zeroshade opened a new pull request, #1886: URL: https://github.com/apache/iceberg-go/pull/1886
## Summary - adapt the expanded Iceberg Python threat-model structure to Iceberg Go's actual catalog, REST, configuration, IO, and CLI boundaries - preserve Iceberg Go-owned credential isolation across separately constructed catalog/client instances while distinguishing caller-shared state - clarify private vulnerability reporting, delegated credentials, endpoint routing, resource limits, table provenance, and destructive external-path behavior - make scanner calibration conditional and require human review instead of blanket rejection ## Review notes The Go model intentionally does not copy Python's blanket same-process isolation disclaimer or assume universal table-root containment. Availability-only findings remain hardening by default unless they violate a documented Iceberg Go-owned boundary or demonstrate another security impact. ## Verification - `go test ./...` — 28 packages passed; 6 packages had no tests - `git diff --check upstream/main..HEAD` - final task review and whole-branch security-policy review completed with no remaining Critical or Important findings -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
