You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@maven.apache.org by Sandra Parsick <sa...@parsick.dev> on 2025/08/05 11:45:23 UTC
[VOTE] Introduce Prevent Branch Protection Rules
As discussed in a previous thread, it makes sense from a supply chain
security perspective to introduce the following branch protection rules
to all Maven repositories:
- Prevent force push
- Prevent branch deletion
It will be enabled by .asf.yaml to ensure that the same branch
protection rules are used for Gitbox and GitHub.
It will be enabled for all default and maintenance branches.
Tasks to do:
- Check every Maven repository has .asf.yaml
- Enabling above-mentioned branch protection rules in all Maven
repositories via .asf.yaml
If the vote passes, I will take care of it.
Vote open for at least 72 hours.
[ ] +1
[ ] +0
[ ] -1
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Mirko Friedenhagen <mf...@gmx.de.INVALID>.
If I understand https://github.com/apache/maven/blob/master/.asf.yaml#L11 ff. correctly merge is prohibited.
Mit freundlichen Grüßen
Mirko Friedenhagen
—
> Am 06.08.2025 um 09:10 schrieb Piotr P. Karwasz <pi...@mailing.copernik.eu>:
>
> Hi Tibor,
>
> On 5.08.2025 16:00, Tibor Digana wrote:
>> Is somebody using Git Merge? For sake of clarity of the log history, this
>> should be prohibited and Git Rebase should be used instead. This
>> alternative should be added in the Vote as well.
>
> Good topic!
>
> I think another interesting feature to discuss is requiring commit
> signatures (GPG or SSH) on all commits. This creates a verifiable trail
> showing that commits came from specific GitHub users, although that
> trail disappears if the user later removes the associated key from their
> account.
>
> The two topics are related:
>
> - Merge commits preserve signatures of all included changes, and the
> merge commit itself is signed by GitHub. However, as you noted, this
> can result in a cluttered history with “apply review suggestions” and
> other small technical commits and a very branched tree.
>
> - GitHub’s "Rebase" button removes the branching issue but discards the
> original commit signatures. If I recall correctly, with “verified
> mode” enabled, rebased commits are marked as *partially verified*.
>
> - Squash merges also discard original signatures but combine the PR into
> a single commit. Unless the PR is co-authored, GitHub marks that
> commit as “verified.” This is the option I use most often.
>
> That said, “merge” still has its place: for example, when merging
> release branches. In Log4j, we typically create a `release/x.y.z` branch
> just before a release for final adjustments, then merge it back afterward.
>
> The “rebase” button is probably my favorite one, as it breaks signatures
> and does not remove “apply review suggestions” commits. The improvement
> in the Git tree structure isn't really tangible.
>
> Piotr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Tibor,
On 5.08.2025 16:00, Tibor Digana wrote:
> Is somebody using Git Merge? For sake of clarity of the log history, this
> should be prohibited and Git Rebase should be used instead. This
> alternative should be added in the Vote as well.
Good topic!
I think another interesting feature to discuss is requiring commit
signatures (GPG or SSH) on all commits. This creates a verifiable trail
showing that commits came from specific GitHub users, although that
trail disappears if the user later removes the associated key from their
account.
The two topics are related:
- Merge commits preserve signatures of all included changes, and the
merge commit itself is signed by GitHub. However, as you noted, this
can result in a cluttered history with “apply review suggestions” and
other small technical commits and a very branched tree.
- GitHub’s "Rebase" button removes the branching issue but discards the
original commit signatures. If I recall correctly, with “verified
mode” enabled, rebased commits are marked as *partially verified*.
- Squash merges also discard original signatures but combine the PR into
a single commit. Unless the PR is co-authored, GitHub marks that
commit as “verified.” This is the option I use most often.
That said, “merge” still has its place: for example, when merging
release branches. In Log4j, we typically create a `release/x.y.z` branch
just before a release for final adjustments, then merge it back afterward.
The “rebase” button is probably my favorite one, as it breaks signatures
and does not remove “apply review suggestions” commits. The improvement
in the Git tree structure isn't really tangible.
