(tooling-trusted-releases) branch main updated: #1064: Add audit guidance

[ar...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

arm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/main by this push:
     new d9e47ba8 #1064: Add audit guidance
d9e47ba8 is described below

commit d9e47ba8dce4a4a4e0c42e82939adc4db08b54ad
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Thu Apr 16 11:29:58 2026 +0100

    #1064: Add audit guidance
---
 atr/get/download.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/atr/get/download.py b/atr/get/download.py
index 2ba06751..d618fbe2 100644
--- a/atr/get/download.py
+++ b/atr/get/download.py
@@ -164,6 +164,9 @@ async def zip_selected(
     """
     URL: /download/zip/<project_key>/<version_key>
     """
+    # audit_guidance no file count or total size limit is enforced here intentionally: this endpoint requires
+    # committer authentication (web.Committer), release content is controlled at ingestion time, and providing
+    # an unrestricted download of one's own release is a core platform requirement
     try:
         release = await session.release(project_key=project_key, version_key=version_key, phase=None)
     except ValueError as e:


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org