sbp commented on issue #1395: URL: https://github.com/apache/tooling-trusted-releases/issues/1395#issuecomment-5062033836
(7) **MFA OAuth** This is relatively independent, and as noted previously the only effect is that users cannot log in. This is unrecoverable, and users must wait until OAuth is available again. We could add connection and total request timeouts, and possibly improve the error message by doing a preflight. (8) **GitHub** We use GitHub in a few different ways. (a) Trusted Publishing. This fails quite cleanly, though some errors aren't reported properly, like JWKS connection errors. We could even cache JWKS, but that's very low priority. (b) Source tree comparison. If this fails, it cannot be restarted. Perhaps we should have a special case for checks that fail due to network errors. (c) Distribution workflow. The worst case here would seem to be GitHub sending a POST and then ATR going down. Low priority. (9) **OSV and deps.dev** OSV is an explicit check, and if the site is unreachable then the task fails. Error reporting could likely be improved, but this is not high priority. deps.dev is used when generating or augmenting SBOMs, and if unreachable -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
