tvoipio commented on issue #44688: URL: https://github.com/apache/arrow/issues/44688#issuecomment-6441345952
Having just spent two hours figuring out our exposure to the Brotli RCE vulnerability via Parquet files handled by PyArrow, I would have very much appreciated having an up-to-date, accurate SBOM for both the PyPI-distributed wheel and the Conda packages (in this case conda-forge, but Anaconda main channel users would probably appreciate it too). This would have saved a significant amount of time trawling through CMake files and trying to guess which options have been active at build time. (A real software engineer would probably have taken less time to figure out the options or just look at the binaries, but I did not have one on call right now...) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
