Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Publish a new package, loguru-hardened, with security focussed defaults #1136

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

bneijt
Copy link

@bneijt bneijt commented May 4, 2024

Introduce a separate script that will override a few files to harden loguru defaults and build a loguru-hardened package, then revert the changes using git.

hardened/_defaults.py Outdated Show resolved Hide resolved
build_hardened.py Outdated Show resolved Hide resolved
@Delgan
Copy link
Owner

Delgan commented May 9, 2024

I don't know why 3.13 build fails, maybe try rebasing (a few libraries were updated since then)?

@trim21
Copy link
Contributor

trim21 commented May 10, 2024

if it's serialized be default, should we also remove level time from default format?

@bneijt bneijt force-pushed the hardened branch 2 times, most recently from c5f9775 to 92cd74c Compare May 11, 2024 19:40
@bneijt
Copy link
Author

bneijt commented May 11, 2024

if it's serialized be default, should we also remove level time from default format?

I don't follow, could you give a code example of what you mean or explain further?

@trim21
Copy link
Contributor

trim21 commented May 12, 2024

if it's serialized be default, should we also remove level time from default format?

I don't follow, could you give a code example of what you mean or explain further?

from

LOGURU_FORMAT = env(
    "LOGURU_FORMAT",
    str,
    "<green>{time:YYYY-MM-DD HH:mm:ss.SSS}</green> | "
    "<level>{level: <8}</level> | "
    "<cyan>{name}</cyan>:<cyan>{function}</cyan>:<cyan>{line}</cyan> - <level>{message}</level>",
)

to

LOGURU_FORMAT = env("LOGURU_FORMAT", str, "{message}")

@@ -40,6 +40,7 @@ Installation

pip install loguru

Or if you need more secure defaults, install ``loguru-hardened``.
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also mentioned loguru-hardened in the README, but I could not find a release action configured, so I'm not sure how to make sure hardened is also released when a new release is created.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, since there is no Github Action, I need to do it manually for now.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could open up another pr with release workflows if you would like that. I don't know what currently goes into the manual release actions, but it might be a nice setup to simplify maintenance.

@bneijt bneijt changed the title Use separate script to build hardened variant Publish a new package, loguru-hardened, with security focussed defaults May 12, 2024
@Delgan
Copy link
Owner

Delgan commented May 16, 2024

I finally fixed CI for Python 3.5 and 3.13, can you try rebasing the PR please?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants