GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Affirm that gitdb and smmap advisories can also be created by EliahKagan · Pull Request #1991 · gitpython-developers/GitPython

Conversation

@EliahKagan

@EliahKagan EliahKagan commented Jan 5, 2025

Copy link
Copy Markdown
Member

This expands SECURITY.md to affirm the claims in the new SECURITY.md files in gitdb and smmap that vulnerabilities found in them can be reported in the GitPython repository with the same link as one would use to report a GitPython vulnerability, as well as to note how the distinction between affected package can be specified when it is known at the time a vulnerability is reported.

Along with gitpython-developers/smmap#59 and gitpython-developers/gitdb#117, this fixes gitpython-developers/gitdb#116.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@EliahKagan
EliahKagan force-pushed the gitdb-smmap-security branch from 770e4b8 to 0459b9a Compare January 5, 2025 08:36
@EliahKagan EliahKagan changed the title Affirm that gitdb and smmap advisories can also be crated Affirm that gitdb and smmap advisories can also be created Jan 5, 2025
@EliahKagan
Affirm that gitdb and smmap advisories can also be created
b20de09 
This expands `SECURITY.md` to affirm the claims in the new
`SECURITY.md` files in gitdb and smmap that vulnerabilities found
in them can be reported in the GitPython repository with the same
link as one would use to report a GitPython vulnerability, as well
as to note how the distinction between affected package can be
specified when it is known at the time a vulnerability is reported.

Along with gitpython-developers/smmap#59
and gitpython-developers/gitdb#117, this
fixes gitpython-developers/gitdb#116.
@EliahKagan
EliahKagan force-pushed the gitdb-smmap-security branch from 0459b9a to b20de09 Compare January 5, 2025 08:43
@EliahKagan

EliahKagan commented Jan 5, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

The setup-wsl action failed on Windows in Python 3.12 here (here's the log). It is extremely unlikely to relate to the actual change in this PR, which modifies only SECURITY.md. I've done a no-change amend and forced pushed to achieve the effect of rerunning the tests, which I expect to pass.

I do wonder if Alpine Linux for WSL is more likely to have this problem than Debian, which was used before and which I believe setup-wsl still downloads from a different source.

Edit: Hmm, actually, it failed both in my fork on the push trigger and here on the pull-request trigger:

  • https://github.com/EliahKagan/GitPython/actions/runs/12618020099/job/35160951729
  • https://github.com/gitpython-developers/GitPython/actions/runs/12618020423/job/35160952489

This is odd because it only failed with Python 3.12. But as far as I know, setup-wsl should not be using Python in any way!

One possibility is that there was a temporary outage in access to the download, and that because this push was after the PR was opened (it was a force push to fix a typo), the jobs started at almost the same time, and thus reached that step at almost the same time, where they both encountered the transient error at the same time.

Edit 2: It reran successfully.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Byron
Byron approved these changes Jan 5, 2025
View reviewed changes

@Byron Byron left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot, this will do perfectly!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@Byron
Byron merged commit 206201c into gitpython-developers:main Jan 5, 2025
@EliahKagan
EliahKagan deleted the gitdb-smmap-security branch January 5, 2025 16:41
EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request Jan 5, 2025
@EliahKagan
Fix links to gitdb and smmap SECURITY.md files
55f36e6 
The links in gitpython-developers#1991 did not work, as I got the branch names wrong.
@EliahKagan EliahKagan mentioned this pull request Jan 5, 2025
Fix links to gitdb and smmap SECURITY.md files #1992
Merged
@EliahKagan

EliahKagan commented Jan 5, 2025

Copy link
Copy Markdown
Member Author

Actually, the links I added are broken! The branch name part of the URLs is wrong, so they give not-found errors. (I had tested the links from gitdb and smmap to here, but not the ones here to gitdb and smmap.) I've opened #1992 to fix this.
Byron reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@EliahKagan EliahKagan mentioned this pull request Jan 7, 2025
Bump Vampire/setup-wsl from 4.0.0 to 4.1.0 #1993
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Byron Byron Byron approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Unclear what security policy would apply to gitdb and smmap vulnerabilities

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@EliahKagan @Byron
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.