This is an automated email from the ASF dual-hosted git repository.
steveloughran pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/hadoop-cloudstore.git
The following commit(s) were added to refs/heads/main by this push:
new 3508c87 HADOOP-19880. contributing.md and security.md formatting
tweaks
3508c87 is described below
commit 3508c872cd1f90d949cc780d7b93f4ae8d208bb9
Author: Steve Loughran <[email protected]>
AuthorDate: Wed Jun 3 21:55:39 2026 +0100
HADOOP-19880. contributing.md and security.md formatting tweaks
---
CONTRIBUTING.md | 2 +-
SECURITY.md | 5 +----
2 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 81d9884..de5c10d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,4 @@
-o <!---
+<!---
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
diff --git a/SECURITY.md b/SECURITY.md
index d71d328..87386c2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -134,7 +134,7 @@ The project is built on developer systems, and in CI
systems.
* Components such as maven plugins execute code on developer systems. Their
security MUST be evaluated before adoption.
* Third-party libraries which production code compiles against may be executed
during testing. Their security MUST be evaluated.
* Some developers may use VS.Code. This IDE has a notion of [a trusted
workspace](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust),
which allows for files in the directory tree to declare executables, files
such as `.env' and `tasks.json`. These files must be considered sensitive.
-*
+
The CI build output is publicly visible, so the threat model includes
unobfuscated logging of any cloud credentials provided by CI runs, or leakage
of other secrets.
The threat model includes the risk of subverted github actions and build
tooling.
@@ -147,9 +147,6 @@ The threat model includes the risk of subverted github
actions and build tooling
For example, there MUST NOT be `pull_request_target`, `workflow_run`, or
`issue_comment` triggers.
* Github Actions SHALL follow GitHub's [secure
use](https://docs.github.com/en/actions/reference/security/secure-use)
guidelines, and in particular use [Intermediate Environment
Variables](https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable)
to safely process untrusted inputs.
-
-
-
## Not in the Threat Model
* Any attack which requires the user to manually enter credentials or
configuration options.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
