You are viewing a plain text version of this content. The canonical link for it is here.
- Re: [I] Invalidate authorization cache and session file cache on logout/session termination (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/01 19:31:09 UTC, 5 replies.
- Re: [I] Missing `session.check_access()` in multiple route handlers (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/01 19:35:05 UTC, 4 replies.
- [PR] Add check access controls for committers (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/01 20:25:24 UTC, 3 replies.
- Re: [I] Add release manager storage permissions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/01 22:19:37 UTC, 1 replies.
- Re: [PR] Drop admin privileges (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 09:28:29 UTC, 1 replies.
- Re: [I] Distribution data model uses lax schema allowing extra fields (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 10:05:31 UTC, 0 replies.
- Re: [I] Add a mode for admins to browse as themselves with no admin permissions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 13:56:20 UTC, 0 replies.
- [I] Allow released files to be read more widely (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 14:07:21 UTC, 1 replies.
- Re: [I] Preserve the history of configuration options that affect attestations (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 14:17:47 UTC, 0 replies.
- Re: [I] Implement authentication failure logging (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 14:41:28 UTC, 0 replies.
- Re: [I] Apply URL encoding to distribution platform API URL parameters (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 15:11:44 UTC, 2 replies.
- Re: [I] Ensure that tasks themselves are cached as well as task results (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 15:12:51 UTC, 0 replies.
- Re: [I] Add protocol validation for external vulnerability URLs in SBOM display (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 15:32:54 UTC, 0 replies.
- [PR] #344 - instructions on how to upload via GitHub Actions (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/02 15:51:00 UTC, 1 replies.
- [GH] #344 - instructions on how to upload via GitHub Actions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 16:41:08 UTC, 2 replies.
- Re: [PR] Remove unnecessary test endpoint (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 17:01:31 UTC, 0 replies.
- Re: [I] `/admin/test` performs state-changing write via GET request (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 17:01:33 UTC, 0 replies.
- Re: [I] Review permissions for all actions in ATR (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 19:56:55 UTC, 1 replies.
- [GH] Validate sec-fetch headers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 20:01:36 UTC, 1 replies.
- Re: [PR] Validate sec-fetch headers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 20:08:26 UTC, 2 replies.
- Re: [PR] Add has post access check for controls for committers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 20:24:39 UTC, 0 replies.
- [I] Links on main docs page missing `docs/` (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 20:32:02 UTC, 2 replies.
- Re: [PR] Fix manual vote resolution configuration (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 21:07:04 UTC, 0 replies.
- Re: [I] Manual vote resolution bypasses required vote verification (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/02 21:07:05 UTC, 0 replies.
- Re: [I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 21:25:38 UTC, 3 replies.
- [I] Rework or remove the published endpoint (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 21:28:15 UTC, 1 replies.
- Re: [I] Add Origin header validation for API endpoints (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 21:40:57 UTC, 2 replies.
- [PR] Satisfy ASVS #786 (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 21:51:09 UTC, 2 replies.
- Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 22:02:22 UTC, 5 replies.
- [PR] Remove hardcoded tooling users (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 22:48:02 UTC, 1 replies.
- Re: [I] Prefix and formatting for LLM audit comments (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/02 22:53:01 UTC, 3 replies.
- [I] Audit guidance tests (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 00:41:10 UTC, 1 replies.
- [PR] Adding Cache-Control params; fixes #788 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 01:17:00 UTC, 1 replies.
- [PR] Adding comments for SVN upload sizes; fixes #718 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 01:32:17 UTC, 5 replies.
- [PR] Adding comment for vote email validation; fixes #773 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 01:47:51 UTC, 1 replies.
- [PR] Adding comment for confirm dialog; fixes #767 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 01:55:00 UTC, 1 replies.
- [PR] Adding a comment about octet-stream; fixes #714 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 02:04:01 UTC, 1 replies.
- [PR] Adding comment about data display; fixes #711 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/03 02:13:18 UTC, 1 replies.
- Re: [I] Consider improving logging (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 02:36:11 UTC, 1 replies.
- [PR] #656 - add check_access to remaining handlers (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/03 09:18:40 UTC, 1 replies.
- Re: [I] IDOR in distribution delete — missing `check_access()` and form/URL parameter mismatch (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/03 09:32:32 UTC, 1 replies.
- [GH] Adding Cache-Control params; fixes #788 (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 14:08:33 UTC, 1 replies.
- Re: [I] Vote email body construction lacks input sanitization (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 14:10:14 UTC, 0 replies.
- Re: [I] Refactor confirm dialog from inline JavaScript to data attributes (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 14:11:07 UTC, 0 replies.
- Re: [I] Use accurate Content-Type for file downloads instead of generic application/octet-stream (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 14:11:44 UTC, 0 replies.
- Re: [I] Fix Content-Type mismatch — JSON returned as text/plain in /result/data endpoint (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 14:12:05 UTC, 0 replies.
- Re: [I] Add content size limits to SVN import (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 14:39:21 UTC, 15 replies.
- Re: [I] Move hardcoded committee membership to external configuration (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 15:14:27 UTC, 0 replies.
- Re: [I] Implement Sec-Fetch-* header validation middleware (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 15:47:39 UTC, 0 replies.
- Re: [I] ShellResponse and JWT endpoint missing Content-Disposition headers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 15:54:52 UTC, 0 replies.
- Re: [PR] File type validation on upload through web browser (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 15:58:26 UTC, 1 replies.