Piotr
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Kemal Soysal <ke...@ls-it-solutions.de>.
Rebasing is quite simple usually when small neat commits line up in the branch… though deleted files / blocks in the main branch might confuse.
So far git diff best matches with the patience algorithm
Kemal
> Am 05.08.2025 um 16:17 schrieb Andy Law <an...@roslin.ed.ac.uk>:
>
> Although I’m just a lurker here, the idea of promoting the use of rebase on a shared repository seems incredibly dangerous. Or “brave” as some would put it.
>
> Later,
>
> Andy
>
> From: Tibor Digana <ti...@apache.org>
> Date: Tuesday, 5 August 2025 at 15:01
> To: Maven Developers List <de...@maven.apache.org>
> Subject: Re: [VOTE] Introduce Prevent Branch Protection Rules
>
> [You don't often get email from tibordigana@apache.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Is somebody using Git Merge? For sake of clarity of the log history, this
> should be prohibited and Git Rebase should be used instead. This
> alternative should be added in the Vote as well.
>
> Regarding branch deletions, I remember the time when we had to delete the
> master branch. It was a permission problem with a committer.
>
>> On Tue, Aug 5, 2025 at 1:45 PM Sandra Parsick <sa...@parsick.dev> wrote:
>>
>> As discussed in a previous thread, it makes sense from a supply chain
>> security perspective to introduce the following branch protection rules
>> to all Maven repositories:
>>
>> - Prevent force push
>> - Prevent branch deletion
>>
>> It will be enabled by .asf.yaml to ensure that the same branch
>> protection rules are used for Gitbox and GitHub.
>>
>> It will be enabled for all default and maintenance branches.
>>
>>
>> Tasks to do:
>> - Check every Maven repository has .asf.yaml
>> - Enabling above-mentioned branch protection rules in all Maven
>> repositories via .asf.yaml
>>
>>
>> If the vote passes, I will take care of it.
>>
>>
>> Vote open for at least 72 hours.
>>
>> [ ] +1
>> [ ] +0
>> [ ] -1
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>> For additional commands, e-mail: dev-help@maven.apache.org
>>
>>
> The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th’ ann an Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Mirko Friedenhagen <mf...@gmx.de.INVALID>.
+1 for protecting important branches while allowing squashing/force-push in PR branches
+1 for using Tibor's fast-forward only approach instead of merge commits.
Mit freundlichen Grüßen
Mirko
> Am 05.08.2025 um 18:04 schrieb Tibor Digana <ti...@apache.org>:
>
> Andy, you know what happens when you rebase locally in your branch?
> Your working copy is updated from remote master into your working copy
> which is then shifted to the HEAD commit if there are no conflicts. If
> there are conflicts, you have to resolve them within the rebase operation,
> and then you can push it from the branch to the master and this guarantees
> that you did not push two commits instead of one because you are always up
> to date on the latest commit always and the history is readable.
>
>> On Tue, Aug 5, 2025 at 4:16 PM Andy Law <an...@roslin.ed.ac.uk> wrote:
>>
>> Although I’m just a lurker here, the idea of promoting the use of rebase
>> on a shared repository seems incredibly dangerous. Or “brave” as some would
>> put it.
>>
>> Later,
>>
>> Andy
>>
>> From: Tibor Digana <ti...@apache.org>
>> Date: Tuesday, 5 August 2025 at 15:01
>> To: Maven Developers List <de...@maven.apache.org>
>> Subject: Re: [VOTE] Introduce Prevent Branch Protection Rules
>>
>> [You don't often get email from tibordigana@apache.org. Learn why this is
>> important at https://aka.ms/LearnAboutSenderIdentification ]
>>
>> Is somebody using Git Merge? For sake of clarity of the log history, this
>> should be prohibited and Git Rebase should be used instead. This
>> alternative should be added in the Vote as well.
>>
>> Regarding branch deletions, I remember the time when we had to delete the
>> master branch. It was a permission problem with a committer.
