You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by fr...@apache.org on 2026/09/02 19:24:39 UTC
(logging-log4net) 01/01: Harden the release scripts and connection string redaction #313
This is an automated email from the ASF dual-hosted git repository.
FreeAndNil pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 34e428947875b243f644df78eb5efe91da054ef4
Merge: 9ed3d554 2e5cc831
Author: Jan Friedrich <43...@users.noreply.github.com>
AuthorDate: Wed Sep 2 21:24:33 2026 +0200
Harden the release scripts and connection string redaction #313
Follow-ups from the second security scan, on top of 3.4.0.
- verify-release.sh/.ps1: KEYS was downloaded into the directory being
verified, so a planted KEYS file was the one imported and its keys were
accepted as release keys. Both scripts now download into a temporary
keyring of their own. Not a regression, the bare wget line dates from 3.2.0.
- The release scripts relied on $PSNativeCommandUseErrorActionPreference,
which only exists from PowerShell 7.4. On 5.1 the assignment was a silent
no-op and a failing gpg --verify was ignored. Added #Requires -Version 7.4,
and release-review.adoc now installs PowerShell 7 and uses pwsh.
- AdoNetAppender: connection string redaction hid password-bearing keywords,
which missed Extended Properties and AccessToken. Replaced with an
allowlist of diagnostic keywords.
- Removed graphify and its 26 MB of generated output from the tree.
.github/workflows/build.yaml | 7 +
.gitignore | 14 -
CLAUDE.md | 10 -
graphify-out/graph.json | 154467 ------------------
graphify-out/manifest.json | 2252 -
scripts/build-preview.ps1 | 4 +-
scripts/build-release.ps1 | 4 +-
scripts/verify-release.Tests.ps1 | 86 +
scripts/verify-release.ps1 | 38 +-
scripts/verify-release.sh | 25 +-
.../313-redact-connection-string-allowlist.xml | 13 +
src/changelog/3.4.1/313-require-powershell-74.xml | 14 +
.../3.4.1/313-verify-release-keys-bypass.xml | 15 +
src/log4net.Tests/Appender/AdoNetAppenderTest.cs | 20 +-
src/log4net/Appender/AdoNetAppender.cs | 32 +-
.../antora/modules/ROOT/pages/release-review.adoc | 9 +-
16 files changed, 219 insertions(+), 156791 deletions(-)