:05:52 UTC, 2 replies.
- [GH] New year (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/09 17:06:58 UTC, 1 replies.
- [I] Add easier methods to prevent check results from being cached (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/09 19:15:08 UTC, 6 replies.
- [I] Projects VM track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/09 20:17:53 UTC, 0 replies.
- [I] Setup projects vm for development (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/09 20:21:00 UTC, 18 replies.
- [I] Reporter integration with BAT (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/09 20:25:40 UTC, 1 replies.
- [I] Integrate ATR with projects vm (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/09 20:27:38 UTC, 0 replies.
- [I] Protect the project from low quality PR contributions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/10 11:59:48 UTC, 2 replies.
- [I] .dockerignore should use allowlist strategy (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/10 15:52:56 UTC, 2 replies.
- Re: [I] Improve error reporting when /resolve/tabulated data is unavailable (tooling-trusted-releases) - posted by "Smitaambiger (via GitHub)" <gi...@apache.org> on 2026/01/12 08:19:40 UTC, 16 replies.
- [PR] Work to enable automatic distributions (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/01/12 14:25:49 UTC, 5 replies.
- [I] Make the vast majority of files compatible with `fix_order.sh`, and add to linting (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/12 14:46:12 UTC, 0 replies.
- [I] @openrefactoryinc.1925 (tooling-trusted-releases) - posted by "q2qs2gknxb-alt (via GitHub)" <gi...@apache.org> on 2026/01/12 20:17:14 UTC, 1 replies.
- Re: [I] Speed up building the OCI container (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/12 20:48:17 UTC, 1 replies.
- Re: [I] Review permissions for all actions in ATR (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/12 22:01:58 UTC, 6 replies.
- Re: [I] Get admin users from Infra and Tooling LDAP groups (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/12 22:51:48 UTC, 1 replies.
- Re: [I] Integrate ATR secrets with Puppet (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/12 22:59:15 UTC, 4 replies.
- [GH] Work to enable automatic distributions (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/01/13 10:28:02 UTC, 3 replies.
- [I] Consider allowing different authentication methods on a single endpoint (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/13 15:44:13 UTC, 2 replies.
- [I] /api/project/releases/{name} should return 404 for non-existent project (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/13 16:56:29 UTC, 2 replies.
- Re: [I] Project lifecycle information as part of the release catalog (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/13 17:01:15 UTC, 1 replies.
- [I] Ensure that error messages from the storage interface are informative (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/13 17:22:13 UTC, 2 replies.
- [I] Ensure that a release can only be deleted or archived, and that the state is clear (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/13 17:30:38 UTC, 1 replies.
- [I] Block announcing a release if tagged distributions have not yet been done (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/13 17:38:40 UTC, 3 replies.
- [I] Allow a past release to be archived when creating a new release (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/13 17:41:40 UTC, 1 replies.
- [I] Ensure that a project can only be deleted or archived under certain conditions, and that the state is clear (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/13 22:40:34 UTC, 1 replies.
- Re: [I] Ignore checks are ignored (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/13 23:20:01 UTC, 3 replies.
- [I] Miscellaneous track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/13 23:30:47 UTC, 0 replies.
- Re: [I] Work on the following issues in order (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/13 23:33:08 UTC, 1 replies.
- [I] Beta track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/13 23:35:09 UTC, 0 replies.
- [I] DB JDO project label is db-_jdo with an extra symbol between db and jdo (tooling-trusted-releases) - posted by "clr-apache (via GitHub)" <gi...@apache.org> on 2026/01/14 00:22:26 UTC, 6 replies.
- [PR] # This is a combination of 2 commits. (tooling-trusted-releases) - posted by "sanjana2505006 (via GitHub)" <gi...@apache.org> on 2026/01/14 11:09:17 UTC, 1 replies.
- [I] Make it less likely that release artifacts can be accidentally modified or deleted (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 14:42:54 UTC, 3 replies.
- [I] Do not allow revision serial numbers to be reallocated (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 14:44:00 UTC, 3 replies.
- [I] Document database cascades (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 15:05:22 UTC, 4 replies.
- [I] Updated Readme (tooling-actions) - posted by "Jai-76 (via GitHub)" <gi...@apache.org> on 2026/01/14 15:22:11 UTC, 5 replies.
- [I] Ensure that ATR can be developed on musl based Linux distributions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 15:57:43 UTC, 5 replies.
- [PR] Document database cascade deletions (#517) (tooling-trusted-releases) - posted by "Aditi102005 (via GitHub)" <gi...@apache.org> on 2026/01/14 17:22:02 UTC, 0 replies.
- [I] Allow release managers to be designated (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 17:23:02 UTC, 9 replies.
- [I] Document the layout of the filesystem (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 17:50:58 UTC, 3 replies.
- [I] Add a PR form to orient new developers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 17:51:37 UTC, 4 replies.
- [I] Promotion permissions for phase transitions and distributions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 18:49:53 UTC, 6 replies.
- Re: [PR] Document database cascade deletions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/14 19:08:04 UTC, 3 replies.
- [I] Infra documentation changes for the Release Manager role (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 20:37:22 UTC, 5 replies.
- [I] Infra documentation changes for Download pages (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 20:50:30 UTC, 0 replies.
- [I] Infra documentation additions to describe using ATR in release creation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 21:15:23 UTC, 0 replies.
- Re: [I] Release policy improvements for ATR (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 21:34:29 UTC, 4 replies.
- [I] Incubator documentation for release management (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 21:49:10 UTC, 0 replies.
- [I] FAQs on ATR for legal release policy (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 22:06:07 UTC, 0 replies.
- Re: [I] Improve HTML form validation error display and code quality (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 23:26:21 UTC, 2 replies.
- Re: [I] Ordering of private vs public functions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/14 23:52:14 UTC, 1 replies.
- [PR] Possible recurrent jobs implementation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/01/15 11:34:41 UTC, 2 replies.
- [GH] Possible recurrent jobs implementation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/15 14:37:28 UTC, 6 replies.
- [I] Organise all files into subdirectories within the state directory (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/15 14:41:44 UTC, 4 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: server side execution (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/15 23:12:26 UTC, 0 replies.
- [PR] Migrate state files with extensive checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/16 16:51:44 UTC, 3 replies.
- [GH] Migrate state files with extensive checks (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/01/16 17:01:47 UTC, 1 replies.
- [PR] Bump pynacl from 1.6.0 to 1.6.2 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/16 17:32:36 UTC, 2 replies.
- [I] Update `notes` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 19:30:29 UTC, 3 replies.
- [PR] Bump pyasn1 from 0.6.1 to 0.6.2 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/16 20:02:25 UTC, 2 replies.
- [I] Implement rate limiting on authentication endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:26:02 UTC, 21 replies.
- [I] Implement log injection prevention (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:28:52 UTC, 3 replies.
- [I] Enforce MAX_CONTENT_LENGTH for upload size limits (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:30:52 UTC, 8 replies.
- [I] Remove hardcoded authorization bypass for tooling committee (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:31:44 UTC, 2 replies.
- [I] Move admin user list to LDAP/external configuration (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:32:29 UTC, 8 replies.
- [I] Increase JWT token ID (jti) entropy from 64 to 128 bits (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:33:20 UTC, 2 replies.
- [I] Improve JWT secret key management - increase size and require configuration (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:34:03 UTC, 6 replies.
- [I] Add issuer and audience claims to JWT tokens (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:35:08 UTC, 2 replies.
- [I] Configure session cookie security attributes (Secure, HttpOnly, SameSite) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:36:11 UTC, 2 replies.
- [I] Add Strict-Transport-Security (HSTS) header (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:36:42 UTC, 1 replies.
- [I] Hide stack traces from error pages in production (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:38:06 UTC, 1 replies.
- [I] Use generic error messages to prevent user enumeration (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:38:48 UTC, 1 replies.
- [I] Notify users when authentication credentials change (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:39:13 UTC, 2 replies.
- [I] Create centralized HTTP client with explicit TLS configuration (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:39:47 UTC, 8 replies.
- [I] Implement structured logging for API access (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:40:32 UTC, 1 replies.
- [I] Enable CPU and memory limits for worker processes (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:41:02 UTC, 3 replies.
- [I] Configure request timeouts to prevent slowloris attacks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:42:39 UTC, 3 replies.
- [I] Add upper limit to email thread message processing (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:43:03 UTC, 1 replies.
- [I] Implement file type/content validation for uploads (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:43:42 UTC, 5 replies.
- [I] Escape database values before writing to database (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:45:53 UTC, 8 replies.
- [I] Create SECURITY.md and security documentation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:46:51 UTC, 3 replies.
- [I] Narrow exception handling in GitHub OIDC verification (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:47:19 UTC, 4 replies.
- [I] Clarify the instructions to start a server and to submit a PR (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/16 22:28:31 UTC, 7 replies.
- [I] What does TUI stand for? (tooling-releases-client) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/19 00:02:15 UTC, 3 replies.
- [PR] Revise README for clarifying TUI (tooling-releases-client) - posted by "tisonkun (via GitHub)" <gi...@apache.org> on 2026/01/19 08:36:48 UTC, 4 replies.
- [I] Supply missing executables in the lint workflow (tooling-releases-client) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/19 14:03:20 UTC, 2 replies.
- [I] Write hypercorn.log somewhere other than the state directory (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/19 17:02:33 UTC, 3 replies.
- [PR] Bump biomejs/setup-biome from 2.6.0 to 2.7.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/19 21:44:50 UTC, 10 replies.
- [PR] Bump astral-sh/setup-uv from 7.1.6 to 7.2.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/19 21:45:02 UTC, 1 replies.
- [PR] Copy SBOM models to remove interdependencies (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/20 15:07:03 UTC, 1 replies.
- [PR] Prevent enumeration (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/20 17:15:35 UTC, 1 replies.
- [PR] Thread count (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/20 17:29:53 UTC, 1 replies.
- [I] Incorrect permissions for ssh_host_key if migrated from state (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/20 17:34:14 UTC, 6 replies.
- [PR] Clarify docs for getting started (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/20 20:34:53 UTC, 1 replies.
- [PR] Add HSTS response header (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/20 21:33:46 UTC, 1 replies.
- [PR] Synch with start-atr.sh (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/20 21:54:29 UTC, 2 replies.
- analyze workflow failing with updated action biomejs/setup-biome - posted by sebb <se...@gmail.com> on 2026/01/20 22:09:46 UTC, 0 replies.
- [PR] Update docs for 2026 (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/20 22:13:33 UTC, 2 replies.
- [I] BLOCKER: State is blown out for release-test.apache.org (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/20 23:13:37 UTC, 6 replies.
- Introduction: Abhishek Mishra - New Contributor - posted by Abhishek Mishra <mi...@gmail.com> on 2026/01/21 07:27:42 UTC, 0 replies.
- [I] Use read only permissions for attestation data once written (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/21 15:10:50 UTC, 0 replies.
- Re: [I] Preserve the history of configuration options that affect attestations (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/21 15:56:05 UTC, 1 replies.
- [PR] Removing markdown tables, linted (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/21 19:06:52 UTC, 1 replies.
- [PR] Add too large a payload handler (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/21 20:25:36 UTC, 1 replies.
- [PR] Notify users on authentication credentials change (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/21 21:51:32 UTC, 1 replies.
- Re: [I] Task resource limits do not work consistently between architectures (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/21 23:01:18 UTC, 3 replies.
- [PR] Configure session cookie security attributes (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/21 23:23:37 UTC, 1 replies.
- [PR] Adding security documentation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/22 00:00:06 UTC, 4 replies.
- [PR] Update storage interface error messages (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 01:08:55 UTC, 2 replies.