>>
>>> On Tue, Aug 5, 2025 at 1:45 PM Sandra Parsick <sa...@parsick.dev> wrote:
>>>
>>> As discussed in a previous thread, it makes sense from a supply chain
>>> security perspective to introduce the following branch protection rules
>>> to all Maven repositories:
>>>
>>> - Prevent force push
>>> - Prevent branch deletion
>>>
>>> It will be enabled by .asf.yaml to ensure that the same branch
>>> protection rules are used for Gitbox and GitHub.
>>>
>>> It will be enabled for all default and maintenance branches.
>>>
>>>
>>> Tasks to do:
>>> - Check every Maven repository has .asf.yaml
>>> - Enabling above-mentioned branch protection rules in all Maven
>>> repositories via .asf.yaml
>>>
>>>
>>> If the vote passes, I will take care of it.
>>>
>>>
>>> Vote open for at least 72 hours.
>>>
>>> [ ] +1
>>> [ ] +0
>>> [ ] -1
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>>> For additional commands, e-mail: dev-help@maven.apache.org
>>>
>>>
>> The University of Edinburgh is a charitable body, registered in Scotland,
>> with registration number SC005336. Is e buidheann carthannais a th’ ann an
>> Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Tibor Digana <ti...@apache.org>.
Andy, you know what happens when you rebase locally in your branch?
Your working copy is updated from remote master into your working copy
which is then shifted to the HEAD commit if there are no conflicts. If
there are conflicts, you have to resolve them within the rebase operation,
and then you can push it from the branch to the master and this guarantees
that you did not push two commits instead of one because you are always up
to date on the latest commit always and the history is readable.
On Tue, Aug 5, 2025 at 4:16 PM Andy Law <an...@roslin.ed.ac.uk> wrote:
> Although I’m just a lurker here, the idea of promoting the use of rebase
> on a shared repository seems incredibly dangerous. Or “brave” as some would
> put it.
>
> Later,
>
> Andy
>
> From: Tibor Digana <ti...@apache.org>
> Date: Tuesday, 5 August 2025 at 15:01
> To: Maven Developers List <de...@maven.apache.org>
> Subject: Re: [VOTE] Introduce Prevent Branch Protection Rules
>
> [You don't often get email from tibordigana@apache.org. Learn why this is
> important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Is somebody using Git Merge? For sake of clarity of the log history, this
> should be prohibited and Git Rebase should be used instead. This
> alternative should be added in the Vote as well.
>
> Regarding branch deletions, I remember the time when we had to delete the
> master branch. It was a permission problem with a committer.
>
> On Tue, Aug 5, 2025 at 1:45 PM Sandra Parsick <sa...@parsick.dev> wrote:
>
> > As discussed in a previous thread, it makes sense from a supply chain
> > security perspective to introduce the following branch protection rules
> > to all Maven repositories:
> >
> > - Prevent force push
> > - Prevent branch deletion
> >
> > It will be enabled by .asf.yaml to ensure that the same branch
> > protection rules are used for Gitbox and GitHub.
> >
> > It will be enabled for all default and maintenance branches.
> >
> >
> > Tasks to do:
> > - Check every Maven repository has .asf.yaml
> > - Enabling above-mentioned branch protection rules in all Maven
> > repositories via .asf.yaml
> >
> >
> > If the vote passes, I will take care of it.
> >
> >
> > Vote open for at least 72 hours.
> >
> > [ ] +1
> > [ ] +0
> > [ ] -1
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
> >
> The University of Edinburgh is a charitable body, registered in Scotland,
> with registration number SC005336. Is e buidheann carthannais a th’ ann an
> Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.
>
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Andy Law <an...@roslin.ed.ac.uk>.
Although I’m just a lurker here, the idea of promoting the use of rebase on a shared repository seems incredibly dangerous. Or “brave” as some would put it.
Later,
Andy
From: Tibor Digana <ti...@apache.org>
Date: Tuesday, 5 August 2025 at 15:01
To: Maven Developers List <de...@maven.apache.org>
Subject: Re: [VOTE] Introduce Prevent Branch Protection Rules
[You don't often get email from tibordigana@apache.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
Is somebody using Git Merge? For sake of clarity of the log history, this
should be prohibited and Git Rebase should be used instead. This
alternative should be added in the Vote as well.
Regarding branch deletions, I remember the time when we had to delete the
master branch. It was a permission problem with a committer.
On Tue, Aug 5, 2025 at 1:45 PM Sandra Parsick <sa...@parsick.dev> wrote:
> As discussed in a previous thread, it makes sense from a supply chain
> security perspective to introduce the following branch protection rules
> to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch
> protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven
> repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th’ ann an Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Tibor Digana <ti...@apache.org>.
Is somebody using Git Merge? For sake of clarity of the log history, this
should be prohibited and Git Rebase should be used instead. This
alternative should be added in the Vote as well.
Regarding branch deletions, I remember the time when we had to delete the
master branch. It was a permission problem with a committer.
On Tue, Aug 5, 2025 at 1:45 PM Sandra Parsick <sa...@parsick.dev> wrote:
> As discussed in a previous thread, it makes sense from a supply chain
> security perspective to introduce the following branch protection rules
> to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch
> protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven
> repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Arnaud Héritier <ah...@gmail.com>.
+1
Arnaud Héritier
GitHub/ASF/... : aheritier
On Tue, Aug 5, 2025 at 13:46 Sandra Parsick <sa...@parsick.dev> wrote:
> As discussed in a previous thread, it makes sense from a supply chain
> security perspective to introduce the following branch protection rules
> to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch
> protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven
> repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Hervé Boutemy <hb...@apache.org>.
yes, we should check what we can, not only what we want
given what we want vote is only on the minimal step, I'm +1
but eager on seeing how we can implement it (without going more aggressive)
for next steps, seing what we can will be a strong prerequisite on voting on it
Regards,
Hervé
On 2025/08/05 13:16:31 Konrad Windszus wrote:
> Hi Sandra,
> AFAIK only prevent force push is evaluated by Gitbox. Do you have any reference about the branch deletion part?
> I am not against it, just highlighting that you can bypass it.
>
> Thanks,
> Konrad
>
> > On 5. Aug 2025, at 13:45, Sandra Parsick <sa...@parsick.dev> wrote:
> >
> > As discussed in a previous thread, it makes sense from a supply chain security perspective to introduce the following branch protection rules to all Maven repositories:
> >
> > - Prevent force push
> > - Prevent branch deletion
> >
> > It will be enabled by .asf.yaml to ensure that the same branch protection rules are used for Gitbox and GitHub.
> >
> > It will be enabled for all default and maintenance branches.
> >
> >
> > Tasks to do:
> > - Check every Maven repository has .asf.yaml
> > - Enabling above-mentioned branch protection rules in all Maven repositories via .asf.yaml
> >
> >
> > If the vote passes, I will take care of it.
> >
> >
> > Vote open for at least 72 hours.
> >
> > [ ] +1
> > [ ] +0
> > [ ] -1
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Sandra Parsick <sa...@parsick.dev>.
Thanks for highlighting it.
I have asked the ASF infra Team [1] and they confirmed that both rules
are synced if we are using .asf.yaml.
[1] https://the-asf.slack.com/archives/CBX4TSBQ8/p1754468118813779
Am 05.08.25 um 15:16 schrieb Konrad Windszus:
> Hi Sandra,
> AFAIK only prevent force push is evaluated by Gitbox. Do you have any reference about the branch deletion part?
> I am not against it, just highlighting that you can bypass it.
>
> Thanks,
> Konrad
>
>> On 5. Aug 2025, at 13:45, Sandra Parsick <sa...@parsick.dev> wrote:
>>
>> As discussed in a previous thread, it makes sense from a supply chain security perspective to introduce the following branch protection rules to all Maven repositories:
>>
>> - Prevent force push
>> - Prevent branch deletion
>>
>> It will be enabled by .asf.yaml to ensure that the same branch protection rules are used for Gitbox and GitHub.
