Skip to content

Commit 71a50b0

Browse files
kevinjqliuCopilot
kevinjqliu
and
Copilot
committed
security stuff
Co-authored-by: Copilot <copilot@github.com>
1 parent 714c24f commit 71a50b0

12 files changed

Lines changed: 329 additions & 59 deletions

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,19 @@ updates:
2828
- dependency-name: "datafusion"
2929
cooldown:
3030
default-days: 7
31+
groups:
32+
minor-and-patch:
33+
update-types:
34+
- "minor"
35+
- "patch"
3136
- package-ecosystem: "github-actions"
3237
directory: "/"
3338
schedule:
3439
interval: "weekly"
3540
cooldown:
3641
default-days: 7
42+
groups:
43+
actions-minor-patch:
44+
update-types:
45+
- "minor"
46+
- "patch"

‎.github/workflows/codeql.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,18 @@ permissions:
3232

3333
jobs:
3434
analyze:
35-
name: Analyze Actions
35+
name: Analyze (${{ matrix.language }})
3636
runs-on: ubuntu-slim
3737
permissions:
3838
contents: read
3939
security-events: write
4040
packages: read
4141

42+
strategy:
43+
fail-fast: false
44+
matrix:
45+
language: [ 'actions', 'python' ]
46+
4247
steps:
4348
- name: Checkout repository
4449
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -48,9 +53,9 @@ jobs:
4853
- name: Initialize CodeQL
4954
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
5055
with:
51-
languages: actions
56+
languages: ${{ matrix.language }}
5257

5358
- name: Perform CodeQL Analysis
5459
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
5560
with:
56-
category: "/language:actions"
61+
category: "/language:${{ matrix.language }}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
name: "Dependency Review"
21+
22+
on:
23+
pull_request:
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
dependency-review:
30+
runs-on: ubuntu-latest
31+
steps:
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
33+
with:
34+
persist-credentials: false
35+
36+
- name: Dependency Review
37+
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
38+
with:
39+
fail-on-severity: high
40+
# ASF 3rd Party License Policy: https://www.apache.org/legal/resolved.html
41+
#
42+
# Category A — auto-allowed (listed below):
43+
# Apache-like, BSD, MIT, PSF, CC0, etc.
44+
#
45+
# Category B — blocked by allow-list, requires manual review:
46+
# CDDL-1.0, CDDL-1.1, CPL-1.0,
47+
# EPL-1.0, EPL-2.0,
48+
# IPL-1.0,
49+
# MPL-1.0, MPL-1.1, MPL-2.0,
50+
# SPL-1.0,
51+
# OSL-3.0,
52+
# CC-BY-2.5, CC-BY-3.0, CC-BY-4.0,
53+
# CC-BY-SA-2.5, CC-BY-SA-3.0, CC-BY-SA-4.0 (unmodified media only)
54+
# Permitted in binary form only, with appropriate labeling.
55+
#
56+
# Category X — always blocked (never allow):
57+
# GPL-1.0/2.0/3.0, AGPL-1.0/3.0, LGPL-2.0/2.1/3.0,
58+
# SSPL-1.0, BUSL-1.1,
59+
# CC-BY-NC-*, BSD-4-Clause, QPL-1.0, Sleepycat,
60+
# CPOL-1.02, NPL-1.0/1.1, JSON, APSL-2.0
61+
#
62+
allow-licenses: >-
63+
Apache-2.0, Apache-1.1,
64+
MIT, MIT-0,
65+
ISC,
66+
BSD-2-Clause, BSD-3-Clause,
67+
PSF-2.0, Python-2.0,
68+
BSL-1.0,
69+
Unlicense,
70+
0BSD,
71+
Zlib,
72+
CC0-1.0,
73+
CC-PDDC,
74+
ECL-2.0,
75+
AFL-3.0,
76+
MS-PL,
77+
UPL-1.0,
78+
NCSA,
79+
W3C,
80+
PostgreSQL,
81+
HPND,
82+
MulanPSL-2.0,
83+
BlueOak-1.0.0,
84+
Artistic-2.0,
85+
Zope-2.0