- [I] Document ATR disk layout and size requirements (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 16:15:46 UTC, 0 replies.
- Re: [I] Path traversal in storage layer `delete_file` and `generate_hash_file` (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 17:55:47 UTC, 1 replies.
- Re: [I] Check XML parsing to prevent XXE attacks (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 18:18:33 UTC, 3 replies.
- [PR] Validate no CR/LF in http header values (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 18:36:42 UTC, 1 replies.
- Re: [I] Validate against CR/LF characters in HTTP header values (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 18:45:35 UTC, 0 replies.
- [I] Regular root file gets reported as directory when `targz.structure` fails (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/03 18:53:07 UTC, 3 replies.
- Re: [I] Make all client responses JSON by default (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 19:30:05 UTC, 2 replies.
- Re: [I] Improve error reporting when /resolve/tabulated data is unavailable (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 21:06:19 UTC, 1 replies.
- Re: [I] Prevent the reuse of detached session objects in database commit contexts (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 21:15:35 UTC, 1 replies.
- Re: [I] Use Mailpit to improve email tests (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 21:18:25 UTC, 0 replies.
- Re: [I] promote uploading via GHA (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 21:20:48 UTC, 1 replies.
- Re: [I] Require two approvals for important actions (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 21:43:49 UTC, 0 replies.
- Re: [I] Document how to provide a groupId for Maven (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/03 21:53:29 UTC, 1 replies.
- [I] Vote resolved date is not set (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 15:34:34 UTC, 3 replies.
- Re: [I] Add a quarantined validation period after uploading and before checks are started (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/04 16:29:06 UTC, 1 replies.
- Re: [I] Document pip-audit CVE exception/suppression process (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 17:36:46 UTC, 0 replies.
- Re: [I] Document approved cryptographic algorithms for the project (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 17:51:15 UTC, 0 replies.
- Re: [I] Create centralized input validation documentation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 17:57:43 UTC, 3 replies.
- [PR] Add explicit charset (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 20:21:05 UTC, 6 replies.
- Re: [I] Add explicit charset to JSON and text response helpers (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 20:37:00 UTC, 3 replies.
- Re: [I] Admin override access lacks persistent audit logging (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/04 20:58:50 UTC, 2 replies.
- Re: [I] Open redirect via unvalidated OAuth login redirect parameter (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 21:16:41 UTC, 0 replies.
- Re: [I] Add size limits to SSH/rsync file uploads (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 21:59:33 UTC, 0 replies.
- [PR] Use session asf_uid when adding ssh key and pat (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 22:42:05 UTC, 1 replies.
- [PR] Search ldap returning limited attributes (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 23:15:38 UTC, 3 replies.
- [PR] Add start_tls to smtp connection (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 23:25:30 UTC, 2 replies.
- Re: [I] Apply URL encoding to mailing list API query parameters (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/04 23:48:36 UTC, 2 replies.
- Re: [I] ATR logo request (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 00:10:23 UTC, 0 replies.
- [PR] New atr logo topnav treatment (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 00:36:22 UTC, 2 replies.
- [PR] Don't merge: for discussion (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/05 11:45:07 UTC, 7 replies.
- [I] Vote result email To configuration (tooling-trusted-releases) - posted by "cstamas (via GitHub)" <gi...@apache.org> on 2026/03/05 13:01:05 UTC, 2 replies.
- [I] [Discuss] Dependency release chains (tooling-trusted-releases) - posted by "cstamas (via GitHub)" <gi...@apache.org> on 2026/03/05 13:04:05 UTC, 3 replies.
- Re: [I] Storage layer accepts arbitrary user IDs for SSH key and PAT creation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 14:15:30 UTC, 0 replies.
- Re: [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 14:21:29 UTC, 4 replies.
- Re: [I] Add STARTTLS initiation to SMTP mail relay in `atr/mail.py` (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 15:18:48 UTC, 0 replies.
- Re: [I] Check for bombs and other archival problems in uploads (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 15:22:54 UTC, 1 replies.
- Re: [I] Remove `token_hash` from PersonalAccessToken API responses (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 15:49:19 UTC, 1 replies.
- [I] Revoke JWTs when a PAT is deleted (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 16:04:17 UTC, 5 replies.
- Re: [I] Filter sensitive fields from Task objects in API responses (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 16:06:12 UTC, 1 replies.
- Re: [I] Validate release workflow phase before operations (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 18:10:44 UTC, 2 replies.
- Re: [I] TLS: Add explicit cipher suite configuration for defense-in-depth (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 18:37:04 UTC, 1 replies.
- [I] Study replacing repository.apache.org (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 18:53:26 UTC, 1 replies.
- Re: [I] Implement JWT token revocation mechanism (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 20:20:06 UTC, 1 replies.
- [GH] Don't merge: for discussion (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/05 20:59:52 UTC, 8 replies.
- Re: [I] Clarify and constrain permitted ASF TLP version numbers (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 21:00:02 UTC, 2 replies.
- [PR] Adjust topnav menu if ALLOW_TESTS (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 22:29:07 UTC, 1 replies.
- [PR] Make token change emails more clear (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/05 22:48:04 UTC, 1 replies.
- [GH] Utilising taint tracking types (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/06 14:41:32 UTC, 1 replies.
- Re: [PR] Utilising taint tracking types (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/06 15:14:47 UTC, 0 replies.
- Re: [I] Record 3-way merge metadata (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/06 15:34:55 UTC, 1 replies.
- Re: [I] Verify all DistributionPlatform template URLs use HTTPS (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/06 16:31:55 UTC, 0 replies.
- [I] Backfill archives (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/06 18:37:04 UTC, 2 replies.
- [I] Determine a list of file types that can be blocked based on extension (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/06 19:02:50 UTC, 10 replies.
- Re: [I] Implement file type/content validation for uploads (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/06 19:15:13 UTC, 2 replies.
- [I] Uploading PAX archives fails due to an extraction error (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/06 20:26:51 UTC, 3 replies.
- Re: [I] Project metadata to add to project database (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/06 23:03:18 UTC, 8 replies.
- [I] Detailed quarantine archive extraction error messages are not reported (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/08 14:40:38 UTC, 2 replies.
- [I] Allow quarantine failure reports to be cleared (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/08 14:48:39 UTC, 2 replies.
- [I] Some source archives are not detected at source (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/08 19:58:55 UTC, 5 replies.
- Re: [I] Upload file path validation bypass when file_name parameter is provided (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/08 21:18:57 UTC, 2 replies.
- Re: [I] Clear JWT token and CSRF token from DOM on session end / timeout (ASVS 14.3.1) (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 09:25:02 UTC, 4 replies.
- Re: [I] Block announcing a release if tagged distributions have not yet been done (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 09:33:08 UTC, 0 replies.
- Re: [I] Path traversal in attestable file path construction (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 09:37:07 UTC, 1 replies.
- Re: [I] Test whether `quart_wtf` works (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 10:49:01 UTC, 0 replies.
- Re: [I] Verify CSRF coverage for `@post.empty()` decorated endpoints (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 10:49:42 UTC, 5 replies.
- Re: [I] `/test/login` performs session creation via GET request (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 10:51:26 UTC, 2 replies.
- [I] SVN Import task not starting (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 11:22:18 UTC, 1 replies.
- Re: [I] Add and use exploratory taint tracking types (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/09 15:04:01 UTC, 3 replies.
- [I] Trying to add ignore with invalid data updates existing ignore forms on the page (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/09 17:12:20 UTC, 6 replies.
- [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.3.1 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/09 18:04:14 UTC, 2 replies.
- Re: [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.3.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/09 18:04:15 UTC, 1 replies.
- [PR] Bump actions/upload-artifact from 6.0.0 to 7.0.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/09 18:04:25 UTC, 0 replies.
- [I] Support `SafeCommittee` taint tracking (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/09 18:57:47 UTC, 12 replies.
- [I] Checks failed on Maven JLink Plugin 3.3.0 (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/09 19:30:59 UTC, 7 replies.
- Re: [I] Insufficient archive member path validation in check tasks (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/09 19:54:20 UTC, 0 replies.
- [I] Add a filetype warning check (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/09 20:49:57 UTC, 0 replies.
- [PR] Bump astral-sh/setup-uv from 7.3.0 to 7.3.1 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/09 21:33:03 UTC, 2 replies.
- Re: [I] JWT subject (ASF UID) lacks format validation (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:28:18 UTC, 1 replies.
- Re: [I] Task arguments lack schema validation in worker pipeline (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:28:41 UTC, 1 replies.
- Re: [I] Semgrep XML security rules in pre-commit (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:28:57 UTC, 1 replies.
- Re: [I] Update docs with relpath (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:33:34 UTC, 1 replies.
- Re: [I] Apply `form.to_relpath()` consistently in `draft.py` and `finish.py` POST handlers (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:36:02 UTC, 1 replies.
- Re: [I] Configure explicit TLS version constraints for Hypercorn server (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:41:09 UTC, 5 replies.
- [PR] Adding comment for SSH workflow key (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:51:36 UTC, 1 replies.
- [PR] Adding comment about sending mail to other committees (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/09 23:58:51 UTC, 1 replies.
- [PR] Adding comment about public download of release files (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 00:10:25 UTC, 1 replies.
- [PR] Adding comments for key and token deletion (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 00:32:33 UTC, 1 replies.
- Re: [I] Add not-before validation for SSH workflow keys (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 00:39:23 UTC, 0 replies.
- Re: [I] Message sending lacks committee-scoped recipient validation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 00:40:07 UTC, 0 replies.
- Re: [I] Public download access to draft/pre-release artifacts (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 00:41:12 UTC, 0 replies.
- Re: [I] Token deletion missing ownership validation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 00:41:49 UTC, 0 replies.
- [PR] Adding docs for auth bypass (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 00:53:41 UTC, 1 replies.
- Re: [I] Test mode authorization bypass allows all users test committee access (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 00:53:59 UTC, 1 replies.
- [PR] Adding docs about public API endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 01:09:52 UTC, 1 replies.
- Re: [I] Missing authorization on public API check results (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 01:14:28 UTC, 1 replies.
- Re: [I] GitHub workflow arguments lack key/value validation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/10 09:47:26 UTC, 0 replies.
- Re: [I] Improve type validation of GET parameters (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/10 11:38:07 UTC, 1 replies.
- [PR] Drop `file_name` field in upload files (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 16:42:58 UTC, 4 replies.
- Re: [I] SVN import URL lacks scheme validation — SSRF and local file read risk (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 17:42:04 UTC, 8 replies.
- [I] Require the release manager to confirm that they are ignoring non-blocking errors (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/10 17:50:08 UTC, 0 replies.
- Re: [I] RAO / maven upload only works for single release artifact (+classifiers) (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 18:15:28 UTC, 5 replies.
