dev  

Messages by Date

• 2026/02/18 [I] Use accurate Content-Type for file downloads instead of generic application/octet-stream (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Fix Content-Type mismatch — plain text error responses served as text/html in asfquart (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Add explicit charset to JSON and text response helpers (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Fix Content-Type mismatch — JSON returned as text/plain in /result/data endpoint (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Populate `version.py` at build time (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Document pip-audit CVE exception/suppression process (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Add a "historical only" flag for outdated keys (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Use explicit allowlist for GitHub OIDC payload fields (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Extend Dependabot configuration to cover pip and Docker ecosystems (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Pin syft version in Dockerfile (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Add integrity verification for Apache RAT JAR (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Prefix and formatting for LLM audit comments (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Implement LDAP attribute allowlist instead of `ALL_ATTRIBUTES` (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Filter sensitive fields from Task objects in API responses (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Extend secret redaction patterns in `/admin/configuration` endpoint (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Remove `token_hash` from PersonalAccessToken API responses (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Clear JWT token and CSRF token from DOM on session end / timeout (ASVS 14.3.1) (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Use continuation passing style for creating new revisions (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Use continuation passing style for creating new revisions (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Document reproducible builds, signing, SBOMs, and OpenSSF (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Add a mode for admins to browse as themselves with no admin permissions (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 [I] Remove release from SVN import options (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/18 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [PR] clarify ASF distribution vs third party channels (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [PR] clarify ASF distribution vs third party channels (tooling-trusted-releases) via GitHub
• 2026/02/17 [PR] clarify ASF distribution vs third party channels (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/17 [I] Update docs with relpath (tooling-trusted-releases) via GitHub
• 2026/02/17 [I] Use continuation passing style for creating new revisions (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Ensure that tasks themselves are cached as well as task results (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Ensure that tasks themselves are cached as well as task results (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) via GitHub
• 2026/02/17 [I] Ensure that tasks themselves are cached as well as task results (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [PR] Use the intersection of algorithms from asyncssh and ssh-audit (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) via GitHub
• 2026/02/17 [PR] Use the intersection of algorithms from asyncssh and ssh-audit (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Mark `unverified_header_and_payload` as internal and add security warnings (tooling-trusted-releases) via GitHub
• 2026/02/17 [PR] #677 - Add explicit ciphers, kex and mac algorithms. (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Explicitly reject JWTs containing `jku`, `x5u`, or `jwk` headers (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] User impersonation via email sender bypass in message.py (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Add `nbf` (not-before) claim to internally issued JWTs (tooling-trusted-releases) via GitHub
• 2026/02/17 Re: [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Verify all DistributionPlatform template URLs use HTTPS (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add explicit TLS configuration to LDAP connections in `atr/ldap.py` (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add TLS enforcement to download shell script in `atr/static/sh/download-urls.sh` (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Enforce HTTPS-only for SVN PubSub listener URL in `atr/svn/pubsub.py` (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Enforce HTTPS-only for SVN PubSub listener URL in `atr/svn/pubsub.py` (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Configure explicit TLS version constraints for Hypercorn server (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add STARTTLS initiation to SMTP mail relay in `atr/mail.py` (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add explicit SCM path rejection to `_validate_relpath_string` (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Document OAuth architecture and ASVS V10.4.x delegation (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Replace `assert` with explicit error handling in OAuth callback (a.k.a. document no -O flag usage) (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Document approved cryptographic algorithms for the project (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] TLS: Add explicit cipher suite configuration for defense-in-depth (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] SSH server: Configure explicit cipher suites, KEX, and MAC algorithms (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add temporal validation helper to `TrustedPublisherPayload` model (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add `nbf` (not-before) claim to internally issued JWTs (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Add not-before validation for SSH workflow keys (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Explicitly reject JWTs containing `jku`, `x5u`, or `jwk` headers (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Mark `unverified_header_and_payload` as internal and add security warnings (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Validate JWKS URI against allowlist in GitHub OIDC flow (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Message sending lacks committee-scoped recipient validation (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Error message says "create" instead of "delete" in `release_delete` (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Incomplete committee validation in project deletion (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] URL/form parameter mismatch in project category endpoints (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Admin override access lacks persistent audit logging (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Public download access to draft/pre-release artifacts (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Missing authorization on public API check results (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Token deletion missing ownership validation (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] SVN import accepts arbitrary URLs without validation (SSRF) (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Test mode authorization bypass allows all users test committee access (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Missing authorization on SBOM endpoints (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Missing authorization on public API check results (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Test mode authorization bypass allows all users test committee access (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Task worker executes with stale authorization (TOCTOU) (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Storage layer accepts arbitrary user IDs for SSH key and PAT creation (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] Missing `session.check_access()` in multiple route handlers (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] IDOR in distribution delete — missing `check_access()` and form/URL parameter mismatch (tooling-trusted-releases) via GitHub
• 2026/02/16 [I] User impersonation via email sender bypass in message.py (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Ensure that Dependabot PRs are checked against the action allow list (tooling-trusted-releases) via GitHub
