Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add SECURITY policy #11035

Merged
merged 1 commit into from
Jan 28, 2025
Merged

Add SECURITY policy #11035

merged 1 commit into from
Jan 28, 2025
+23 −0

Conversation

zanieb
Copy link
Member

@zanieb zanieb commented Jan 28, 2025 •
edited
Loading

Closes #11020

@zanieb zanieb added the documentation Improvements or additions to documentation label Jan 28, 2025
zanieb
zanieb commented Jan 28, 2025
View reviewed changes
SECURITY.md Outdated Show resolved Hide resolved
zanieb
zanieb commented Jan 28, 2025
View reviewed changes
SECURITY.md
Comment on lines +8 to +11
- uv invokes Python interpreters on the system to retrieve metadata
- uv builds source distributions as described by PEP 517
- uv may build packages from the requested package indexes

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm sure I'm missing things here

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could perhaps just mention things like no-build?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking about that but wasn't sure how to do so without being verbose.. let me see what I can do

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That sort of belongs in a "Hardening" document rather than the security policy document?

Maybe once that exists we can just link there?

@zanieb zanieb marked this pull request as ready for review January 28, 2025 19:45
@zanieb
Copy link
Member Author

zanieb commented Jan 28, 2025

I think we should also outline our process for reporting CVEs, which I think GitHub provides an okay interface for? But I haven't used it and we haven't had to report any CVEs yet so I'm not sure what our process will be.

charliermarsh
charliermarsh reviewed Jan 28, 2025
View reviewed changes
SECURITY.md Outdated Show resolved Hide resolved
@zanieb
Copy link
Member Author

zanieb commented Jan 28, 2025

I also took a look at https://www.python.org/dev/security/

konstin
konstin approved these changes Jan 28, 2025
View reviewed changes
Copy link
Member

@konstin konstin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we inline this file somewhere else? We already have a lot of top level files.

@zanieb
Copy link
Member Author

zanieb commented Jan 28, 2025

@konstin I don't think so, I think this is the GitHub standard location.

@zanieb
Copy link
Member Author

zanieb commented Jan 28, 2025

We could link to another document (e.g., as they do in pypa/pip) but we need the file.

@zanieb zanieb merged commit 321f8cc into main Jan 28, 2025
61 checks passed
@zanieb zanieb deleted the zb/sec branch January 28, 2025 20:06
@BrewTestBot BrewTestBot mentioned this pull request Jan 28, 2025
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jan 29, 2025
@tmeijn
build(deps): update astral-sh/uv to v0.5.25
685a036 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.5.24` -> `0.5.25` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>astral-sh/uv (astral-sh/uv)</summary>

### [`v0.5.25`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0525)

[Compare Source](astral-sh/uv@0.5.24...0.5.25)

##### Enhancements

-   Allow installation of manylinux wheels on loongarch64 ([#&#8203;10927](astral-sh/uv#10927))
-   Allow optional `=` for editables in `requirements.txt` ([#&#8203;10954](astral-sh/uv#10954))
-   Add Windows aarch64 to the release binaries ([#&#8203;10885](astral-sh/uv#10885))

##### Bug fixes

-   Use spec-compliant (`128+n`) exit codes for `uv run` and `uv tool run` on Unix ([#&#8203;10781](astral-sh/uv#10781))
-   Fix best-interpreter lookups when there is an invalid interpreter in the `PATH` ([#&#8203;11030](astral-sh/uv#11030))
-   Guard against concurrent cache writes on Windows ([#&#8203;11007](astral-sh/uv#11007))
-   Prioritize package preferences with greater package versions ([#&#8203;10963](astral-sh/uv#10963))
-   Reject `--editable` flag on non-directory requirements ([#&#8203;10994](astral-sh/uv#10994))
-   Respect `--no-sources` for `uv pip install` workspace discovery ([#&#8203;11003](astral-sh/uv#11003))
-   Set `JEMALLOC_SYS_WITH_LG_PAGE=16` in ARM Docker builds ([#&#8203;10943](astral-sh/uv#10943))
-   Update `riscv64` Python downloads to allow install on `riscv64gc` ([#&#8203;10937](astral-sh/uv#10937))
-   Fix file persist retries on Windows ([#&#8203;11008](astral-sh/uv#11008))
-   Fix incorrect error message when specifying `tool.uv.sources.(package).workspace` with other options ([#&#8203;11013](astral-sh/uv#11013))
-   Improve SIGINT handling in `uv run` ([#&#8203;11009](astral-sh/uv#11009))

##### Documentation

-   Add `SECURITY` policy ([#&#8203;11035](astral-sh/uv#11035))
-   Add `Requires-Python` upper bound behavior to the docs ([#&#8203;10964](astral-sh/uv#10964))
-   Add a troubleshooting section and reproducible example guide ([#&#8203;10947](astral-sh/uv#10947))
-   Add documentation for `uv add -r` ([#&#8203;10926](astral-sh/uv#10926))
-   Amend `requires-python` rules in resolver documentation ([#&#8203;10993](astral-sh/uv#10993))
-   Reference workspaces in `--no-sources` documentation ([#&#8203;10995](astral-sh/uv#10995))
-   Update documentation for activating virtual environments in different shell ([#&#8203;11000](astral-sh/uv#11000))
-   Add Docker SHA pinning tip ([#&#8203;10955](astral-sh/uv#10955))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMzcuMiIsInVwZGF0ZWRJblZlciI6IjM5LjEzNy4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
styvane added a commit to styvane/uv that referenced this pull request Jan 29, 2025
@styvane
Merge branch 'main' into fix-8743
2dd5372 
* main: (53 commits)
  Shorten "Using existing Python versions" nav item so it fits on one line (astral-sh#11077)
  docs: suggest copy linking for GitLab integration guide (astral-sh#11067)
  Refactor `uv tool run` hint into separate function (astral-sh#11069)
  Fix typo in no-deps docs/comments/cli description (astral-sh#11073)
  Allow `--no-dev --invert` in `uv tree` (astral-sh#11068)
  Add docs for signal handling (astral-sh#11041)
  Add a bit more context about SIGTERM and PID 1 (astral-sh#11036)
  Reflow CLI documentation comments (astral-sh#11040)
  doc typo: unnecessary backslashes to represent brackets in markdown (astral-sh#11059)
  Update Dependabot links (astral-sh#11054)
  Document `gather_credentials` (astral-sh#11024)
  Link to our MRE documentation in the issue template (astral-sh#11045)
  Avoid sharing state between universal and non-universal resolves (astral-sh#11051)
  Mark metadata as dynamic when reading from built wheel cache (astral-sh#11046)
  Fix formatting of `RUST_LOG` documentation (astral-sh#10053)
  Bump version to 0.5.25 (astral-sh#11042)
  Add CVE disclosure to security policy (astral-sh#11037)
  Guard against concurrent cache writes on Windows (astral-sh#11007)
  Add SECURITY policy (astral-sh#11035)
  Improve SIGINT handling in `uv run` (astral-sh#11009)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@charliermarsh charliermarsh charliermarsh approved these changes

@konstin konstin konstin approved these changes

Assignees
No one assigned
Labels
documentation Improvements or additions to documentation
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Security Process
3 participants
@zanieb @charliermarsh @konstin