You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ar...@apache.org on 2026/03/11 15:50:10 UTC
(tooling-trusted-releases) branch arm updated (70a48069 -> 7dd2a2be)
This is an automated email from the ASF dual-hosted git repository.
arm pushed a change to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
discard 70a48069 Change gh slug for Maven distributions
discard 88b27f06 Validate user ID of PATs on JWT usage
add 78bf4740 Add unit tests for license file checks
new 79de7c4e Validate user ID of PATs on JWT usage
new 7dd2a2be Change gh slug for Maven distributions
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (70a48069)
\
N -- N -- N refs/heads/arm (7dd2a2be)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
atr/tasks/checks/license.py | 10 +++++
tests/unit/test_checks_license.py | 77 +++++++++++++++++++++++++++++++++++++++
2 files changed, 87 insertions(+)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
(tooling-trusted-releases) 02/02: Change gh slug for Maven distributions
Posted by ar...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
arm pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
commit 7dd2a2be7d7eb4261b8da66fc7df7fe2113ecdcd
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Wed Mar 11 15:42:43 2026 +0000
Change gh slug for Maven distributions
---
atr/models/sql.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/atr/models/sql.py b/atr/models/sql.py
index 2ba21727..ac70f282 100644
--- a/atr/models/sql.py
+++ b/atr/models/sql.py
@@ -121,7 +121,7 @@ class DistributionPlatform(enum.Enum):
# )
MAVEN = DistributionPlatformValue(
name="Maven Central",
- gh_slug="maven",
+ gh_slug="mavencentral",
template_url="https://repo1.maven.org/maven2/{owner_namespace}/{package}/maven-metadata.xml",
# Below is the old template using the maven search API - but the index isn't updated quickly enough for us
# template_url="https://search.maven.org/solrsearch/select?q=g:{owner_namespace}+AND+a:{package}+AND+v:{version}&core=gav&rows=20&wt=json",
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
(tooling-trusted-releases) 01/02: Validate user ID of PATs on JWT usage
Posted by ar...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
arm pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git
commit 79de7c4ea040ebe0aa26862cdb1e34f109fad2b9
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Tue Mar 10 17:05:31 2026 +0000
Validate user ID of PATs on JWT usage
---
atr/jwtoken.py | 3 +++
1 file changed, 3 insertions(+)
diff --git a/atr/jwtoken.py b/atr/jwtoken.py
index 2bf9dee4..2cebd4f0 100644
--- a/atr/jwtoken.py
+++ b/atr/jwtoken.py
@@ -143,6 +143,9 @@ async def verify(token: str) -> dict[str, Any]:
if not pat:
log.failed_authentication("pat_hash_invalid")
raise base.ASFQuartException("Personal Access Token invalid")
+ if pat.asfuid != claims.get("sub"):
+ log.failed_authentication("pat_user_mismatch")
+ raise base.ASFQuartException("Personal Access Token invalid")
if pat.expires < datetime.datetime.now(datetime.UTC):
log.failed_authentication("pat_expired")
raise base.ASFQuartException("Personal Access Token expired")
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org