You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/05/14 10:08:55 UTC
[PR] docs(security): document supported deployment platforms [airflow]
potiuk opened a new pull request, #66931:
URL: https://github.com/apache/airflow/pull/66931
## Summary
Adds an explicit out-of-scope section for non-Linux platforms to the Security Model. Bugs that only manifest on Windows / macOS / other non-Linux platforms are not eligible for CVE allocation because Airflow does not officially support those platforms as deployment targets.
## Motivation
Codifies what was already the security team's practice — most recently the disposition on a 2026-05-14 IMAP-attachment-path-traversal report ([GHSA-w72r-xvc9-jwgh](https://github.com/apache/airflow/security/advisories/GHSA-w72r-xvc9-jwgh)) that only manifested on Windows due to backslash path-separator handling, closed NOT-CVE-WORTHY on this basis.
Without an explicit Security Model section, reporters routinely submit Windows-only path-traversal / RCE reports that the team has to invalidate one-by-one with manual reasoning. Future Windows-only / macOS-only reports will be closed against this section, and reporters can read the rule upfront before submitting through `security@`.
The rule applies symmetrically: a bug that affects Linux is judged on the Linux behavior regardless of whether it also reaches Windows; non-Linux-only bugs are out of scope.
## Test plan
- [ ] Render the docs locally with `breeze build-docs apache-airflow --package-filter apache-airflow` and confirm the new section appears under the existing out-of-scope items in the Security Model page.
- [ ] Spot-check that the new anchor `#supported-deployment-platforms` is generated correctly (Sphinx generates anchor IDs from heading text via kebab-case).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "shahar1 (via GitHub)" <gi...@apache.org>.
shahar1 commented on code in PR #66931:
URL: https://github.com/apache/airflow/pull/66931#discussion_r3246331612
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -826,3 +826,22 @@ significantly from typical web applications — many scanner findings (such as "
code" or "database credentials accessible in configuration") are expected behavior. Reports must
include a proof-of-concept that demonstrates how the finding violates the security model described
in this document, including identifying the specific user role involved and the attack scenario.
+
+Supported deployment platforms
+..............................
+
+Apache Airflow officially supports Linux-based deployment environments only. The reference
+deployment, the CI matrix, and the official Docker image are all Linux-targeted (Debian Bookworm).
+macOS is supported for local development but is not a deployment platform. Windows is not supported
+for deployment or development.
Review Comment:
nit: except for WSL (which sort of converges back into linux)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "shahar1 (via GitHub)" <gi...@apache.org>.
shahar1 commented on code in PR #66931:
URL: https://github.com/apache/airflow/pull/66931#discussion_r3246331612
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -826,3 +826,22 @@ significantly from typical web applications — many scanner findings (such as "
code" or "database credentials accessible in configuration") are expected behavior. Reports must
include a proof-of-concept that demonstrates how the finding violates the security model described
in this document, including identifying the specific user role involved and the attack scenario.
+
+Supported deployment platforms
+..............................
+
+Apache Airflow officially supports Linux-based deployment environments only. The reference
+deployment, the CI matrix, and the official Docker image are all Linux-targeted (Debian Bookworm).
+macOS is supported for local development but is not a deployment platform. Windows is not supported
+for deployment or development.
Review Comment:
nit: except for WSL (which sort of converges back into linux), and until https://github.com/apache/airflow/issues/10388 is resolved
(today with AI, someone might be brace enough to do so)
:)
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -826,3 +826,22 @@ significantly from typical web applications — many scanner findings (such as "
code" or "database credentials accessible in configuration") are expected behavior. Reports must
include a proof-of-concept that demonstrates how the finding violates the security model described
in this document, including identifying the specific user role involved and the attack scenario.
+
+Supported deployment platforms
+..............................
+
+Apache Airflow officially supports Linux-based deployment environments only. The reference
+deployment, the CI matrix, and the official Docker image are all Linux-targeted (Debian Bookworm).
+macOS is supported for local development but is not a deployment platform. Windows is not supported
+for deployment or development.
Review Comment:
nit: except for WSL (which sort of converges back into linux), and until https://github.com/apache/airflow/issues/10388 is resolved
(today with AI, someone might be brave enough to do so)
:)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #66931:
URL: https://github.com/apache/airflow/pull/66931#discussion_r3251084197
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -826,3 +826,22 @@ significantly from typical web applications — many scanner findings (such as "
code" or "database credentials accessible in configuration") are expected behavior. Reports must
include a proof-of-concept that demonstrates how the finding violates the security model described
in this document, including identifying the specific user role involved and the attack scenario.
+
+Supported deployment platforms
+..............................
+
+Apache Airflow officially supports Linux-based deployment environments only. The reference
+deployment, the CI matrix, and the official Docker image are all Linux-targeted (Debian Bookworm).
+macOS is supported for local development but is not a deployment platform. Windows is not supported
+for deployment or development.
Review Comment:
right
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on PR #66931:
URL: https://github.com/apache/airflow/pull/66931#issuecomment-4466167958
@potiuk Mhm, now you have merged this - means that if Edge Worker with Task SDK will implement Windows Support in future then this needs to be reverted and potentially all Path separators need to be found which might be unsafe?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #66931:
URL: https://github.com/apache/airflow/pull/66931
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "jscheffl (via GitHub)" <gi...@apache.org>.
jscheffl commented on PR #66931:
URL: https://github.com/apache/airflow/pull/66931#issuecomment-4450925835
@potiuk I still have the aim and a task on my bucket list making Edge + Task SDK working on a Windows system. In Airflow 2.10 there was also a experimental setup documented in https://airflow.apache.org/docs/apache-airflow-providers-edge3/stable/install_on_windows.html - so I am not really good in excluding this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #66931:
URL: https://github.com/apache/airflow/pull/66931#issuecomment-4464620663
### Backport successfully created: v3-2-test
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-2-test</td>
<td><a href="https://github.com/apache/airflow/pull/67017"><img src="https://img.shields.io/badge/PR-67017-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs(security): document supported deployment platforms [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #66931:
URL: https://github.com/apache/airflow/pull/66931#discussion_r3251078926
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -826,3 +826,22 @@ significantly from typical web applications — many scanner findings (such as "
code" or "database credentials accessible in configuration") are expected behavior. Reports must
include a proof-of-concept that demonstrates how the finding violates the security model described
in this document, including identifying the specific user role involved and the attack scenario.
+
+Supported deployment platforms
+..............................
+
+Apache Airflow officially supports Linux-based deployment environments only. The reference
+deployment, the CI matrix, and the official Docker image are all Linux-targeted (Debian Bookworm).
+macOS is supported for local development but is not a deployment platform. Windows is not supported
+for deployment or development.
Review Comment:
```suggestion
for deployment - except WSL2 for develop (buy only with POSIX filesystem which is the same as Linux).
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org