Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to create json files from issues #8

Closed
wants to merge 0 commits into from

Conversation

nvdaes
Copy link
Sponsor Contributor

@nvdaes nvdaes commented Feb 5, 2022

The planned procedure to submit add-ons to the addon-datastore repo has security issues, as shown in:

nvaccess/addon-datastore#35

This intends to provide a way to add and validate add-on metadata by creating issues in addon-datastore, which maybe automerged if checks pass.

@feerrenrut
Copy link
Contributor

Aren't most of these checks already done on the PR validation? To resolve the security issue, can you added the extra check to the PR validation. The extra check is:

If an add-on has been previously submitted, ensure the owner does not change.

Separately, the issue form/template would be convenient for submitters, and should be able to share validation code with the PR validation.

@nvdaes
Copy link
Sponsor Contributor Author

nvdaes commented Feb 21, 2022

Most checks are already done. We can remove the check for publisher if none should change a sent file, even owners, throwing an error if status of file changed is "modified":

https://api.github.com/repos/nvaccess/addon-datastore/pulls/35/files

I'l try to do it in the yaml file. Also, I think that something should be done to prevent people to send add-ons compatible with API version not published yet. Even if they don't appear in the NV Access server.

@feerrenrut
Copy link
Contributor

Github seems to have closed this when I tried to update the branch. I'm going to open a new PR and progress this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants