You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/26 21:17:47 UTC
[I] Guardrails for linting intentionally unused variables (tooling-trusted-releases)
andrewmusselman opened a new issue, #589:
URL: https://github.com/apache/tooling-trusted-releases/issues/589
Example found by audit:
```
# atr/db/interaction.py lines 185-213
async def trusted_jwt_for_dist(
publisher: str, jwt: str, asf_uid: str, phase: TrustedProjectPhase, project_name: str, version_name: str
) -> tuple[dict[str, Any], str, sql.Project, sql.Release]:
payload, _asf_uid = await validate_trusted_jwt(publisher, jwt) # _asf_uid is IGNORED
# ...
return payload, asf_uid, project, release # Returns user-provided asf_uid, not JWT-validated one
```
This was not caught by `F841` in the `F` category for `pyflakes` which we do have set in `tool.ruff.lint`, because the leading `_` indicates "intentionally unused variable". But in this case this would have been good for the linter to complain about it.
Might be overkill to instrument this but worth a discussion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Guardrails for linting intentionally unused variables (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #589:
URL: https://github.com/apache/tooling-trusted-releases/issues/589#issuecomment-3802008025
Say we did the following instead:
```
payload = await validate_trusted_jwt(publisher, jwt)[0]
```
Or this:
```
payload, asfuid = await validate_trusted_jwt(publisher, jwt)
# ...
return payload, asf_uid, project, release
```
How would these be linted?
What these alternatives demonstrate is that raising an error on all ignored variables would not catch this class of bug, because this is a _business logic_ bug and the validation of this kind of business logic exceeds the capabilities of the linters that we have available. That's why we run these separate audits.
The individual bug here is now being tracked as #594.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Guardrails for linting intentionally unused variables (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #589: Guardrails for linting intentionally unused variables
URL: https://github.com/apache/tooling-trusted-releases/issues/589
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org