fixture.key file causing Aquasec scan failures #5781
Assignees
Labels
size/small
Estimated to take LESS THAN A DAY
Comments
|
This seems reasonable. I want to check with some team folks to see if there's any reason not to add |
glasser
added a commit
that referenced
this issue
Oct 8, 2021
We know of no reason that including the source of tests in built npm packages would be helpful, and we've heard reports that including the RSA private key fixture as we do in apollo-server-core can trigger security scans. Change how we drop tests from "dist" to drop the whole test directory in case some other files sneak in there. Fixes #5781.
glasser
added a commit
that referenced
this issue
Oct 8, 2021
We know of no reason that including the source of tests in built npm packages would be helpful, and we've heard reports that including the RSA private key fixture as we do in apollo-server-core can trigger security scans. Change how we drop tests from "dist" to drop the whole test directory in case some other files sneak in there. Add a comment to the one npmignore file that differs from the others. Fixes #5781.
glasser
added a commit
that referenced
this issue
Oct 8, 2021
We know of no reason that including the source of tests in built npm packages would be helpful, and we've heard reports that including the RSA private key fixture as we do in apollo-server-core can trigger security scans. Change how we drop tests from "dist" to drop the whole test directory in case some other files sneak in there. Add a comment to the one npmignore file that differs from the others. Fixes #5781.
glasser
added a commit
that referenced
this issue
Oct 8, 2021
We know of no reason that including the source of tests in built npm packages would be helpful, and we've heard reports that including the RSA private key fixture as we do in apollo-server-core can trigger security scans. Change how we drop tests from "dist" to drop the whole test directory in case some other files sneak in there. Add a comment to the one npmignore file that differs from the others. Fixes #5781.
glasser
added a commit
that referenced
this issue
Oct 8, 2021
We know of no reason that including the source of tests in built npm packages would be helpful, and we've heard reports that including the RSA private key fixture as we do in apollo-server-core can trigger security scans. Change how we drop tests from "dist" to drop the whole test directory in case some other files sneak in there. Add a comment to the one npmignore file that differs from the others. Fixes #5781.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Hello,
as of version 3.3.0 of apollo-server-core our Aquasec scans complain on sensitive data in our dependencies.
According to scan report issue is with packages/apollo-server-core/src/plugin/drainHttpServer/tests/stoppable/fixture.key file being part of the npm module.
Could this file (or complete tests) be excluded from the module?
Thank you.
The text was updated successfully, but these errors were encountered: