You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Samin061 (via GitHub)" <gi...@apache.org> on 2026/08/18 10:57:50 UTC
[PR] restrict permissions on teradata credential files written for ssh runs [airflow]
Samin061 opened a new pull request, #71766:
URL: https://github.com/apache/airflow/pull/71766
The Teradata remote-execution paths write the tbuild script, the tdload job-variable file, and the BTEQ script to a local temp file before encrypting and transferring them, and each of those embeds the connection password (`UserPassword`/`TargetUserPassword` for TPT, `.LOGON <host>/<user>,<password>` for BTEQ). The local-execution siblings already restrict those files to the owner through `set_local_file_permissions`, but the three SSH paths left them at the process umask, so under a common umask the credential files are group- and world-readable on disk before transfer. This applies the same owner-only restriction at the three remote-execution sites and adds regression tests.
---
##### Was generative AI tooling used to co-author this PR?
- [ ] Yes (please specify the tool below)
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] restrict permissions on teradata credential files written for ssh runs [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #71766:
URL: https://github.com/apache/airflow/pull/71766#issuecomment-5839378605
Hello @Samin061 - thank you for your contributions to Apache Airflow!
The Airflow community has introduced a limit of **5 open pull requests at a time** for contributors without write access to the repository. You currently have 7 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:
* #69585 - Fix execution API 404 for connection IDs containing a slash
* #69644 - validate log server hostname before building the log fetch url
* #69850 - prevent path traversal in ObjectStoragePath recursive copy to local
* #71700 - escape connection type and field name in registry connection builder
* #71766 - restrict permissions on teradata credential files written for ssh runs
These pull requests stay open because maintainers are already engaged in them - they count towards your limit:
* #70000 - Strip connection headers on cross-host redirect in HttpHook
* #71423 - disable external entities in SAML idp response parsing
This is **not** a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.
What we ask you to do is to make your **first prioritization decision**: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or `gh pr reopen <PR_NUMBER> --repo apache/airflow`. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.
While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.
Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.
---
Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] restrict permissions on teradata credential files written for ssh runs [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #71766: restrict permissions on teradata credential files written for ssh runs
URL: https://github.com/apache/airflow/pull/71766
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org