You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ar...@apache.org on 2026/03/09 09:32:40 UTC
(tooling-trusted-releases) branch arm updated (eadf18d4 -> 8fd6be8a)
This is an automated email from the ASF dual-hosted git repository.
arm pushed a change to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
from eadf18d4 Add some missing underscore prefixes and an explicit notfound route - use that route on test/login when disabled (for #784)
add ecd6fe61 Extract quarantined archives to a staging directory first
add 8e210963 block published endpoints when not testing
add df73c600 Use JSON mode when serialising any Pydantic model in the API
add 427a333e Propagate archive extraction error messages
add c7d06743 Add forms to allow quarantine error messages to be dismissed
add d7719568 Update exarch and other dependencies
add de57b293 Always extract any archives uploaded before quarantine code was added
add 769e6257 Only extract archives added before quarantining once
add b5222e27 Detect source archives by stem suffix
add 5d6a978e Additionally detect source files by stem infix
new 8fd6be8a Use release name from URL and compare to the form to ensure no malicious/accidental use. Closes #655
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.pre-commit-config.yaml | 2 +-
atr/api/__init__.py | 92 ++++-----
atr/classify.py | 11 +-
atr/detection.py | 7 +-
atr/get/published.py | 5 +
atr/hashes.py | 9 +
atr/models/sql.py | 1 +
atr/post/distribution.py | 4 +
atr/post/draft.py | 21 ++
atr/server.py | 12 ++
atr/shared/draft.py | 4 +
atr/shared/web.py | 126 ++++++------
atr/storage/writers/revision.py | 21 ++
atr/tasks/quarantine.py | 184 +++++++++++++++---
atr/templates/check-selected.html | 41 ++--
....02_3799e8e6.py => 0056_2026.03.08_427a333e.py} | 24 +--
pyproject.toml | 2 +-
requirements-for-pip-audit.txt | 10 +-
tests/unit/test_detection.py | 22 +++
tests/unit/test_quarantine_backfill.py | 200 +++++++++++++++++++
tests/unit/test_quarantine_task.py | 211 ++++++++++++++++++++-
uv.lock | 116 +++++------
22 files changed, 908 insertions(+), 217 deletions(-)
copy migrations/versions/{0054_2026.03.02_3799e8e6.py => 0056_2026.03.08_427a333e.py} (63%)
create mode 100644 tests/unit/test_quarantine_backfill.py
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
(tooling-trusted-releases) 01/01: Use release name from URL and compare to the form to ensure no malicious/accidental use. Closes #655
Posted by ar...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
arm pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
commit 8fd6be8a983d0bd52634043471e41cc40747c17d
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Mon Mar 9 09:32:23 2026 +0000
Use release name from URL and compare to the form to ensure no malicious/accidental use. Closes #655
---
atr/post/distribution.py | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/atr/post/distribution.py b/atr/post/distribution.py
index 01f847ca..fd70485d 100644
--- a/atr/post/distribution.py
+++ b/atr/post/distribution.py
@@ -137,6 +137,10 @@ async def delete(
await session.check_access(project_name)
sql_platform = delete_form.platform.to_sql() # type: ignore[attr-defined]
+ url_release = sql.release_name(project_name, version_name)
+ if url_release != delete_form.release_name:
+ raise RuntimeError("Release name mismatch")
+
# Validate the submitted data, and obtain the committee for its name
async with db.session() as data:
release = await data.release(name=str(delete_form.release_name)).demand(
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org