You are viewing a plain text version of this content. The canonical link for it is here.
- [I] Indicate binding vote in mail sent to dev@project.a.o (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/01 06:26:26 UTC, 3 replies.
- Re: [I] Add a check to ensure that the source in tarballs is the same as the upstream repository (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/02 03:10:35 UTC, 0 replies.
- Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) - posted by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/02/02 05:44:24 UTC, 32 replies.
- Re: [I] Deploy self hosted GitHub action runners for distribution workflows (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/02 14:57:32 UTC, 0 replies.
- Re: [I] Discuss upstreaming of certain components (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/02 15:11:35 UTC, 0 replies.
- [VOTE] Release Tooling 26.2.2 - posted by sb...@apache.org on 2026/02/02 16:10:57 UTC, 1 replies.
- [VOTE] [RESULT] Release Apache Tooling 26.2.2 PASSED - posted by sb...@apache.org on 2026/02/02 16:13:00 UTC, 0 replies.
- [I] Allow PMC members to perform PMC actions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/02 17:14:35 UTC, 5 replies.
- [PR] Bump actions/setup-python from 6.1.0 to 6.2.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/02 19:11:13 UTC, 1 replies.
- Re: [PR] Bump actions/checkout from 4.3.0 to 6.0.2 (tooling-releases-client) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/02 19:15:18 UTC, 0 replies.
- Re: [PR] Bump actions/upload-artifact from 4.6.2 to 6.0.0 (tooling-releases-client) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/02 19:15:31 UTC, 0 replies.
- Re: [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.2.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/02 19:16:22 UTC, 1 replies.
- [I] Improve session testing by using more realising workflows (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/02 20:45:19 UTC, 1 replies.
- [I] Research whether structured ASFQuart permissions can be used more widely in ATR (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/02 21:02:58 UTC, 0 replies.
- [PR] Binding vote noted in email #616 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/02 21:55:57 UTC, 2 replies.
- [I] Remove workaround for pip-audit when pip 26.0 is available (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/03 00:12:29 UTC, 4 replies.
- [PR] Bump actions/setup-python from 6.1.0 to 6.2.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/03 02:15:36 UTC, 1 replies.
- Re: [I] Implement file type/content validation for uploads (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/03 11:42:45 UTC, 0 replies.
- Re: [I] Implement PyPi Distributions (tooling-trusted-releases) - posted by "potiuk (via GitHub)" <gi...@apache.org> on 2026/02/03 13:11:17 UTC, 0 replies.
- [I] Fix RuntimeWarning about Queue.join not being awaited (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/03 14:27:14 UTC, 2 replies.
- [PR] File type validation on upload through web browser (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/03 15:04:00 UTC, 12 replies.
- Re: [I] Setup projects vm for development (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/03 15:44:35 UTC, 2 replies.
- [I] Implement the "Pause for RM" release policy option (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/03 16:31:35 UTC, 2 replies.
- Re: [I] Improve session testing by using more realistic workflows (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/03 16:40:49 UTC, 2 replies.
- Re: [I] Add a check to ensure that the source in uploaded archives is a subset of the upstream repository (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/03 17:07:45 UTC, 5 replies.
- Re: [I] Apply URL encoding to query parameters and paths (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/04 11:28:25 UTC, 3 replies.
- Re: [I] Record masquerades in the audit log (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/04 15:33:39 UTC, 0 replies.
- Re: [I] Allow Projects to be defined via .asf.yaml (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/04 18:09:26 UTC, 0 replies.
- [I] Nexus 3 testing of both legacy and ATR methods on repository.apache.org (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/05 18:22:40 UTC, 2 replies.
- Re: [I] check for zip bombs in uploads (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/05 18:34:59 UTC, 4 replies.
- [I] Remove the leading `/` from RAT check results (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 14:48:56 UTC, 2 replies.
- Re: [I] Add a new class of check outcome that cannot be ignored (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 15:55:12 UTC, 3 replies.
- [I] Add a quarantined validation period after uploading and before checks are started (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 19:11:23 UTC, 6 replies.
- Re: [I] Check for bombs and other archival problems in uploads (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/06 19:14:09 UTC, 1 replies.
- [I] Add a column of file type and classifier to file lists (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 19:39:07 UTC, 9 replies.
- [I] Apply path ignores to implicitly classified source archives (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 19:43:10 UTC, 3 replies.
- [I] Add user configuration for navigation pinning and colour blindness mode (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 20:13:18 UTC, 1 replies.
