Closed
Description
The release package includes various text fixtures, including things like TLS private keys, which some container scanning tools (erroneously) flag as problematic. While this is a limitation of the various container scanning tools, it would be easier for us to avoid the problem entirely, while also allowing us to reduce the size of the release archive, by removing tests from our release package.
For example, our release has various .pem and .key files:
Is there some straightforward way to avoid installing tests along with our various dependencies in the release package?