- [PR] Add TLS security configuration docs (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 20:35:21 UTC, 1 replies.
- Re: [I] Missing authorization on SBOM endpoints (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 21:16:12 UTC, 1 replies.
- [PR] Adding comment for domain checking (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 21:21:39 UTC, 1 replies.
- [PR] Adding relpath to docs (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 21:38:02 UTC, 1 replies.
- Re: [I] SVN import accepts arbitrary URLs without validation (SSRF) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 21:38:41 UTC, 0 replies.
- [PR] Fix title case (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 21:42:12 UTC, 1 replies.
- [PR] Added comment about versioning (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 21:57:11 UTC, 1 replies.
- Re: [I] Populate `version.py` at build time (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/10 22:00:33 UTC, 0 replies.
- [PR] Add support for pyproject.toml and Docker in Dependabot (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/10 22:01:40 UTC, 1 replies.
- [I] Move extracted directories out of the cache directory (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 15:24:22 UTC, 3 replies.
- [I] Make extracted archive directories immutable (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 15:25:49 UTC, 2 replies.
- Re: [I] User Identity Trust Boundary in Background Tasks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 16:42:08 UTC, 1 replies.
- Re: [I] SSH server lacks brute force protection (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/11 16:49:04 UTC, 0 replies.
- Re: [I] Extend Dependabot configuration to cover pip and Docker ecosystems (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 16:55:11 UTC, 0 replies.
- [PR] Bump ldap3 from 2.10.2rc2 to 2.10.2rc3 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/11 16:59:14 UTC, 2 replies.
- [PR] Bump rich from 14.0.0 to 14.3.3 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/11 16:59:23 UTC, 2 replies.
- [PR] Bump aiosmtplib from 4.0.2 to 5.1.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/11 16:59:52 UTC, 2 replies.
- [PR] Bump email-validator from 2.2.0 to 2.3.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/11 17:00:14 UTC, 2 replies.
- [PR] Bump aiofiles from 24.1.0 to 25.1.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/11 17:03:24 UTC, 2 replies.
- Re: [I] Make CSRF token required in Form base class (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 17:36:42 UTC, 1 replies.
- [I] SSL configuration on release-test needs work (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/11 17:39:12 UTC, 9 replies.
- Re: [I] Email validation insufficient across codebase (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 19:12:55 UTC, 1 replies.
- [I] Use extracted archives in checks rather than extracting archives again (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 19:28:45 UTC, 3 replies.
- [I] Remove Referrer-Policy from server headers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 20:11:19 UTC, 4 replies.
- Re: [I] Also check for null bytes (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 20:23:10 UTC, 1 replies.
- [I] Trest -bin and -bin- like -src and -src- (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 20:32:25 UTC, 1 replies.
- Re: [I] Add size limits to LICENSE/NOTICE file reads and remote KEYS fetch (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 20:40:34 UTC, 1 replies.
- Re: [I] Treat -bin and -bin- like -src and -src- (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/11 21:05:09 UTC, 6 replies.
- Re: [I] Should podling votes during the second phase be cc'd to the project (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/11 21:05:21 UTC, 1 replies.
- Re: [I] Create security documentation for authentication defense controls (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/11 22:30:37 UTC, 1 replies.
- [PR] Adding docs for cascading (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/11 22:47:31 UTC, 4 replies.
- Re: [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/12 00:05:08 UTC, 1 replies.
- Test message - posted by Alastair McFarlane <al...@gmail.com> on 2026/03/12 12:03:26 UTC, 0 replies.
- [I] Vote tabulation - UID/email detection doesn't work when sent from external email with strict DKIM settings (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/12 12:29:05 UTC, 6 replies.
- Re: [I] Validate JWKS URI against allowlist in GitHub OIDC flow (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/12 14:34:48 UTC, 0 replies.
- [I] Automatically close old releases in compose phase (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 14:38:51 UTC, 2 replies.
- Re: [I] Add temporal validation helper to `TrustedPublisherPayload` model (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/12 14:49:40 UTC, 5 replies.
- [I] Subscribe to pubsub for LDAP and use it to inform authorisation decisions (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 16:06:05 UTC, 2 replies.
- Re: [I] Implement server-side session store to enable session revocation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/12 16:09:34 UTC, 5 replies.
- Re: [I] Add user configuration for navigation pinning and colour blindness mode (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 17:06:05 UTC, 0 replies.
- Re: [I] Automatically delete unfinished releases (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/12 17:26:04 UTC, 0 replies.
- Re: [I] Move test routes to a separate blueprint (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 17:42:40 UTC, 1 replies.
- Re: [I] Vote content fields lack length and content validation (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/12 18:04:40 UTC, 7 replies.
- [I] Session handling refactor parent (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/12 18:14:02 UTC, 1 replies.
- Re: [I] Handle session isolation for mixed authentication methods (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 18:28:26 UTC, 1 replies.
- Re: [I] Fix Content-Type mismatch — plain text error responses served as text/html in asfquart (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/12 18:39:06 UTC, 3 replies.
- Re: [I] Enforce MAX_CONTENT_LENGTH and add file upload size limits across all HTTP entry points (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/12 18:53:18 UTC, 1 replies.
- [PR] Moving asfquart doc into `atr/docs` (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/12 20:07:34 UTC, 3 replies.
- [GH] Moving asfquart doc into `atr/docs` (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 20:19:13 UTC, 0 replies.
