chore: rolling uv exclude-newer supply-chain quarantine - #368
Merged
Conversation
Sets [tool.uv].exclude-newer = "7 days" so every uv dependency resolution excludes package releases published in the last 7 days, rolling forward day to day. Dependabot's cooldown setting only protects Dependabot-authored PRs. It does nothing for the other paths that resolve dependencies: manual `uv add`, ad hoc `uv lock` regenerations, `uvx` bootstraps, and CI re-resolves triggered by a widened version range. exclude-newer covers all of those uniformly by giving newly published releases a quarantine window to be pulled or patched before uv will select them, without needing an allowlist of trusted publish times. Per the uv docs, exclude-newer accepts RFC 3339 timestamps or friendly durations like "7 days" and is evaluated relative to the current time at resolution, so the window rolls automatically. Reference: Canonical Security "How-To: Secure a repo" — Minimum release age.
Sets [tool.uv].no-build = true so uv refuses to install any package from a source distribution (sdist) and only accepts prebuilt wheels. Installing an sdist (via `pip install <sdist>` or `uv sync` resolving to one) runs that package's setup.py / PEP 517 build hooks at install time — arbitrary code execution controlled by the package author, not reviewed as part of this repo's dependency review. Wheels are prebuilt archives and do not execute install-time scripts, so restricting to wheel-only installs closes this vector fleet-wide. Verified 2026-07-02 that 0 of 571 dependencies across the fleet's uv.lock files are sdist-only, so this is a zero-cost change today. If a future dependency is only published as an sdist, the escape hatch is [tool.uv].no-build-package = ["specific-pkg"] to exempt just that package rather than disabling the protection globally. Reference: Canonical Security "How-To: Secure a repo" — Install scripts.
Replace the bare `[tool.uv]` block with the canonical fleet comment (rolling quarantine rationale) and drop `no-build = true`. See canonical/pytest-jubilant#98 for the exemplar PR and canonical/charm-tech#22 (references/decisions.md) for the recorded deferral of `no-build` and `--locked`: uv has no allow-list to exempt the workspace project from `no-build`, and rolling `exclude-newer` is fundamentally incompatible with `--locked`. Rolling `exclude-newer` is the surviving pattern.
tonyandrewmeyer
marked this pull request as ready for review
July 4, 2026 05:16
james-garner-canonical
approved these changes
Jul 6, 2026
james-garner-canonical
added a commit
that referenced
this pull request
Jul 30, 2026
This PR prepares Jubilant for release. Release notes: ``` v1.12.0: Improved Jubilant logging ``` ``` This feature release improves Jubilant's logging, lowering the default verbosity and presenting app/unit status changes in an easier to read format. Read more: [Configure Jubilant logs](https://canonical.com/juju/docs/ops/latest/howto/write-integration-tests-for-a-charm/#configure-jubilant-logs). ## What's Changed * feat: improve Jubilant logging mechanism in #351 * feat: bump minimum python version to 3.10 in #370 * chore: rolling uv exclude-newer supply-chain quarantine in #368 * chore: set dependabot commit-message prefix to "chore" (no scope) in #367 * chore: add Code of Conduct linking to Ubuntu CoC in #356 * chore: run uv lock after adding exclude-newer duration in #372 * ci: adopt new dependabot conventions in #365 * ci: hash-pin actions and drop zizmor config in #366 * ci: correct hash-pin version comment for upload-sarif action in #376 * ci: pin action version comments to exact tags in #378 **Full Changelog**: v1.11.0...v1.12.0 ```
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a rolling package-level cooldown in
[tool.uv]:uv refuses to resolve against any package published in the last 7 days, so a compromised release has a window to be caught / yanked upstream before it can enter this project. Complements (does not replace) the Dependabot cooldown, which only protects Dependabot-authored PRs —
exclude-neweralso covers manualuv add,uv lockregens,uvxbootstraps, and CI re-resolves, which Dependabot cooldown alone doesn't reach.