linux-kernel - Re: [RESEND. PATCH 1/5] drm/ci: Upgrade requirements because of bothering by GitHub Dependabot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0B8912A07B48A352+c9e7af3e-ebe3-4e6c-bf11-dc25f7864e06@uniontech.com>
Date: Thu, 31 Oct 2024 13:42:16 +0800
From: WangYuli <wangyuli@...ontech.com>
To: Vignesh Raman <vignesh.raman@...labora.com>,
 Helen Mae Koike Fornazier <helen.koike@...labora.com>
Cc: "maarten.lankhorst" <maarten.lankhorst@...ux.intel.com>,
 mripard <mripard@...nel.org>, tzimmermann <tzimmermann@...e.de>,
 airlied <airlied@...il.com>, simona <simona@...ll.ch>,
 "david.heidelberg" <david.heidelberg@...labora.com>,
 dri-devel <dri-devel@...ts.freedesktop.org>,
 linux-kernel <linux-kernel@...r.kernel.org>,
 guanwentao <guanwentao@...ontech.com>, zhanjun <zhanjun@...ontech.com>
Subject: Re: [RESEND. PATCH 1/5] drm/ci: Upgrade requirements because of
 bothering by GitHub Dependabot

On 2024/10/29 18:47, Vignesh Raman wrote:
> Hi Helen,
>
> On 29/10/24 16:07, Helen Mae Koike Fornazier wrote:
>>
>>
>>
>>
>> ---- On Thu, 17 Oct 2024 00:39:48 -0300 WangYuli  wrote ---
>>
>>   > GitHub Dependabot keeps bugging us about old, vulnerable Python 
>> packages.
>>   >
>>   > Until we figure out a way to make it calm, we're stuck updating our
>>   > dependencies whenever it complains.
>>   >
>>   > I guess it's a good thing in the long run, though, right?
>>   > Makes our CI a bit "more secure"...
>>   >
>>   > Signed-off-by: WangYuli wangyuli@...ontech.com>
>>   > --
>>   > 2.45.2
>>   >
>>   >
>>
>>
>> Hi WangYuli,
>>
>> Thanks for this.
>>
>> tbh, I'm tempted in removing the python script that is in the repo, 
>> and keep it out-of-tree somewhere, since it is a tool that is only 
>> triggered manually in local environment.
>>
>> I also want to hear Vignesh's thoughts about it.
>
> We can remove xfails/update-xfails.py script since we do not use this 
> in CI jobs. Once ci-collate [1] is ready and tested for drm-ci, we 
> could use this tool directly.
>
> [1] https://gitlab.freedesktop.org/gfx-ci/ci-collate/
>
> Regards,
> Vignesh
>

Cool!

Cheers,
-- 
WangYuli

Download attachment "OpenPGP_0xC5DA1F3046F40BEE.asc" of type "application/pgp-keys" (633 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)