- Re: [I] Document how to become a Trusted Publishing project (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/12 20:41:26 UTC, 2 replies.
- [I] Documents GitHub * workflow paths (tooling-trusted-releases) - posted by "slawekjaranowski (via GitHub)" <gi...@apache.org> on 2026/03/12 21:26:56 UTC, 0 replies.
- [PR] Logout is a POST (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/12 21:38:20 UTC, 2 replies.
- [I] Remove `LICENSE` and `NOTICE` checks for binary packages (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/13 14:10:48 UTC, 5 replies.
- [VOTE] Release Tooling 0.1 - posted by ar...@apache.org on 2026/03/13 14:11:12 UTC, 4 replies.
- [I] Make license header checks more lenient (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/13 14:23:17 UTC, 0 replies.
- [I] Classification is inconsistent (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/13 14:36:28 UTC, 1 replies.
- [I] Turning off the global check result cache does not work (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/13 14:57:09 UTC, 4 replies.
- [I] Allow more filenames in top level checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/13 15:18:23 UTC, 2 replies.
- [I] All emails queried from LDAP on every vote tabulation (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/13 17:05:02 UTC, 0 replies.
- [I] ATR OpenAPI viewer 500 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/13 20:14:13 UTC, 2 replies.
- [PR] Adding a pydantic json schema for output; fixes #883 (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/13 20:43:59 UTC, 0 replies.
- [PR] Bump pyjwt from 2.11.0 to 2.12.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/14 01:15:42 UTC, 2 replies.
- [I] pre-commit: we can add `checkmake` a linter for Makefiles. It scans Makefiles for potential issues based on configurable rules. (tooling-trusted-releases) - posted by "jbampton (via GitHub)" <gi...@apache.org> on 2026/03/14 18:11:13 UTC, 0 replies.
- [PR] Fix typo in Markdown file (tooling-trusted-releases) - posted by "jbampton (via GitHub)" <gi...@apache.org> on 2026/03/14 18:41:15 UTC, 5 replies.
- [I] Does the Docker container run as the root user ? Implement a Non-Root User (tooling-trusted-releases) - posted by "jbampton (via GitHub)" <gi...@apache.org> on 2026/03/14 19:11:43 UTC, 4 replies.
- [I] Dependabot now supports pre-commit hooks (tooling-trusted-releases) - posted by "jbampton (via GitHub)" <gi...@apache.org> on 2026/03/14 19:30:59 UTC, 1 replies.
- [I] We can add `editorconfig-checker` with pre-commit: a tool to verify that your files are in harmony with your `.editorconfig` (tooling-trusted-releases) - posted by "jbampton (via GitHub)" <gi...@apache.org> on 2026/03/14 19:45:14 UTC, 1 replies.
- Re: [PR] Adding a pydantic json schema for output (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/15 17:17:11 UTC, 1 replies.
- [I] Support Mermaid charts in the documentation pages (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/15 17:42:29 UTC, 0 replies.
- Test message - please ignore - posted by Alastair McFarlane <ar...@apache.org> on 2026/03/16 11:18:48 UTC, 0 replies.
- [I] Record the check version number in the check result table (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/16 14:42:33 UTC, 3 replies.
- [I] Record latest presence, hash, and classification data in the database (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/16 14:52:51 UTC, 1 replies.
- [PR] #776 - implement 50k character limit for vote comment and support passing form errors through a cache in the form module instead of via flash in the session (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/16 16:01:14 UTC, 0 replies.
- [PR] Add `pre-commit` hooks to dependabot.yml (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/16 16:29:26 UTC, 1 replies.
- [PR] Bump https://github.com/oxc-project/mirrors-oxlint from v1.55.0 to 1.56.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/16 17:12:16 UTC, 2 replies.
- [PR] Bump stylelint-config-standard from 37.0.0 to 40.0.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/16 17:12:20 UTC, 3 replies.
- [PR] Bump pydantic-core from 2.41.5 to 2.42.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/16 17:12:22 UTC, 2 replies.
- [PR] Bump stylelint from 16.14.1 to 17.4.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/16 17:12:29 UTC, 4 replies.
- [PR] Bump aiosqlite from 0.21.0 to 0.22.1 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/16 17:12:58 UTC, 2 replies.
- [I] Expand SBOM support (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/16 17:29:05 UTC, 3 replies.
- [I] Refactor "_name" properties to "_key" (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/17 12:13:08 UTC, 3 replies.
- [PR] Rename name params and columsn to keys (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/17 12:27:28 UTC, 0 replies.
- Re: [I] Improve `LICENSE` and `NOTICE` checks for binary packages (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/18 16:19:26 UTC, 1 replies.
- Re: [I] Add Clear-Site-Data header and client-side storage clearing on logout (ASVS 14.3.1) (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 16:23:43 UTC, 2 replies.
- [GH] Record check version in the database (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/18 17:04:07 UTC, 5 replies.
- Re: [PR] Record check version in the database (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/18 17:30:13 UTC, 2 replies.
- [PR] Adding OAuth docs (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/18 18:41:45 UTC, 2 replies.
- [I] Added features to email Message class in `atr/mail.py` (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 19:42:35 UTC, 2 replies.
- Re: [I] Investigate remote promotion of artifacts on third party platforms (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 20:28:38 UTC, 3 replies.
- Re: [I] Retry failed email deliveries (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 21:44:59 UTC, 1 replies.
- Re: [I] Warn the user if the "Preserve download files" option is checked during announcing (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 21:47:46 UTC, 1 replies.