- [PR] Improve documentation for external contributors (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/22 02:53:18 UTC, 2 replies.
- [PR] No traceback on error html page (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 04:28:56 UTC, 1 replies.
- [PR] Allow projects to specify a tagging spec, allow rsync of tag (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/01/22 15:05:12 UTC, 5 replies.
- [GH] Allow projects to specify a tagging spec, allow rsync of tag (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/22 15:50:35 UTC, 1 replies.
- [PR] Bump actions/checkout from 4.3.0 to 6.0.2 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/22 17:01:32 UTC, 0 replies.
- [PR] Bump actions/upload-artifact from 4.6.2 to 6.0.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/22 17:01:44 UTC, 0 replies.
- [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.2.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/22 17:02:06 UTC, 0 replies.
- [GH] Adding security documentation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/22 17:05:31 UTC, 7 replies.
- [PR] Storage interface error messages redux (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/22 20:11:42 UTC, 2 replies.
- Re: [I] Improve performance of routes throughout (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:24:07 UTC, 1 replies.
- Re: [I] Add tests suited to the alpha2 phase (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:30:27 UTC, 0 replies.
- Re: [I] Ability to record +1 by release manager (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:33:58 UTC, 1 replies.
- Re: [I] Use stagex for the default container (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:36:21 UTC, 1 replies.
- Re: [I] We should add `Hadolint` a Dockerfile linter, validate inline bash, written in Haskell (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:37:55 UTC, 0 replies.
- Re: [I] Use Mailpit to improve email tests (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:41:35 UTC, 0 replies.
- Re: [I] Retry failed email deliveries (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:44:19 UTC, 0 replies.
- Re: [I] Resolve the design of emptiness and nullability for form types (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/22 23:52:09 UTC, 0 replies.
- [PR] Only change perms if necessary (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/23 11:32:58 UTC, 7 replies.
- Docker log showing GET messages every couple of seconds - posted by sebb <se...@gmail.com> on 2026/01/23 12:42:17 UTC, 5 replies.
- [I] Ensure that `TimeoutError: SSL shutdown timed out` do not happen or are not logged (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/23 16:17:46 UTC, 9 replies.
- [I] Read enisa sbom landscape analysis (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/23 20:25:38 UTC, 6 replies.
- Poetry in BAT, uv in ATR: should these continue to differ? - posted by sebb <se...@gmail.com> on 2026/01/24 10:08:43 UTC, 2 replies.
- [PR] Clean up SSL shutdown noise in logs (tooling-trusted-releases) - posted by "sanjana2505006 (via GitHub)" <gi...@apache.org> on 2026/01/24 20:30:59 UTC, 2 replies.
- [PR] fix(security): centralize escaping for template substitutions (tooling-trusted-releases) - posted by "Abhishekmishra2808 (via GitHub)" <gi...@apache.org> on 2026/01/26 15:02:11 UTC, 2 replies.
- [I] Make checklist URLs consistent with the corresponding model (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/26 15:53:42 UTC, 3 replies.
- [PR] fix(security): implement centralized type-safe escaping for template substitutions (#554) (tooling-trusted-releases) - posted by "Abhishekmishra2808 (via GitHub)" <gi...@apache.org> on 2026/01/26 17:28:09 UTC, 3 replies.
- [I] Regression: in dev mode no ldap connection means no admin functions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/26 18:13:44 UTC, 4 replies.
- [I] Guardrails for linting intentionally unused variables (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/26 21:17:47 UTC, 2 replies.
- [I] Litestream stream backups (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/26 21:30:06 UTC, 4 replies.
- [PR] Bump actions/cache from 5.0.1 to 5.0.2 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/26 22:02:06 UTC, 1 replies.
- [PR] Bump actions/checkout from 6.0.1 to 6.0.2 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/01/26 22:02:14 UTC, 1 replies.
- [I] Use validated asf_uid, not the value supplied by the user (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/26 22:13:25 UTC, 11 replies.