- [I] Document how to become a Trusted Publishing project (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/06 20:27:57 UTC, 5 replies.
- [I] Login/logoff should be a button on the top nav and not a menu (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/06 20:41:19 UTC, 5 replies.
- Re: [I] Export data through Transparency Exchange API (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/06 21:16:09 UTC, 0 replies.
- Re: [I] Add further validation to check site consistency (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/06 21:23:30 UTC, 3 replies.
- [PR] Move auth buttons (tooling-trusted-releases) - posted by "Abhishekmishra2808 (via GitHub)" <gi...@apache.org> on 2026/02/06 21:47:30 UTC, 7 replies.
- [PR] Check templates linter (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/06 22:26:44 UTC, 2 replies.
- Re: [I] We could add the pull request labeler an action for automatically labelling pull requests (tooling-trusted-releases) - posted by "jbampton (via GitHub)" <gi...@apache.org> on 2026/02/07 18:59:37 UTC, 3 replies.
- [I] Consider adding zizmor action security checks (tooling-actions) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/07 22:42:14 UTC, 0 replies.
- Re: [I] Add a template usage linter (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/08 11:24:07 UTC, 0 replies.
- Re: [I] Use Mailpit to improve email tests (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/08 22:46:45 UTC, 0 replies.
- Re: [I] Prevent the reuse of detached session objects in database commit contexts (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/09 15:35:23 UTC, 0 replies.
- Re: [I] Document which project options affect file checks (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/09 17:35:30 UTC, 1 replies.
- Re: [I] Checks track (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/09 17:36:03 UTC, 0 replies.
- [PR] Bump actions/cache from 5.0.2 to 5.0.3 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/09 18:38:55 UTC, 0 replies.
- [I] Use caching on far more checks, as early as possible (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/09 19:31:19 UTC, 4 replies.
- [I] Deduplicate check results (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/09 19:34:16 UTC, 3 replies.
- [PR] Bump actions/cache from 5.0.2 to 5.0.3 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/09 23:26:44 UTC, 1 replies.
- Re: [I] Discuss refining permissions for uploading CI builds into ATR (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/10 14:34:58 UTC, 5 replies.
- [I] Apply 3-way file merges where possible automatically (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/10 15:52:43 UTC, 4 replies.
- [I] Redirect a uniform release artifact url pattern into the ASF's preferred urls (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/10 19:35:25 UTC, 1 replies.
- Re: [I] ATR logo request (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/10 22:54:34 UTC, 5 replies.
- [I] Organise the `atr.util` module (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/11 10:14:48 UTC, 4 replies.
- [I] Make filename and path validation stricter, and duplicate at point of use (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/11 10:24:48 UTC, 3 replies.
- [I] Add and use exploratory taint tracking types (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/11 10:27:02 UTC, 3 replies.
- [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/11 12:11:47 UTC, 5 replies.
- Re: [I] Reporter integration with BAT (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/11 21:17:34 UTC, 1 replies.
- [I] Record 3-way merge metadata (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/12 19:05:42 UTC, 2 replies.
- [PR] Invalidate PATs; fixes #598 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/12 23:39:45 UTC, 3 replies.
- [GH] Invalidate PATs; fixes #598 (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/12 23:49:41 UTC, 0 replies.
- [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/13 15:47:50 UTC, 4 replies.
- [PR] add API and link to svn:dist area (tooling-trusted-releases) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/02/14 22:13:07 UTC, 1 replies.
- [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/02/14 22:39:03 UTC, 5 replies.
- [PR] link to svn:dist, not any svn (tooling-trusted-releases) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/02/14 23:25:58 UTC, 3 replies.
- Re: [I] Tie ATR server into the rsync path of svn dist artifacts (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/15 03:25:42 UTC, 1 replies.
- [GH] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/15 20:00:41 UTC, 0 replies.
- Re: [I] Integrate ATR secrets with Puppet (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/15 21:37:29 UTC, 1 replies.
- [I] Setup svn credentials to commit to dist/release (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/16 04:44:18 UTC, 6 replies.
- Re: [I] Integrate ATR with projects vm (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/16 04:52:35 UTC, 0 replies.
- [PR] Added merge logging to track file changes (tooling-trusted-releases) - posted by "userdefined111 (via GitHub)" <gi...@apache.org> on 2026/02/16 17:16:43 UTC, 3 replies.
- [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.3.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/16 17:27:53 UTC, 0 replies.
