sbp opened a new issue, #1441: URL: https://github.com/apache/tooling-trusted-releases/issues/1441
Releases managed by ATR are still archived to `finished`. Releases discovered by our backfill in SVN `dist/release` are added to the database with `managed=False`, but the code that presents a view of `finished` erroneously considers those releases too. They then display as releases with no files. Only managed releases should use `finished`. Catalogued external releases should use their standard catalogue artifact URLs. Also, `/download/path/` produces a 500 error when browsing the root directory because `.` is interpreted as a path traversal. **Background**: When a release is completed in ATR, it is copied to `finished`, was previously hard linked in `downloads`, and published to SVN. Issue #1393 tracked removing `downloads`, and that removal is already complete. On the status of `finished`, I asked in PR #1415: > We are still moving the finished files to `/finished/`, but it's not exposed, and I think in a subsequent change I might change that to just be attestable data instead. What do you think? (I was wrong that it is not exposed.) I had already performed some research about this, and concluded that we may already be recording all the information that we want to capture and may be able to removed `finished` like we removed `downloads` entirely, without taking any further compatibility action. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