- Re: [I] Allow different authentication methods on a single endpoint (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/01/27 15:31:18 UTC, 1 replies.
- [PR] feat(security): centralize secure HTTP sessions and enforce TLS 1.2+ … (tooling-trusted-releases) - posted by "Abhishekmishra2808 (via GitHub)" <gi...@apache.org> on 2026/01/27 18:34:54 UTC, 2 replies.
- [I] Allow files to be excluded on upload (tooling-actions) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/27 19:06:02 UTC, 6 replies.
- [I] Enforce absolute maximum session lifetime for web sessions (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:24:50 UTC, 9 replies.
- [I] Add project-level authorization to /published/ endpoint (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:25:32 UTC, 1 replies.
- [I] Invalidate all PATs when user account is disabled (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:26:44 UTC, 0 replies.
- [I] Limit regex complexity in user-supplied ignore patterns (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:28:08 UTC, 2 replies.
- [I] Validate release workflow phase before operations (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:28:49 UTC, 0 replies.
- [I] Apply URL encoding to query parameters and paths (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:29:16 UTC, 0 replies.
- [I] Validate against CR/LF characters in HTTP header values (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:30:35 UTC, 3 replies.
- [I] Sanitize email header values against CRLF injection (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:31:00 UTC, 7 replies.
- [I] Limit archive member count to prevent zip bomb attacks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/27 21:32:15 UTC, 1 replies.
- [PR] Limit archive member count to prevent zip bomb attacks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/28 03:59:43 UTC, 4 replies.
- [GH] Limit archive member count to prevent zip bomb attacks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/28 15:20:20 UTC, 0 replies.
- [I] Ensure that Dependabot PRs are checked against the action allow list (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/28 15:28:04 UTC, 8 replies.
- [I] Detect `npm pack` output and allow `package/` as its root directory (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/28 16:15:19 UTC, 2 replies.
- Re: [I] Document how to provide a groupId for Maven (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/28 17:39:44 UTC, 6 replies.
- [PR] Fix: Mitigate CRLF injection in email headers (Issue #603) (tooling-trusted-releases) - posted by "Abhishekmishra2808 (via GitHub)" <gi...@apache.org> on 2026/01/28 19:34:22 UTC, 6 replies.
- [GH] Fix: Mitigate CRLF injection in email headers (Issue #603) (tooling-trusted-releases) - posted by "sebbASF (via GitHub)" <gi...@apache.org> on 2026/01/28 20:32:34 UTC, 20 replies.
- [I] Discuss refining permissions for uploading CI builds into ATR (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/28 22:49:05 UTC, 0 replies.
- Re: [I] promote uploading via GHA (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/28 23:33:04 UTC, 0 replies.
- [I] Add release manager storage permissions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/29 15:53:19 UTC, 0 replies.
- Re: [I] Committees where committers may release (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/29 16:15:32 UTC, 1 replies.
- [I] Make check ignores apply per project, not per committee (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/29 16:18:53 UTC, 2 replies.
- Re: [I] Root directory not matching ? Should we always use -source ? (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/29 19:33:14 UTC, 1 replies.
- Re: [I] Link from RAT check failure to local reproduction instructions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/29 20:44:07 UTC, 1 replies.
- [I] Merge env/tooling to production (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/29 21:33:48 UTC, 4 replies.
- Re: [I] New compose project option for repository branch (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/30 18:38:29 UTC, 1 replies.
- [I] Deploy self hosted GitHub action runners for distribution workflows (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/30 19:48:32 UTC, 3 replies.
- Re: [I] Release catalog model (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/30 20:02:34 UTC, 0 replies.
- Re: [I] Document the checks made by ATR (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/01/30 20:05:10 UTC, 1 replies.
- [I] Discuss integrations with ECMA standards (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/30 22:07:18 UTC, 1 replies.
- Re: [I] Export data through Transparency Exchange API (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/30 22:09:51 UTC, 0 replies.
- [I] Discuss upstreaming of certain components (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/01/31 18:41:05 UTC, 1 replies.