- [PR] Bump astral-sh/setup-uv from 7.2.0 to 7.3.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/16 20:37:26 UTC, 1 replies.
- [I] Ensure that Dependabot PRs are checked against the action allow list (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/16 20:44:20 UTC, 1 replies.
- [I] User impersonation via email sender bypass in message.py (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:34:34 UTC, 1 replies.
- [I] IDOR in distribution delete — missing `check_access()` and form/URL parameter mismatch (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:39:46 UTC, 0 replies.
- [I] Missing `session.check_access()` in multiple route handlers (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:41:04 UTC, 0 replies.
- [I] Storage layer accepts arbitrary user IDs for SSH key and PAT creation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:43:43 UTC, 1 replies.
- [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:45:22 UTC, 5 replies.
- [I] Test mode authorization bypass allows all users test committee access (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:52:40 UTC, 1 replies.
- [I] Missing authorization on public API check results (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:55:13 UTC, 1 replies.
- [I] Missing authorization on SBOM endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 05:57:50 UTC, 0 replies.
- [I] SVN import accepts arbitrary URLs without validation (SSRF) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:02:53 UTC, 0 replies.
- [I] Token deletion missing ownership validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:08:32 UTC, 0 replies.
- [I] Public download access to draft/pre-release artifacts (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:13:17 UTC, 0 replies.
- [I] Admin override access lacks persistent audit logging (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:14:52 UTC, 0 replies.
- [I] URL/form parameter mismatch in project category endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:16:57 UTC, 0 replies.
- [I] Incomplete committee validation in project deletion (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:17:42 UTC, 2 replies.
- [I] Error message says "create" instead of "delete" in `release_delete` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:18:36 UTC, 1 replies.
- [I] Message sending lacks committee-scoped recipient validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:20:21 UTC, 0 replies.
- [I] Validate JWKS URI against allowlist in GitHub OIDC flow (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:24:05 UTC, 0 replies.
- [I] Mark `unverified_header_and_payload` as internal and add security warnings (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:25:59 UTC, 1 replies.
- [I] Explicitly reject JWTs containing `jku`, `x5u`, or `jwk` headers (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:27:16 UTC, 1 replies.
- [I] Add not-before validation for SSH workflow keys (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:29:37 UTC, 0 replies.
- [I] Add `nbf` (not-before) claim to internally issued JWTs (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:31:37 UTC, 1 replies.
- [I] Add temporal validation helper to `TrustedPublisherPayload` model (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:34:03 UTC, 0 replies.
- [I] SSH server: Configure explicit cipher suites, KEX, and MAC algorithms (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:38:01 UTC, 2 replies.
- [I] TLS: Add explicit cipher suite configuration for defense-in-depth (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:40:02 UTC, 0 replies.
- [I] Document approved cryptographic algorithms for the project (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:40:42 UTC, 0 replies.
- [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:43:17 UTC, 4 replies.
- [I] Document OAuth architecture and ASVS V10.4.x delegation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:45:02 UTC, 0 replies.
- [I] Add explicit SCM path rejection to `_validate_relpath_string` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:47:58 UTC, 2 replies.
- [I] Add STARTTLS initiation to SMTP mail relay in `atr/mail.py` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:49:11 UTC, 0 replies.
- [I] Configure explicit TLS version constraints for Hypercorn server (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:51:17 UTC, 0 replies.
- [I] Enforce HTTPS-only for SVN PubSub listener URL in `atr/svn/pubsub.py` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:52:32 UTC, 3 replies.
- [I] Add TLS enforcement to download shell script in `atr/static/sh/download-urls.sh` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:54:41 UTC, 4 replies.
- [I] Add explicit TLS configuration to LDAP connections in `atr/ldap.py` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:55:37 UTC, 1 replies.
- [I] Verify all DistributionPlatform template URLs use HTTPS (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 06:57:08 UTC, 1 replies.
- [PR] #677 - Add explicit ciphers, kex and mac algorithms. (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/17 11:03:02 UTC, 2 replies.
- [PR] Use the intersection of algorithms from asyncssh and ssh-audit (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/17 15:20:46 UTC, 3 replies.
- [I] Ensure that tasks themselves are cached as well as task results (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/17 15:25:34 UTC, 2 replies.
- [I] Use continuation passing style for creating new revisions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/17 16:50:55 UTC, 2 replies.
- [I] Update docs with relpath (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/17 18:31:51 UTC, 0 replies.
- [PR] clarify ASF distribution vs third party channels (tooling-trusted-releases) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/02/17 23:04:09 UTC, 2 replies.