- Re: [I] Use a prefix for all secret tokens, and inform selected third party scanners (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 21:49:44 UTC, 2 replies.
- [I] Artifact catalog schema (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 23:25:38 UTC, 0 replies.
- Re: [I] Do not allow keys to be deleted if they have been used to sign a release (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/18 23:34:24 UTC, 0 replies.
- [I] Project cycle schema (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 03:20:13 UTC, 0 replies.
- [I] Project reference metadata (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 03:21:39 UTC, 4 replies.
- [I] Lifecycle event model (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 03:23:33 UTC, 1 replies.
- Re: [I] Release catalog model (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 03:28:44 UTC, 1 replies.
- Re: [I] Add distribution directory template to finish release policy (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 03:41:58 UTC, 1 replies.
- Re: [I] Add a "historical only" flag for outdated keys (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 03:43:52 UTC, 0 replies.
- Re: [I] Document OAuth architecture and ASVS V10.4.x delegation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/19 14:09:41 UTC, 0 replies.
- Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 15:51:03 UTC, 0 replies.
- [I] safe.Path type (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/19 16:37:13 UTC, 1 replies.
- [I] Anonymous emails come back from lists.a.o (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/19 16:39:43 UTC, 1 replies.
- Re: [PR] Github TP Payload validation (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/19 17:07:56 UTC, 2 replies.
- [I] Project page reorganization (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 18:40:51 UTC, 0 replies.
- Re: [I] DB JDO project label is db-_jdo with an extra symbol between db and jdo (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 18:55:12 UTC, 2 replies.
- Re: [I] Organise the `atr.util` module (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 19:11:00 UTC, 0 replies.
- [I] Committees page allow four up cards (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 20:04:29 UTC, 1 replies.
- [I] Committee page seeing keys buttons when not a PMC member (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 20:13:15 UTC, 1 replies.
- [I] Reorganize committee page (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 20:25:02 UTC, 1 replies.
- [I] Define yaml/json format api for project metadata, cycle, and policy settings (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 20:47:54 UTC, 0 replies.
- Re: [I] Tidy test route blueprints (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/19 21:05:46 UTC, 0 replies.
- [PR] Invalidate SSH keys (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/19 23:49:00 UTC, 0 replies.
- [GH] Invalidate SSH keys (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/20 00:11:23 UTC, 4 replies.
- Re: [I] Move Trusted Publishing configuration into its own section (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/20 15:00:04 UTC, 2 replies.
- Re: [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/20 15:03:15 UTC, 3 replies.
- [I] Add `docs` as a new file classification (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/20 15:11:07 UTC, 2 replies.
- Re: [I] Document which project options affect file checks (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/20 17:58:07 UTC, 1 replies.
- [PR] Remove artifacts paths from project compose form (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/20 18:15:00 UTC, 2 replies.
- Re: [I] Remove artifact path policy fields from project form (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/20 18:57:42 UTC, 1 replies.
- [I] Ensure that at least one archive is classified as source in path checks (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/20 20:11:10 UTC, 1 replies.
- Re: [I] Abandon announcement actions if there is any problem (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/21 19:19:02 UTC, 2 replies.
- [PR] protect main branch against force push and delete (tooling-actions) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/03/22 15:27:31 UTC, 3 replies.
- Re: [I] Allow files to be excluded on upload (tooling-actions) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/22 18:19:37 UTC, 1 replies.
- Re: [I] Consider adding zizmor action security checks (tooling-actions) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/22 18:50:46 UTC, 1 replies.
- [I] Improve use of secrets (tooling-actions) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/22 18:52:42 UTC, 4 replies.
- [PR] Bump actions/setup-python from 5.4.0 to 6.2.0 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/22 19:00:47 UTC, 1 replies.
- [PR] Bump actions/checkout from 4.2.2 to 6.0.2 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/22 19:00:58 UTC, 1 replies.
- [PR] Bump actions/setup-java from 5.1.0 to 5.2.0 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/22 19:01:07 UTC, 1 replies.
- [I] Recommend upload api steps (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/22 20:12:05 UTC, 0 replies.
- Re: [I] Review Maven ATR plugin and make recommendations (tooling-trusted-releases) - posted by "hboutemy (via GitHub)" <gi...@apache.org> on 2026/03/22 21:56:15 UTC, 4 replies.
- [PR] #910 - emails support CC and BCC, and enum for footer to be appended. (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/23 13:59:04 UTC, 1 replies.
- [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.6.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/23 16:55:32 UTC, 0 replies.
- Re: [I] Implement the "Pause for RM" release policy option (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 19:18:44 UTC, 0 replies.
- Re: [I] Ensure that Dependabot PRs are checked against the action allow list (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 20:03:53 UTC, 1 replies.
- [PR] Bump biomejs/setup-biome from 2.7.0 to 2.7.1 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/23 20:28:40 UTC, 1 replies.
- [PR] Bump astral-sh/setup-uv from 7.3.1 to 7.6.0 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/23 20:29:01 UTC, 1 replies.
- [I] Compose feature complete (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 21:33:51 UTC, 0 replies.
- [I] Move file planner UX to compose phase (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 21:39:10 UTC, 3 replies.
- [I] Vote feature complete (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 21:42:29 UTC, 0 replies.
- [I] Require passing vote and time period before allowing vote completion (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 21:48:37 UTC, 1 replies.
- [I] Finish feature complete (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 21:51:00 UTC, 0 replies.
- [I] Project schema and models complete (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 22:15:20 UTC, 0 replies.
- [I] Update start release form to incorporate project cycles (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 22:23:10 UTC, 0 replies.
- [I] Committee release catalog schema and model complete (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/23 22:36:02 UTC, 0 replies.
- Re: [I] Improve the accuracy and UI for the OSV vulnerability scanner (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/24 15:46:01 UTC, 1 replies.
- [I] Supporting Erlang distribution channel (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/24 16:16:20 UTC, 0 replies.
- [VOTE] Release Tooling 0.3a - posted by sb...@apache.org on 2026/03/24 17:13:49 UTC, 0 replies.
- [VOTE] Release Tooling 0.3b - posted by sb...@apache.org on 2026/03/24 17:14:51 UTC, 0 replies.
- [I] Allow private vote threads to be tallied (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/24 17:53:01 UTC, 1 replies.
- [I] Update Pygments when a fix for CVE-2026-4539 is available (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 14:18:05 UTC, 0 replies.
- [I] Add a countdown timer till the end of the vote on the vote page (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 14:29:30 UTC, 2 replies.
- Re: [I] Mailing recipient improvements (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 14:58:46 UTC, 1 replies.
- Re: [I] Remove (not implement) the "Pause for RM" release policy option (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 16:14:25 UTC, 1 replies.
- Re: [I] Add a cancellation vote resolution option (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 16:27:10 UTC, 1 replies.
- [PR] #901 - add support for XML in sbom tooling (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/25 17:55:58 UTC, 0 replies.
- [I] Remove stict checking (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 19:37:15 UTC, 0 replies.
- [GH] Not for merging (yet) #901 - add support for XML in sbom tooling (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 20:20:11 UTC, 4 replies.
- Re: [I] Remove strict checking (tooling-trusted-releases) - posted by "sbp (via GitHub)" <gi...@apache.org> on 2026/03/25 20:58:48 UTC, 1 replies.
- Re: [I] Evaluate compliance with ASVS v5.0.0 L1 criteria (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/25 21:15:33 UTC, 1 replies.
- Re: [I] Discuss upstreaming of certain components (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/25 21:22:07 UTC, 1 replies.
- [I] LDAP state in dev/debug/test modes and users (tooling-trusted-releases) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/25 22:12:06 UTC, 4 replies.
- [PR] Audit docs, code, and reports (tooling-agents) - posted by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/03/26 06:06:29 UTC, 1 replies.
- Re: [PR] Not for merging (yet) #901 - add support for XML in sbom tooling (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/26 10:06:39 UTC, 3 replies.
- [PR] DRAFT: #931 - moving file planner to compose phase (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/26 14:59:00 UTC, 0 replies.
- Re: [PR] DRAFT: moving file planner to compose phase (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/27 17:25:57 UTC, 0 replies.
- [I] Improve vote counting algorithm (tooling-trusted-releases) - posted by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/03/28 09:22:10 UTC, 1 replies.
- [PR] Bump cryptography from 46.0.5 to 46.0.6 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/29 04:16:15 UTC, 2 replies.
- Re: [I] Add a directory creation hint to the file management interface (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/30 10:39:11 UTC, 0 replies.
- [I] Starting server with env var for expected secret crashes server (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/30 15:42:43 UTC, 0 replies.
- Re: [I] Bugs in vote counting algorithm (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/30 15:56:47 UTC, 0 replies.
- [PR] Possible LDAP implementation for review (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/30 15:58:24 UTC, 1 replies.
- [PR] Bump actions/cache from 5.0.3 to 5.0.4 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/30 17:51:43 UTC, 0 replies.
- Re: [PR] Bump actions/cache from 5.0.2 to 5.0.3 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/30 17:51:49 UTC, 1 replies.
- [PR] Bump actions/cache from 4.2.0 to 5.0.4 (tooling-actions) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/30 19:06:12 UTC, 0 replies.
- [PR] Bump pygments from 2.19.2 to 2.20.0 (tooling-releases-client) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/30 20:01:09 UTC, 0 replies.
- [PR] Bump actions/cache from 5.0.3 to 5.0.4 (tooling-trusted-releases) - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/03/30 21:31:01 UTC, 0 replies.
- [I] SSH Authentication Completely Bypasses LDAP Account Status Checks (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 00:25:35 UTC, 0 replies.
- [I] Global Session Validation Hook Checks Age But Not Account Status (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 00:25:55 UTC, 0 replies.
- [I] Key-Committee Association Bypasses Storage Layer Authorization (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 00:25:57 UTC, 0 replies.
- [I] No Global Anti-Caching Middleware (Architectural Gap) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:25 UTC, 0 replies.
- [I] SVN Operations Disable TLS Certificate Verification (Supply Chain Risk) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:27 UTC, 0 replies.
- [I] Admin Environment Variable Endpoint Exposes All Secrets Without Redaction (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:28 UTC, 0 replies.
- [I] Admin User Impersonation Has No Audit Trail (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:40 UTC, 1 replies.
- [I] Committee Key Bulk Deletion Bypasses Storage Layer and Audit (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:42 UTC, 0 replies.
- [I] OpenPGP Key Management Entirely Lacks Audit Logging (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:44 UTC, 0 replies.
- [I] Unsanitized Markdown-to-HTML Conversion Allows Stored XSS in SBOM Vulnerability Descriptions (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:46 UTC, 1 replies.
