Versions Compared

Old Version 3

changes.mady.by.user Unknown User (mjc)

Saved on

compared with

New Version 4

changes.mady.by.user Sebb

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

We already have policies around releases including creation of hashes and signing, https://www.apache.org/legal/release-policy.html#release-signing. Recently Infra wrote a tool to (download-integrity-checker) to validate that all our hosted download artifacts meet that policy.  Future . However this need further development; see

Jira
serverASF JIRA
serverId5aa69414-a9e9-3523-82ec-879b028fb15b
keyINFRA-23469
. Future tooling changes are proposed that will specifically require and check things are to policy prior to them being made available for download.

...

Related to this are dependencies. We do sometimes include these in source distributions but it becomes more of an issue when they're in builds, containers etc too.  Figure out some dependency tracking stuff, such as SLSA (then we'd end up with formulas for builds as well as dependency tracking) https://slsa.dev/provenance/v0.2

Fuzzing and Security Tool Services

...