- [I] Remove release from SVN import options (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/18 20:20:40 UTC, 1 replies.
- [I] Add a mode for admins to browse as themselves with no admin permissions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/18 20:28:15 UTC, 6 replies.
- [I] Document reproducible builds, signing, SBOMs, and OpenSSF (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/18 20:34:11 UTC, 4 replies.
- [I] Clear JWT token and CSRF token from DOM on session end / timeout (ASVS 14.3.1) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:34:44 UTC, 0 replies.
- [I] Extend secret redaction patterns in `/admin/configuration` endpoint (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:37:12 UTC, 1 replies.
- [I] Remove `token_hash` from PersonalAccessToken API responses (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:37:51 UTC, 0 replies.
- [I] Filter sensitive fields from Task objects in API responses (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:39:37 UTC, 0 replies.
- [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:42:06 UTC, 0 replies.
- [I] Prefix and formatting for LLM audit comments (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:54:34 UTC, 0 replies.
- [I] Add integrity verification for Apache RAT JAR (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:55:51 UTC, 4 replies.
- [I] Pin syft version in Dockerfile (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:56:17 UTC, 1 replies.
- [I] Extend Dependabot configuration to cover pip and Docker ecosystems (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:56:52 UTC, 0 replies.
- [I] Use explicit allowlist for GitHub OIDC payload fields (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:11:41 UTC, 2 replies.
- [I] Add a "historical only" flag for outdated keys (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:14:37 UTC, 0 replies.
- [I] Document pip-audit CVE exception/suppression process (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:17:26 UTC, 0 replies.
- [I] Populate `version.py` at build time (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:19:29 UTC, 1 replies.
- [I] Fix Content-Type mismatch — JSON returned as text/plain in /result/data endpoint (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:22:05 UTC, 0 replies.
- [I] Add explicit charset to JSON and text response helpers (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:23:37 UTC, 0 replies.
- [I] Fix Content-Type mismatch — plain text error responses served as text/html in asfquart (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:26:11 UTC, 0 replies.
- [I] Use accurate Content-Type for file downloads instead of generic application/octet-stream (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 22:29:20 UTC, 0 replies.
- Re: [I] Implement RAO / Maven connectivity (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/18 23:11:56 UTC, 1 replies.
- Re: [I] Add read-only and read-write test projects (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/18 23:35:24 UTC, 1 replies.
- Re: [I] Add log sealing (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/18 23:39:16 UTC, 0 replies.
- [I] Make client responses json by default (tooling-releases-client) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/18 23:44:35 UTC, 0 replies.
- Re: [I] Document the intended transition to JSON outputs by default in the client (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/18 23:48:58 UTC, 1 replies.
- Re: [I] Evaluate compliance with ASVS v5.0.0 L1 criteria (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:01:51 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: server side execution (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:02:46 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: cross site scripting (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:03:00 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: weak cryptography (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:03:15 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: external access (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:03:32 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: universal spoofing (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:03:50 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: internal access (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:04:10 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: credential stealing (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:04:25 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: basic access (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:04:40 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: brute force identification (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:05:01 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: credential integrity (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:05:17 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: denial of service (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:05:43 UTC, 1 replies.
- Re: [I] Evaluate ASVS v5.0.0 compliance: documentation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 00:05:49 UTC, 1 replies.
- [I] Enforce MAX_CONTENT_LENGTH and add file upload size limits across all HTTP entry points (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 05:59:15 UTC, 0 replies.
- [I] Add size limits to SSH/rsync file uploads (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:00:42 UTC, 2 replies.
- [I] Add size limits to LICENSE/NOTICE file reads and remote KEYS fetch (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:02:32 UTC, 0 replies.
- [I] Add content size limits to SVN import (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:05:09 UTC, 0 replies.
- [I] Path traversal in attestable file path construction (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:05:49 UTC, 3 replies.
- [I] Path traversal in storage layer `delete_file` and `generate_hash_file` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:07:28 UTC, 3 replies.
- [I] Apply `form.to_relpath()` consistently in `draft.py` and `finish.py` POST handlers (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:09:26 UTC, 0 replies.
- [I] Insufficient archive member path validation in check tasks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:10:54 UTC, 2 replies.
- [I] SSH server lacks brute force protection (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:18:43 UTC, 0 replies.
- [I] Add rate limiting to Trusted Publisher JWT API endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:21:01 UTC, 2 replies.
- [I] Implement authentication failure logging (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:22:16 UTC, 0 replies.
