Mailman 3 April 2021 - Twisted

[Twisted-Python] Codecov.io security incident
by Adi Roiban April 16, 2021

April 16, 2021

Hi. This is a follow up for https://about.codecov.io/security-update/ that was raised by Maarten The security breach is from January 31, 2021, Here you can see the list of Twisted org projects using Codecov.io https://codecov.io/gh/twisted The projects that might be affected are: twisted Latest commit 3 hours ago - using Bash pydoctor Latest commit a day ago - using Python towncrier Latest commit a day ago - using Python axiom Latest commit 2 days ago - using bash via codecov/codecov-action@v1 klein Latest commit 7 days ago - using bash via codecov/codecov-action@v1 incremental Latest commit 25 days ago - using codecov in Travis ldaptor 2 months ago - using Python So the only targets are: twisted , axiom and klein For twisted/twisted we start using the bash uploaded 19 days ago as part of https://github.com/twisted/twisted/pull/1574/ Before that we were using the python uploader. --------------- Here is my understanding of what the codecov bash uploader can do: * Read all the env variables present at the time the bash codecov.io script is executed. The env might contain secrets * Use the GitHub Token that is automatically generated for each GitHub Action job The GitHub token is valid while the action is executed and is kind of a super token: Actions: write Checks: write Contents: write Deployments: write Issues: write Metadata: read Packages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write ----------- For twisted/twisted and I think that other repos the main secret available for GitHub Action is the PYPY upload token. This is not used as a general env variable, but is only available to the specific step in which twine is used to upload the files. ------------- The GitHub Org audit page can be used to check org administratie changes https://github.com/organizations/twisted/settings/audit-log I took a quick look and didn't notice anything suspicious. --------- I don't know how we can prevent these types of security issues. We are a public project with limited resources and are always exposed when we are pulling dependencies from codecov or pypy that we don't fully control. I guess that what we can do is stop using the codecov.io bash uploaded and switch back to python uploader. Any other ideas ? Cheers -- Adi Roiban

3 3

[Twisted-Python] Weekly Bug Summary
by trac＠twistedmatrix.com April 11, 2021

April 11, 2021

1 0

[Twisted-Python] GitHub Actions parallelism limit increase
by Kyle Altendorf April 10, 2021

April 10, 2021

Hi All, Has anyone contacted GitHub to see if they would be willing to increase the parallelism limit in Actions? My understanding is that we maintain two CI systems (GitHub Actions and Azure Pipelines) for the sake of more parallelism. While perhaps worthwhile, this doesn't seem fun. Maybe GitHub would be willing to help out. Cheers, -kyle

3 9

[Twisted-Python] towncrier releases 19.9.0 and 21.3.0rc1
by Kyle Altendorf April 5, 2021

April 5, 2021

Hi everyone, I am announcing 2 twisted releases. This is a bit more complicated than normal since 19.9.0rc1 was never followed by a non-RC release. You can see a detailed checklist and discussion of this in #313 [0]. Relative to 19.9.0rc1, 19.9.0 contains a few readme fixes and the news fragments processed into the news file. 19.9.0 artifacts have been created [1] and 19.9.0 publishing is being held until after 21.3.0 to avoid a somewhat pointless intermediate step for developers that are using 'the latest non-pre release on PyPI' (presently 19.2.0). No real need for someone to get 19.9.0 now just to see 21.3.0 available next week. The news for 21.3.0 is available for review [2]. 21.3.0rc1 has been published and is open for a week for feedback before 21.3.0 is planned to be released. There are remaining bugs and important features. But, it took long enough to get to this point that I consider it important to get something out. Several people are waiting patiently [3]. As we find time to design and address the remaining issues, hopefully we can manage more frequent releases. Please do let me know of any issues you find that are not already documented. Or, if any of the documented ones should really be release blockers. I sure hope we can get this out though. :] Cheers, -kyle [0]: https://github.com/twisted/towncrier/issues/313 [1]: https://github.com/twisted/towncrier/pull/331#issuecomment-803491163 [2]: https://github.com/twisted/towncrier/blob/21.3.0.rc1/NEWS.rst [3]: https://github.com/twisted/towncrier/issues/269

1 1

[Twisted-Python] Weekly Bug Summary
by trac＠twistedmatrix.com April 4, 2021

April 4, 2021

1 0