This is an automated email from the ASF dual-hosted git repository. FreeAndNil pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 34e428947875b243f644df78eb5efe91da054ef4 Merge: 9ed3d554 2e5cc831 Author: Jan Friedrich <[email protected]> AuthorDate: Wed Sep 2 21:24:33 2026 +0200 Harden the release scripts and connection string redaction #313 Follow-ups from the second security scan, on top of 3.4.0. - verify-release.sh/.ps1: KEYS was downloaded into the directory being verified, so a planted KEYS file was the one imported and its keys were accepted as release keys. Both scripts now download into a temporary keyring of their own. Not a regression, the bare wget line dates from 3.2.0. - The release scripts relied on $PSNativeCommandUseErrorActionPreference, which only exists from PowerShell 7.4. On 5.1 the assignment was a silent no-op and a failing gpg --verify was ignored. Added #Requires -Version 7.4, and release-review.adoc now installs PowerShell 7 and uses pwsh. - AdoNetAppender: connection string redaction hid password-bearing keywords, which missed Extended Properties and AccessToken. Replaced with an allowlist of diagnostic keywords. - Removed graphify and its 26 MB of generated output from the tree. .github/workflows/build.yaml | 7 + .gitignore | 14 - CLAUDE.md | 10 - graphify-out/graph.json | 154467 ------------------ graphify-out/manifest.json | 2252 - scripts/build-preview.ps1 | 4 +- scripts/build-release.ps1 | 4 +- scripts/verify-release.Tests.ps1 | 86 + scripts/verify-release.ps1 | 38 +- scripts/verify-release.sh | 25 +- .../313-redact-connection-string-allowlist.xml | 13 + src/changelog/3.4.1/313-require-powershell-74.xml | 14 + .../3.4.1/313-verify-release-keys-bypass.xml | 15 + src/log4net.Tests/Appender/AdoNetAppenderTest.cs | 20 +- src/log4net/Appender/AdoNetAppender.cs | 32 +- .../antora/modules/ROOT/pages/release-review.adoc | 9 +- 16 files changed, 219 insertions(+), 156791 deletions(-)
