uranusjr commented on PR #76666: URL: https://github.com/apache/airflow/pull/76666#issuecomment-6762906863
I don’t think this part can be automated while the metadata is sha256-only. A new entry records whatever the repository served at that moment, so the only safeguard is a human checking new coordinates and hashes. With this trigge, the PR goes green automatically, and since no-one is going to check each entry by hand, it essentially just moves the attack surface from the supply chain to the GitHub Action workers. Maybe we can only the `workflow_dispatch` part? The single generator, the job split and the validator are all good on their own. If we want Dependabot PRs fully automated later, I think PGP verification with `<trusted-keys>` is the way to go. A bump signed by a key we already trust would then need no human, and only new keys or unsigned artifacts would. We’ll probably need a devlist discussion first. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
