Clarify external workflow. Fixes #63 #103
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The original requirement is unclear. The discussion on 2024-12-10 tried to clarify what was intended. This is one attempt to clarify things. Signed-off-by: David A. Wheeler <[email protected]>
|
@funnelfiasco - here's my try! |
Co-authored-by: Ben Cotton <[email protected]> Signed-off-by: David A. Wheeler <[email protected]>
|
I accepted the change. I'm a little worried that removing the word "external" removes too much, since the objective is really about external code, but maybe this is okay. It's at least clearer than it was before. |
Comment on lines
+132
to
+133
| A build process that either leads to release or can read secret data | ||
| MUST NOT execute untrusted code. |
There was a problem hiding this comment.
We'd also need to cover any build pipelines that produce artifacts that would be used on a system that might contain sensitive information, such as an end user or developer machine. 🤔 Effectively any pipeline that produces any artifact that could be used by any machine that isn't ephemeral.
There was a problem hiding this comment.
Would this work?: s/secret/sensitive/
There was a problem hiding this comment.
Or, s/secret/secret or sensitive/
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The original requirement is unclear. The discussion on 2024-12-10 tried to clarify what was intended.
This is one attempt to clarify things.