• 2026/02/16 [PR] Bump astral-sh/setup-uv from 7.2.0 to 7.3.0 (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Record 3-way merge metadata (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Record 3-way merge metadata (tooling-trusted-releases) via GitHub
• 2026/02/16 [PR] Bump astral-sh/setup-uv from 6.4.3 to 7.3.0 (tooling-releases-client) via GitHub
• 2026/02/16 Re: [PR] Added merge logging to track file changes (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [PR] Added merge logging to track file changes (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [PR] Added merge logging to track file changes (tooling-trusted-releases) via GitHub
• 2026/02/16 [PR] Added merge logging to track file changes (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Use caching on far more checks, as early as possible (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Use caching on far more checks, as early as possible (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Deduplicate check results (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Deduplicate check results (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Add and use exploratory taint tracking types (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/16 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [I] Integrate ATR with projects vm (tooling-trusted-releases) via GitHub
• 2026/02/15 [I] Setup svn credentials to commit to dist/release (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [I] Integrate ATR secrets with Puppet (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [I] Integrate ATR secrets with Puppet (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/15 [GH] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [PR] link to svn:dist, not any svn (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [PR] link to svn:dist, not any svn (tooling-trusted-releases) via GitHub
• 2026/02/15 Re: [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/14 Re: [I] Tie ATR server into the rsync path of svn dist artifacts (tooling-trusted-releases) via GitHub
• 2026/02/14 Re: [PR] add API and link to svn:dist area (tooling-trusted-releases) via GitHub
• 2026/02/14 Re: [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/14 Re: [PR] link to svn:dist, not any svn (tooling-trusted-releases) via GitHub
• 2026/02/14 Re: [I] Tie ATR server into the rsync path of svn dist artifacts (tooling-trusted-releases) via GitHub
• 2026/02/14 [PR] link to svn:dist, not any svn (tooling-trusted-releases) via GitHub
• 2026/02/14 Re: [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/14 [PR] clarify: svn:dist not done by ATR yet (tooling-trusted-releases) via GitHub
• 2026/02/14 [PR] add API and link to svn:dist area (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Apply path ignores to implicitly classified source archives (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Apply path ignores to implicitly classified source archives (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [PR] Bump actions/cache from 5.0.2 to 5.0.3 (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) via GitHub
• 2026/02/13 [I] Classify archives as source by default, and use more advanced classifiers (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Add a column of file type and classifier to file lists (tooling-trusted-releases) via GitHub
• 2026/02/13 Re: [I] Add a column of file type and classifier to file lists (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [PR] Invalidate PATs; fixes #598 (tooling-trusted-releases) via GitHub
• 2026/02/12 [GH] Invalidate PATs; fixes #598 (tooling-trusted-releases) via GitHub
• 2026/02/12 [PR] Invalidate PATs; fixes #598 (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [I] ATR logo request (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases) via GitHub
• 2026/02/12 [I] Record 3-way merge metadata (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [I] ATR logo request (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [I] ATR logo request (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [I] Apply path ignores to implicitly classified source archives (tooling-trusted-releases) via GitHub
• 2026/02/12 Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Redirect a uniform release artifact url pattern into the ASF's preferred urls (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Reporter integration with BAT (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Reporter integration with BAT (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Setup projects vm for development (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Setup projects vm for development (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Organise the `atr.util` module (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Organise the `atr.util` module (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Remove workaround for pip-audit when pip 26.0 is available (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Remove workaround for pip-audit when pip 26.0 is available (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Make filename and path validation stricter, and duplicate at point of use (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Make filename and path validation stricter, and duplicate at point of use (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Remove workaround for pip-audit when pip 26.0 is available (tooling-trusted-releases) via GitHub
• 2026/02/11 [I] Update `cryptography` in asfpy due to CVE-2026-26007 (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Apply 3-way file merges where possible automatically (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Apply 3-way file merges where possible automatically (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Add and use exploratory taint tracking types (tooling-trusted-releases) via GitHub
• 2026/02/11 Re: [I] Make filename and path validation stricter, and duplicate at point of use (tooling-trusted-releases) via GitHub
• 2026/02/11 [I] Add and use exploratory taint tracking types (tooling-trusted-releases) via GitHub
• 2026/02/11 [I] Make filename and path validation stricter, and duplicate at point of use (tooling-trusted-releases) via GitHub
• 2026/02/11 [I] Organise the `atr.util` module (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Nexus 3 testing of both legacy and ATR methods on repository.apache.org (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] ATR logo request (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] ATR logo request (tooling-trusted-releases) via GitHub
• 2026/02/10 [I] Redirect a uniform release artifact url pattern into the ASF's preferred urls (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Discuss refining permissions for uploading CI builds into ATR (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [PR] File type validation on upload through web browser (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Discuss refining permissions for uploading CI builds into ATR (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [PR] File type validation on upload through web browser (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [PR] File type validation on upload through web browser (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Discuss refining permissions for uploading CI builds into ATR (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Apply 3-way file merges where possible automatically (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Apply 3-way file merges where possible automatically (tooling-trusted-releases) via GitHub
• 2026/02/10 [I] Apply 3-way file merges where possible automatically (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Discuss refining permissions for uploading CI builds into ATR (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Add a quarantined validation period after uploading and before checks are started (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Use caching on far more checks, as early as possible (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Deduplicate check results (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Use caching on far more checks, as early as possible (tooling-trusted-releases) via GitHub
• 2026/02/10 Re: [I] Nexus 3 testing of both legacy and ATR methods on repository.apache.org (tooling-trusted-releases) via GitHub
• 2026/02/09 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/09 [PR] Bump actions/cache from 5.0.2 to 5.0.3 (tooling-trusted-releases) via GitHub
• 2026/02/09 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/09 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/09 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub
• 2026/02/09 Re: [I] Discuss integrations with ECMA standards (tooling-trusted-releases) via GitHub

• Earlier messages
• Later messages