‎.github/workflows/nightly-pypi-build.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,9 @@ jobs:
7373
environment:
7474
name: testpypi
7575
url: https://test.pypi.org/p/pyiceberg
76-
7776
permissions:
78-
id-token: write # IMPORTANT: mandatory for trusted publishing
79-
77+
id-token: write # OIDC token for Trusted Publishing
78+
attestations: write # PEP 740 build attestations
8079
steps:
8180
- name: Download all the artifacts
8281
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -91,6 +90,7 @@ jobs:
9190
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
9291
with:
9392
repository-url: https://test.pypi.org/legacy/
93+
attestations: true
9494
skip-existing: true
9595
verbose: true
9696
- name: Display error message on publish failure

‎.github/workflows/python-ci.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,9 @@ concurrency:
4545
group: ${{ github.workflow }}-${{ github.ref }}
4646
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
4747

48+
env:
49+
UV_LOCKED: 1 # All uv commands enforce --locked in CI (no re-resolution)
50+
4851
jobs:
4952
lint-and-unit-test:
5053
runs-on: ubuntu-latest
@@ -67,8 +70,6 @@ jobs:
6770
enable-cache: true
6871
- name: Install system dependencies
6972
run: sudo apt-get update && sudo apt-get install -y libkrb5-dev # for kerberos
70-
- name: Check uv.lock is up to date
71-
run: uv lock --check
7273
- name: Install
7374
run: make install
7475
- name: Run linters

‎.github/workflows/python-publish-pypi.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
# Publishes the final release to PyPI with PEP 740 build attestations via
21+
# Trusted Publishing. Run after the vote passes and SVN release is promoted.
22+
#
23+
# The RC pre-release is published automatically by python-release.yml.
24+
#
25+
# Prerequisites (one-time setup):
26+
# 1. Create a "pypi" environment in GitHub repo settings with required reviewers.
27+
# 2. Configure Trusted Publishing on PyPI:
28+
# https://pypi.org/manage/project/pyiceberg/settings/publishing/
29+
# - Owner: apache
30+
# - Repository: iceberg-python
31+
# - Workflow: python-publish-pypi.yml
32+
# - Environment: pypi
33+
34+
name: "Publish Release to PyPI"
35+
36+
on:
37+
workflow_dispatch:
38+
inputs:
39+
version:
40+
description: 'Release version (e.g., 0.8.0)'
41+
type: string
42+
required: true
43+
44+
permissions:
45+
contents: read
46+
47+
jobs:
48+
publish-pypi:
49+
runs-on: ubuntu-latest
50+
environment:
51+
name: pypi
52+
url: https://pypi.org/project/pyiceberg/${{ inputs.version }}
53+
permissions:
54+
id-token: write # OIDC token for Trusted Publishing + Sigstore signing
55+
attestations: write # PEP 740 build attestations stored on PyPI
56+
steps:
57+
- name: Download release artifacts from Apache SVN
58+
env:
59+
VERSION: ${{ inputs.version }}
60+
run: |
61+
SVN_URL="https://dist.apache.org/repos/dist/release/iceberg/pyiceberg-${VERSION}"
62+
63+
echo "Downloading from $SVN_URL..."
64+
svn export --non-interactive "$SVN_URL" svn-artifacts/
65+
66+
mkdir -p dist/
67+
cp svn-artifacts/pyiceberg-*.whl svn-artifacts/pyiceberg-*.tar.gz dist/
68+
69+
echo "Artifacts to publish:"
70+
ls -lah dist/
71+
72+
- name: Publish to PyPI
73+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
74+
with:
75+
attestations: true
76+
verbose: true

‎.github/workflows/python-release-docs.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ jobs:
3333
runs-on: ubuntu-latest
3434
permissions:
3535
contents: write
36-
3736
steps:
3837
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3938
with:

