{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":807572711,"defaultBranch":"main","name":"systemd_ctypes","ownerLogin":"JanZerebecki","currentUserCanPush":false,"isFork":true,"isEmpty":false,"createdAt":"2024-05-29T11:06:44.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/7452727?v=4","public":true,"private":false,"isOrgOwned":false},"refInfo":{"name":"","listCacheKey":"v0:1717587500.0","currentOid":""},"activityList":{"items":[{"before":null,"after":"f9dd425f7ebf8fa4c46ac5b3d2dcb3a9850a0d46","ref":"refs/heads/fixcipydevel","pushedAt":"2024-06-05T11:38:20.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"Fix CI failing to build dbus-python\n\nby installing required python3-devel package","shortMessageHtmlLink":"Fix CI failing to build dbus-python"}},{"before":"955a170e2fc796b971874cb4a973fe947ea0180b","after":"de4f697adb2dd14faa429229e3c0d6b16fd87524","ref":"refs/heads/defusedxml","pushedAt":"2024-05-29T12:39:22.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"Use hardened xml parser defusedxml\n\nIt took entirely too long, but currently released OS distributions now\nhave a safe by default ElementTree, but I think this may be used by some\npeople on older systems that are still vulnerable by shipping it via ssh\nto that old system from a new system with cockpit.\n\nThe xml here comes from something that is in a normal configuration not\nuntrusted (a process running as a local user receives the xml from the\nsystems dbus/systemd instance) and it doesn't cross a possible security\nboundary between cockpit-bridge and cockpit-ws, as this is probably only\nused in cockpit-bridge. On the other hand this is published on pypi.\n\nI considered if this is not needed, overall if this change just works,\nit is probably still a good idea.","shortMessageHtmlLink":"Use hardened xml parser defusedxml"}},{"before":"3356c4bc353e704776c439c1d144aa0246d5a3ce","after":"ad8700ff0ba590abb527c64760561fe2d83d27ac","ref":"refs/heads/test","pushedAt":"2024-05-29T12:26:58.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"DNM: trigger ci","shortMessageHtmlLink":"DNM: trigger ci"}},{"before":null,"after":"3356c4bc353e704776c439c1d144aa0246d5a3ce","ref":"refs/heads/test","pushedAt":"2024-05-29T12:00:23.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"DNM: trigger ci","shortMessageHtmlLink":"DNM: trigger ci"}},{"before":"72b3b4bf33fb56d824c225e5a0128d7745c76f57","after":"955a170e2fc796b971874cb4a973fe947ea0180b","ref":"refs/heads/defusedxml","pushedAt":"2024-05-29T11:51:30.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"use hardened xml parser defusedxml\n\nIt took entirely too long, but currently released OS distributions now\nhave a safe by default ElementTree, but I think this may be used by some\npeople on older systems that are still vulnerable by shipping it via ssh\nto that old system from a new system with cockpit.\n\nThe xml here comes from something that is in a normal configuration not\nuntrusted (a process running as a local user receives the xml from the\nsystems dbus/systemd instance) and it doesn't cross a possible security\nboundary between cockpit-bridge and cockpit-ws, as this is probably only\nused in cockpit-bridge. On the other hand this is published on pypi.\n\nI considered if this is not needed, overall if this change just works,\nit is probably still a good idea.","shortMessageHtmlLink":"use hardened xml parser defusedxml"}},{"before":"e415db9a01e29123f822e861b4a1a275e4092197","after":"72b3b4bf33fb56d824c225e5a0128d7745c76f57","ref":"refs/heads/defusedxml","pushedAt":"2024-05-29T11:43:11.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"use hardened xml parser defusedxml\n\nIt took entirely too long, but currently released OS distributions now\nhave a safe by default ElementTree, but I think this may be used by some\npeople on older systems that are still vulnerable by shipping it via ssh\nto that old system from a new system with cockpit.\n\nThe xml here comes from something that is in a normal configuration not\nuntrusted (a process running as a local user receives the xml from the\nsystems dbus/systemd instance) and it doesn't cross a possible security\nboundary between cockpit-bridge and cockpit-ws, as this is probably only\nused in cockpit-bridge. On the other hand this is published on pypi.\n\nI considered if this is not needed, overall if this change just works,\nit is probably still a good idea.","shortMessageHtmlLink":"use hardened xml parser defusedxml"}},{"before":null,"after":"e415db9a01e29123f822e861b4a1a275e4092197","ref":"refs/heads/defusedxml","pushedAt":"2024-05-29T11:08:50.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"JanZerebecki","name":"Jan Zerebecki","path":"/JanZerebecki","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/7452727?s=80&v=4"},"commit":{"message":"use hardened xml parser defusedxml\n\nIt took entirely too long, but currently released OS distributions now\nhave a safe by default ElementTree, but I think this may be used by some\npeople on older systems that are still vulnerable by shipping it via ssh\nto that old system from a new system with cockpit.\n\nThe xml here comes from something that is in a normal configuration not\nuntrusted (a process running as a local user receives the xml from the\nsystems dbus/systemd instance) and it doesn't cross a possible security\nboundary between cockpit-bridge and cockpit-ws, as this is probably only\nused in cockpit-bridge. On the other hand this is published on pypi.\n\nI considered if this is not needed, overall if this change just works,\nit is probably still a good idea.","shortMessageHtmlLink":"use hardened xml parser defusedxml"}}],"hasNextPage":false,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"Y3Vyc29yOnYyOpK7MjAyNC0wNi0wNVQxMTozODoyMC4wMDAwMDBazwAAAARdCwQW","startCursor":"Y3Vyc29yOnYyOpK7MjAyNC0wNi0wNVQxMTozODoyMC4wMDAwMDBazwAAAARdCwQW","endCursor":"Y3Vyc29yOnYyOpK7MjAyNC0wNS0yOVQxMTowODo1MC4wMDAwMDBazwAAAARW1_dh"}},"title":"Activity · JanZerebecki/systemd_ctypes"}