- [I] Add production safety check for ALLOW_TESTS configuration (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:23:36 UTC, 1 replies.
- [I] Move hardcoded committee membership to external configuration (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:24:56 UTC, 1 replies.
- [I] Make test email address conditional on test environment (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:27:01 UTC, 2 replies.
- [I] Work on using config option for alpha-only (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:29:11 UTC, 1 replies.
- [I] Create security documentation for authentication defense controls (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:30:55 UTC, 0 replies.
- [I] Implement server-side session store to enable session revocation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:33:40 UTC, 0 replies.
- [I] Implement JWT token revocation mechanism (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:38:37 UTC, 0 replies.
- [I] Add session regeneration on OAuth authentication (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:45:18 UTC, 0 replies.
- [I] Document safe usage of `cmarkgfm` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:47:06 UTC, 2 replies.
- [I] Add LDAP account status check to session and JWT validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:47:53 UTC, 3 replies.
- [I] Invalidate authorization cache and session file cache on logout/session termination (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:49:09 UTC, 0 replies.
- [I] Invalidate all SSH keys when user account is disabled (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:50:56 UTC, 1 replies.
- [I] Handle session isolation for mixed authentication methods (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:53:31 UTC, 2 replies.
- [I] Bug: RAO / maven upload only works for single release artifact (+classifiers) (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/19 11:50:05 UTC, 3 replies.
- [PR] Assure debug mode is only set in development (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 17:52:21 UTC, 1 replies.
- [PR] Redact sensitive configurations (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 18:08:33 UTC, 1 replies.
- [PR] Block SCM directories (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 19:05:13 UTC, 1 replies.
- Re: [I] Escape database values before writing to database (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 19:13:27 UTC, 1 replies.
- [PR] Invalidate pats manually 598 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 21:21:38 UTC, 1 replies.
- [PR] Return 404 when project is unknown in api endpoint call (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 21:34:17 UTC, 1 replies.
- Re: [I] Ensure that a project can only be deleted or archived under certain conditions, and that the state is clear (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 21:49:16 UTC, 0 replies.
- [PR] Introduce ATR_STATUS and control recipient lists (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/19 22:27:08 UTC, 1 replies.
- [PR] Updated implementation of check hash checks for caching (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/20 12:29:04 UTC, 2 replies.
- [I] Fix the form to move files in the finish phase, and add regression tests (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/20 15:51:23 UTC, 2 replies.
- [PR] Bump flask from 3.1.2 to 3.1.3 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/20 16:28:34 UTC, 2 replies.
- [PR] Bump werkzeug from 3.1.5 to 3.1.6 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/02/20 16:28:37 UTC, 2 replies.
- Re: [I] Require two approvals for important actions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/20 16:56:03 UTC, 0 replies.
- Re: [I] Improve the accuracy and UI for the OSV vulnerability scanner (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/20 17:02:17 UTC, 0 replies.
- [GH] Updated implementation of check hash checks for caching (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/02/20 17:03:52 UTC, 2 replies.
- Re: [I] /api/project/releases/{name} should return 404 for non-existent project (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/20 18:09:29 UTC, 0 replies.
- Re: [I] Improve error reporting when /resolve/tabulated data is unavailable (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/20 18:29:29 UTC, 1 replies.
- Re: [I] Enforce absolute maximum session lifetime for web sessions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/20 19:49:53 UTC, 2 replies.
- Re: [I] Invalidate all PATs when user account is disabled (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/20 20:37:10 UTC, 0 replies.
- [PR] Improve curl download scripting (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/20 21:10:46 UTC, 1 replies.
- [I] Investigate remote promotion of artifacts on third party platforms (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/23 14:26:53 UTC, 2 replies.
- [I] Fix Litestream backups (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/23 14:48:14 UTC, 2 replies.
- [I] Make the user interface clearer in the finish phase (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/23 14:51:16 UTC, 3 replies.
- Re: [I] Allow release managers to be designated (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/23 17:05:57 UTC, 0 replies.
- [PR] Refactor Dockerfile to streamline Apache RAT installation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/23 18:33:01 UTC, 1 replies.
- [PR] Explicit ldap tls configuration (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/23 20:06:34 UTC, 1 replies.
- Re: [I] Release catalog model (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/23 20:45:41 UTC, 0 replies.
- Re: [I] Make the vast majority of files compatible with `fix_order.sh`, and add to linting (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/23 21:03:42 UTC, 1 replies.
