You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "sbp (via GitHub)" <gi...@apache.org> on 2026/04/10 16:27:02 UTC
[I] Remove the ability to generate test JWT tokens (tooling-trusted-releases)
sbp opened a new issue, #1152:
URL: https://github.com/apache/tooling-trusted-releases/issues/1152
The audit tool often complains about this. Also, when we remove these, we can also remove the "if pat_hash:" branch in `jwtokens.py` because the GitHub JWTs are handled through a different codepath, and the only tokens lacking the `atr_th` (pat_hash) are the test tokens.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Remove the ability to generate test JWT tokens (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1152:
URL: https://github.com/apache/tooling-trusted-releases/issues/1152#issuecomment-4225865233
Implementing this would fix #1029. Closing that so that it's tracked here instead.
> JWTs issued through the web UI (/tokens/jwt) are not bound to any PAT and remain valid for their full 30-minute TTL regardless of logout or authentication factor changes. Only JWTs with the atr_th (PAT hash) claim are validated against the PAT database. The jwtoken.issue() function generates a jti (JWT ID) claim for all JWTs, but this claim is never checked against any denylist or revocation registry.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Remove the ability to generate test JWT tokens (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1152:
URL: https://github.com/apache/tooling-trusted-releases/issues/1152#issuecomment-4225236874
Or if we want to keep this ability, we should link them to a PAT, @alitheg points out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Remove the ability to generate test JWT tokens (tooling-trusted-releases)
Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg closed issue #1152: Remove the ability to generate test JWT tokens
URL: https://github.com/apache/tooling-trusted-releases/issues/1152
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org