‎.github/workflows/python-release.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@
1717
# under the License.
1818
#
1919

20+
# Prerequisites (one-time setup):
21+
# 1. Create a "pypi" environment in GitHub repo settings with required reviewers.
22+
# 2. Configure Trusted Publishing on PyPI for RC publishes:
23+
# https://pypi.org/manage/project/pyiceberg/settings/publishing/
24+
# - Owner: apache
25+
# - Repository: iceberg-python
26+
# - Workflow: python-release.yml
27+
# - Environment: pypi
28+
2029
name: "Python Build Release Candidate"
2130

2231
on:
@@ -146,3 +155,28 @@ jobs:
146155
uses: ./.github/workflows/pypi-build-artifacts.yml
147156
with:
148157
version: ${{ needs.validate-inputs.outputs.VERSION }}rc${{ needs.validate-inputs.outputs.RC }}
158+
159+
# Publish RC pre-release to PyPI with PEP 740 attestations.
160+
# Gated by the "pypi" environment (requires reviewer approval).
161+
publish-rc-to-pypi:
162+
needs:
163+
- validate-inputs
164+
- pypi-build-artifacts
165+
runs-on: ubuntu-latest
166+
environment:
167+
name: pypi
168+
url: https://pypi.org/project/pyiceberg/${{ needs.validate-inputs.outputs.VERSION }}rc${{ needs.validate-inputs.outputs.RC }}
169+
permissions:
170+
id-token: write # OIDC token for Trusted Publishing + Sigstore signing
171+
attestations: write # PEP 740 build attestations stored on PyPI
172+
steps:
173+
- name: Download merged PyPI artifacts
174+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
175+
with:
176+
name: "pypi-release-candidate-${{ needs.validate-inputs.outputs.VERSION }}rc${{ needs.validate-inputs.outputs.RC }}"
177+
path: dist/
178+
- name: Publish to PyPI
179+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
180+
with:
181+
attestations: true
182+
verbose: true

‎.github/workflows/scorecard.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
name: "OpenSSF Scorecard"
21+
22+
on:
23+
push:
24+
branches: ["main"]
25+
schedule:
26+
- cron: '30 2 * * 1' # Weekly on Monday at 02:30 UTC
27+
28+
permissions: {}
29+
30+
jobs:
31+
scorecard:
32+
name: Scorecard analysis
33+
runs-on: ubuntu-latest
34+
permissions:
35+
security-events: write # Upload SARIF results
36+
id-token: write # Publish results
37+
contents: read # Read repo
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
41+
with:
42+
persist-credentials: false
43+
44+
- name: Run OpenSSF Scorecard
45+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
46+
with:
47+
results_file: results.sarif
48+
results_format: sarif
49+
publish_results: true
50+
51+
- name: Upload Scorecard results to Security tab
52+
uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
53+
with:
54+
sarif_file: results.sarif

‎SECURITY.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
Apache Iceberg uses the standard [Apache Security Process](https://www.apache.org/security/)
6+
for reporting and handling security vulnerabilities.
7+
8+
**Please do NOT create public GitHub issues for security vulnerabilities.**
9+
10+
To report a vulnerability, send an email to [security@apache.org](mailto:security@apache.org)
11+
with the following information:
12+
13+
- Description of the vulnerability
14+
- Steps to reproduce the issue
15+
- Affected versions
16+
- Any potential mitigations you have identified
17+
18+
The Apache Security Team will acknowledge your report and work with the project
19+
maintainers to address the issue. You can expect an initial response within 48 hours.
20+
21+
For more details, see: <https://www.apache.org/security/committers.html>
22+
23+
## Supported Versions
24+
25+
Security fixes are applied to the latest released version of PyIceberg.
26+
We do not backport fixes to older minor versions.
27+
28+
| Version | Supported |
29+
| ------- | ------------------ |
30+
| Latest | :white_check_mark: |
31+
| < Latest | :x: |

0 commit comments

Comments
 (0)