- Re: [I] Investigate how to import Arrow checks output from GitHub CI (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/23 21:05:27 UTC, 2 replies.
- [I] Add the ability to add zero or more CI reference URLs to the compose phase (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/23 21:09:11 UTC, 0 replies.
- [I] Allow deleting of DOT files (tooling-trusted-releases) - posted by "erisu (via GitHub)" <gi...@apache.org> on 2026/02/24 07:36:17 UTC, 4 replies.
- Re: [I] Detect `npm pack` output and allow `package/` as its root directory (tooling-trusted-releases) - posted by "erisu (via GitHub)" <gi...@apache.org> on 2026/02/24 09:21:36 UTC, 0 replies.
- [I] Allow more flexible naming for npm artifacts (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/24 15:38:47 UTC, 0 replies.
- Re: [I] RAO / maven upload only works for single release artifact (+classifiers) (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/24 23:35:17 UTC, 0 replies.
- [I] Authorization Bypass via Exception Handling (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 03:52:59 UTC, 0 replies.
- [I] User Identity Trust Boundary in Background Tasks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 03:56:00 UTC, 0 replies.
- [I] Open redirect via unvalidated OAuth login redirect parameter (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 03:57:09 UTC, 0 replies.
- [I] SVN import URL lacks scheme validation — SSRF and local file read risk (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:01:54 UTC, 0 replies.
- [I] Check XML parsing to prevent XXE attacks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:04:06 UTC, 0 replies.
- [I] Semgrep XML security rules in pre-commit (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:05:32 UTC, 0 replies.
- [I] Apply URL encoding to distribution platform API URL parameters (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:06:55 UTC, 0 replies.
- [I] Apply URL encoding to mailing list API query parameters (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:07:52 UTC, 0 replies.
- [I] Refactor confirm dialog from inline JavaScript to data attributes (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:10:15 UTC, 0 replies.
- [I] Add protocol validation for external vulnerability URLs in SBOM display (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 04:10:59 UTC, 0 replies.
- [I] Allow `.gitkeep` as a temporary workaround (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/02/25 10:20:38 UTC, 2 replies.
- [I] Manual vote resolution bypasses required vote verification (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:44:25 UTC, 1 replies.
- [I] GitHub workflow arguments lack key/value validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:45:40 UTC, 0 replies.
- [I] Task arguments lack schema validation in worker pipeline (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:46:59 UTC, 0 replies.
- [I] Vote email body construction lacks input sanitization (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:49:37 UTC, 0 replies.
- [I] Email validation insufficient across codebase (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:53:21 UTC, 0 replies.
- [I] Also check for null bytes (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:54:12 UTC, 0 replies.
- [I] Vote content fields lack length and content validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:54:45 UTC, 0 replies.
- [I] Distribution data model uses lax schema allowing extra fields (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:55:58 UTC, 0 replies.
- [I] Create centralized input validation documentation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:56:26 UTC, 0 replies.
- [I] JWT subject (ASF UID) lacks format validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:57:20 UTC, 0 replies.
- [I] Upload file path validation bypass when file_name parameter is provided (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:58:37 UTC, 0 replies.
- [I] Pagination validation only checks upper bound (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 18:59:02 UTC, 0 replies.
- [I] `/admin/test` performs state-changing write via GET request (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:00:33 UTC, 0 replies.
- [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:01:56 UTC, 1 replies.
- [I] `/test/login` performs session creation via GET request (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:03:48 UTC, 0 replies.
- [I] Move test routes to a separate blueprint (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:04:37 UTC, 0 replies.
- [I] Add Origin header validation for API endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:05:55 UTC, 0 replies.
- [I] Implement Sec-Fetch-* header validation middleware (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:06:22 UTC, 0 replies.
- [I] ShellResponse and JWT endpoint missing Content-Disposition headers (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:08:45 UTC, 0 replies.
- [I] Verify CSRF coverage for `@post.empty()` decorated endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:10:00 UTC, 0 replies.
- [I] Test whether `quart_wtf` works (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:10:33 UTC, 1 replies.
- [I] Test whether `csrf: str` works (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:11:00 UTC, 1 replies.
- [I] Make CSRF token required in Form base class (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:13:17 UTC, 0 replies.
- [I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:13:45 UTC, 0 replies.
- Re: [I] Preserve the history of configuration options that affect attestations (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/28 20:40:07 UTC, 0 replies.
- [PR] Fix manual vote resolution configuration (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/02/28 22:04:07 UTC, 1 replies.