FreeAndNil opened a new pull request, #313:
URL: https://github.com/apache/logging-log4net/pull/313
Follow-ups from the second security scan, on top of 3.4.0.
- verify-release.sh/.ps1: KEYS was downloaded into the directory being
verified, so a planted KEYS file was the one imported and its keys were
accepted as release keys. Both scripts now download into a temporary
keyring of their own. Not a regression, the bare wget line dates from
3.2.0.
- The release scripts relied on $PSNativeCommandUseErrorActionPreference,
which only exists from PowerShell 7.4. On 5.1 the assignment was a silent
no-op and a failing gpg --verify was ignored. Added #Requires -Version
7.4,
and release-review.adoc now installs PowerShell 7 and uses pwsh.
- AdoNetAppender: connection string redaction hid password-bearing
keywords,
which missed Extended Properties and AccessToken. Replaced with an
allowlist of diagnostic keywords.
- Removed graphify and its 26 MB of generated output from the tree.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
