July 2022 - slf4j-dev - mailman3.qos.ch

[JIRA] Updates for SLF4J-553: Add GitHub token permissions for GitHub Actions workflow
by QOS.CH (JIRA) 21 Jul '22

21 Jul '22

SLF4J / SLF4J-553 [Resolved] Add GitHub token permissions for GitHub Actions workflow ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-553 ============================== 1 comment ------------------------------ Varun Sharma on 21/Jul/22 4:10 PM I think it has to do with the order of events. GitHub token permissions were introduced after developers had already started using the token, so having "contents: read" as default later on would have broken some existing workflows that needed higher permissions and had not yet set them explicitly. You can set "contents: read" as default for your repo and org using the UI: https://github.blog/changelog/2021-04-20-github-actions-control-permissions… ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-553: Add GitHub token permissions for GitHub Actions workflow
by QOS.CH (JIRA) 21 Jul '22

21 Jul '22

SLF4J / SLF4J-553 [Resolved] Add GitHub token permissions for GitHub Actions workflow ============================== Here's what changed in this issue in the last few minutes. There are 2 updates, 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-553 ============================== 2 updates ------------------------------ Changes by Ceki Gülcü on 21/Jul/22 12:48 PM Resolution: Fixed Status: Resolved (was: Open) ============================== 1 comment ------------------------------ Ceki Gülcü on 21/Jul/22 12:50 PM [~varunsh] Thank you for this report. I was wondering why "permissions: contents: read" was not the default. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-553: Add GitHub token permissions for GitHub Actions workflow
by QOS.CH (JIRA) 19 Jul '22

19 Jul '22

SLF4J / SLF4J-553 [Open] Add GitHub token permissions for GitHub Actions workflow ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-553 ============================== Issue created ------------------------------ Varun Sharma created this issue on 19/Jul/22 5:19 PM Summary: Add GitHub token permissions for GitHub Actions workflow Issue Type: Improvement Assignee: SLF4J developers list Created: 19/Jul/22 5:19 PM Environment: GitHub Action workflow at https://github.com/qos-ch/slf4j/blob/master/.github/workflows/main.yml Priority: Major Reporter: Varun Sharma Description: This work has been done as part of PR: [https://github.com/qos-ch/slf4j/pull/293] GitHub recommends defining minimum GITHUB_TOKEN permissions for securing GitHub Actions workflows * [https://github.blog/changelog/2021-04-20-github-actions-control-permissions…] * [https://docs.github.com/en/actions/security-guides/automatic-token-authenti…] * The Open Source Security Foundation (OpenSSF) [Scorecards|https://github.com/ossf/scorecard] treats not setting token permissions as a high-risk issue ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for SLF4J-548: Loading services (plugins) with the caller's ClassLoader
by QOS.CH (JIRA) 06 Jul '22

06 Jul '22

SLF4J / SLF4J-548 [Open] Loading services (plugins) with the caller's ClassLoader ============================== Here's what changed in this issue in the last few minutes. There is 1 comment. View or comment on issue using this link https://jira.qos.ch/browse/SLF4J-548 ============================== 1 comment ------------------------------ pierre on 06/Jul/22 2:18 PM The fact of having to recompile SLF4J with each update does not really satisfy me. Would it be possible to load the services with the caller's class loader only if it was not found by the thread's class loader? The basic operation remains unchanged, but SLF4J offers the possibility of being embedded in a MANIFEST.MF of a jar archive loader by an URLClassLoader... Thank you. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0