>>
>> It will be enabled for all default and maintenance branches.
>>
>>
>> Tasks to do:
>> - Check every Maven repository has .asf.yaml
>> - Enabling above-mentioned branch protection rules in all Maven repositories via .asf.yaml
>>
>>
>> If the vote passes, I will take care of it.
>>
>>
>> Vote open for at least 72 hours.
>>
>> [ ] +1
>> [ ] +0
>> [ ] -1
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>> For additional commands, e-mail: dev-help@maven.apache.org
>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Konrad Windszus <kw...@apache.org>.
Hi Sandra,
AFAIK only prevent force push is evaluated by Gitbox. Do you have any reference about the branch deletion part?
I am not against it, just highlighting that you can bypass it.
Thanks,
Konrad
> On 5. Aug 2025, at 13:45, Sandra Parsick <sa...@parsick.dev> wrote:
>
> As discussed in a previous thread, it makes sense from a supply chain security perspective to introduce the following branch protection rules to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Kemal Soysal <ke...@ls-it-solutions.de>.
+1
Kemal
> Am 05.08.2025 um 13:45 schrieb Sandra Parsick <sa...@parsick.dev>:
>
> As discussed in a previous thread, it makes sense from a supply chain security perspective to introduce the following branch protection rules to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Maarten Mulders <mt...@apache.org>.
+1
Maarten
On August 5, 2025 at 12:45, Sandra Parsick wrote:
> As discussed in a previous thread, it makes sense from a supply chain
> security perspective to introduce the following branch protection rules
> to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch
> protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven
> repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Olivier Lamy <ol...@apache.org>.
On Wed, 6 Aug 2025 at 12:20, Olivier Lamy <ol...@apache.org> wrote:
>
> +1
> I guess it's only for master/main :)
Well, eventually for main branches as well (such maven-3.9.x etc...)
>
> On Tue, 5 Aug 2025 at 21:45, Sandra Parsick <sa...@parsick.dev> wrote:
> >
> > As discussed in a previous thread, it makes sense from a supply chain
> > security perspective to introduce the following branch protection rules
> > to all Maven repositories:
> >
> > - Prevent force push
> > - Prevent branch deletion
> >
> > It will be enabled by .asf.yaml to ensure that the same branch
> > protection rules are used for Gitbox and GitHub.
> >
> > It will be enabled for all default and maintenance branches.
> >
> >
> > Tasks to do:
> > - Check every Maven repository has .asf.yaml
> > - Enabling above-mentioned branch protection rules in all Maven
> > repositories via .asf.yaml
> >
> >
> > If the vote passes, I will take care of it.
> >
> >
> > Vote open for at least 72 hours.
> >
> > [ ] +1
> > [ ] +0
> > [ ] -1
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Olivier Lamy <ol...@apache.org>.
+1
I guess it's only for master/main :)
On Tue, 5 Aug 2025 at 21:45, Sandra Parsick <sa...@parsick.dev> wrote:
>
> As discussed in a previous thread, it makes sense from a supply chain
> security perspective to introduce the following branch protection rules
> to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch
> protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven
> repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: [VOTE] Introduce Prevent Branch Protection Rules
Posted by Anders Hammar <an...@hammar.net>.
+1
/Anders
On Tue, Aug 5, 2025 at 1:45 PM Sandra Parsick <sa...@parsick.dev> wrote:
>
> As discussed in a previous thread, it makes sense from a supply chain
> security perspective to introduce the following branch protection rules
> to all Maven repositories:
>
> - Prevent force push
> - Prevent branch deletion
>
> It will be enabled by .asf.yaml to ensure that the same branch
> protection rules are used for Gitbox and GitHub.
>
> It will be enabled for all default and maintenance branches.
>
>
> Tasks to do:
> - Check every Maven repository has .asf.yaml
> - Enabling above-mentioned branch protection rules in all Maven
> repositories via .asf.yaml
>
>
> If the vote passes, I will take care of it.
>
>
> Vote open for at least 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org