- [I] Trusted Publishing Cross-Field Validation Bypassed Via Web Form (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:47 UTC, 0 replies.
- [I] Vote Policy Form Bypasses Minimum Hours Range Check (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:48 UTC, 0 replies.
- [I] Missing Phase Validation in Vote Start Flow (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:50 UTC, 0 replies.
- [I] SBOM Task Functions Use File Paths Without Containment Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:53 UTC, 0 replies.
- [I] State-Changing API Endpoints Lack Per-Endpoint Rate Limits (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:54 UTC, 2 replies.
- [I] Release Vote Logic Validation Always Passes Due to Catch-All Pattern (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:54 UTC, 0 replies.
- [I] Vote Resolution Phase Transitions Lack Optimistic Locking (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:57 UTC, 0 replies.
- [I] Upload Staging Endpoint Ignores Authentication Context (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:33:58 UTC, 0 replies.
- [I] Documented Rate Limits Missing on Multiple API Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:07 UTC, 2 replies.
- [I] OAuth Authentication Does Not Terminate Prior Session Token (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:09 UTC, 0 replies.
- [I] No Session Termination After PAT Deletion or Creation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:10 UTC, 0 replies.
- [I] Admin Token Revocation Does Not Terminate User Web Sessions (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:12 UTC, 0 replies.
- [I] IDOR in Check Ignore Operations via Numeric ID (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:13 UTC, 0 replies.
- [I] IDOR on check_id in Check Result Data Endpoint (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:16 UTC, 0 replies.
- [I] Missing Project-Level Access Control on Multiple GET Endpoints (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:17 UTC, 0 replies.
- [I] ALLOW_TESTS Flag Enables Complete Authentication Bypass in Production Worker (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:35 UTC, 0 replies.
- [I] API JWT Creation Endpoint Missing Cache-Control Header (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:37 UTC, 0 replies.
- [I] rsync Subprocess Execution Without Timeout (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:48 UTC, 0 replies.
- [I] Missing Centralized Documentation of Resource-Intensive Operations (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:50 UTC, 0 replies.
- [I] Unbounded Directory Traversal and File Hashing in Signature Provenance Endpoint (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:52 UTC, 0 replies.
- [I] Archive Extraction Size Tracking Reset by Metadata Files (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:53 UTC, 0 replies.
- [I] Git Clone Operations Without Network Timeout (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:55 UTC, 0 replies.
- [I] Distribution Operations Have No Audit Logging (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:57 UTC, 1 replies.
- [I] SSH Host Key Generated with RSA 2048-bit (~112 bits of security) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:34:58 UTC, 0 replies.
- [I] No Validation of Uploaded OpenPGP Key Cryptographic Strength (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:00 UTC, 0 replies.
- [I] Missing URL Protocol Validation for Third-Party Distribution URLs Rendered in HTML (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:01 UTC, 0 replies.
- [I] LDAP Filter Injection in Account Lookup Function (Multiple Files) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:03 UTC, 0 replies.
- [I] Missing `--` Separator and Unsafe Argument Order in `sbomqs` Execution (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:04 UTC, 0 replies.
- [I] User Input Used Directly as RegExp Without Escaping in Project Directory Filter (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:07 UTC, 0 replies.
- [I] Unsandboxed render_string_sync API Allows Arbitrary Jinja2 Template Compilation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:09 UTC, 0 replies.
- [I] Sequential Template Substitution Allows Variable Injection in Email Templates (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:10 UTC, 0 replies.
- [I] Form Fields Bypass Safe Type Validation (Multiple Instances) (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:11 UTC, 0 replies.
- [I] Archive Extraction Does Not Inspect or Sanitize SVG Files (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:13 UTC, 0 replies.
- [I] No SVG Sanitization Library or Function Exists in Codebase (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:13 UTC, 0 replies.
- [I] HTTP Redirects Followed Without Target Domain Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:15 UTC, 0 replies.
- [I] Thread ID Parameter Lacks Format Validation Before Server-Side Request (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:17 UTC, 0 replies.
- [I] Tar Archive Extraction Uses Explicitly Insecure Default Filter (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:18 UTC, 0 replies.
- [I] Finish-Phase Operations Executable During Any Release Phase (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:20 UTC, 0 replies.
- [I] API Policy Update Bypasses Form-Level Business Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:21 UTC, 0 replies.
- [I] Optional Safe-Type URL Parameters Bypass Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:23 UTC, 0 replies.
- [I] SBOM score_tool Uses previous_release_version in Path Without Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:25 UTC, 0 replies.
- [I] API Models Lack Cross-Field Contextual Validation (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:26 UTC, 0 replies.
- [I] SSH Interface Lacks Rate Limiting for Write Operations (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:27 UTC, 0 replies.
- [I] No Automatic Credential Revocation on Account Disable (tooling-trusted-releases) - posted by "asf-tooling (via GitHub)" <gi...@apache.org> on 2026/03/31 01:35:29 UTC, 0 replies.
- [PR] Periodic recheck of LDAP status (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/31 13:32:51 UTC, 2 replies.
- [PR] Extract some of the validation for TP configuration into a shared helper (tooling-trusted-releases) - posted by "alitheg (via GitHub)" <gi...@apache.org> on 2026/03/31 14:22:57 UTC, 0 replies.
- [GH] Periodic recheck of LDAP status (tooling-trusted-releases) - posted by "dave2wave (via GitHub)" <gi...@apache.org> on 2026/03/31 17:14:08 UTC, 1 replies.