Repository navigation
Update SPEC 8 - #438
Update SPEC 8#438jarrodmillman wants to merge 7 commits into
Conversation
See scientific-python#392 for more details.
|
@andyfaff @tylerjereddy Thought you'd be the right people to ping about this - apparently SciPy hasn't endorsed SPEC 8. Does the SPEC and this update look good to you, and do you think we should move for SciPy to endorse it? |
|
worth a quick ping à la https://discuss.scientific-python.org/t/proposal-to-endorse-spec-7-seeding-prngs/1474 perhaps once this update is merged |
We only have one check now (zizmor), but we do have one, so we could. For the security skill, maybe it should move somewhere first? Or we could add it now then work on moving it later.
Sure. |
I'd second Lucas' suggestion to ping on the discourse/mailing list. IIRC Ralf had stronger views than I on SPECs related to security matters, so would be good to see buy in there first. I did look over the full diff here and the changes themselves seemed sensible enough. |
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
@henryiii How about https://github.com/scientific-python/skills or https://github.com/scientific-python/sp-skills? |
matthewfeickert
left a comment
matthewfeickert
left a comment
There was a problem hiding this comment.
Thanks for being the person who got to this @jarrodmillman! 🙇 Just a few questions and comments from me.
sethmlarson
left a comment
sethmlarson
left a comment
There was a problem hiding this comment.
There are other comments that captured my few questions, so I'll leave this as a LGTM, thanks!
Co-authored-by: Matthew Feickert <matthew.feickert@cern.ch>
f1918ce to
d74bd24
Compare
matthewfeickert
left a comment
matthewfeickert
left a comment
There was a problem hiding this comment.
I'm happy with this. Thanks for the work @jarrodmillman!
Co-authored-by: Matthew Feickert <matthew.feickert@cern.ch>
stefanv
left a comment
stefanv
left a comment
There was a problem hiding this comment.
Some minor questions, but broadly looks good to me, thanks!
| Using versions or small hashes is susceptible to attacks. | ||
| GitHub Actions must be pinned using the full commit SHA corresponding to the release version being used. | ||
| Using versions, branches, tags, or abbreviated hashes is susceptible to attacks. | ||
| Include the corresponding release version in a comment, and update pinned actions regularly through a reviewed process so that related actions remain compatible. |
There was a problem hiding this comment.
This feels to me like one of the weak points we have right now: dependabot makes a PR, someone merges it; who knows what that new version of the action contains?
| This replaces the need to use a long-lived token to authenticate, reducing the security risks associated with authentication tokens (e.g., tokens being compromised or needing to be rotated). | ||
|
|
||
| Trusted Publishers can be used in GitHub Actions by using the [`pypa/gh-action-pypi-publish`](https://github.com/pypa/gh-action-pypi-publish) GitHub Action defaults in a GitHub Actions environment. | ||
| When used with Trusted Publishing, this action generates and uploads [PEP 740](https://peps.python.org/pep-0740/) digital attestations by default, so a separate attestation step is not required. |
There was a problem hiding this comment.
By removing the above paragraph on attestation, do we still say, explicitly, that attestation is strongly recommended?
| print-hash: true | ||
| ``` | ||
|
|
||
| Projects that cannot use Trusted Publishing should still generate and publish provenance attestations where their build and distribution services support them. |
There was a problem hiding this comment.
This might be that sentence; worth moving earlier?
See #392 for more details.
@mihaimaruseac Feel free to suggest changes or push directly to my branch. Would you be okay adding your name as an author?
@henryiii Should we add anything about repo-review or your security skills? Feel free to suggest changes or push directly to my branch. Would you be okay adding your name as an author?
@sethmlarson Could you check my changes?