Compare CVE version constraints with Nixpkgs package versions #189

New issue

Closed

opened 2024-09-25 10:19:15 +00:00 by erictapen · 1 comment

erictapen commented

2024-09-25 10:19:15 +00:00

(Migrated from github.com)

No usable version constraints should indicate a need for manual review
An existing version constraint that matches with one of our versions needs high visibility
An existing version constraint that doesn't match needs low visiblility

Specifically for Nixpkgs package versions,

if stable and unstable version matches, we summarise
if stable and unstable don't match, we list separately
if the version in one channel differ (e.g. nixpkgs-unstable and nixos-unstable-small), we show these differences

Depends on:

https://github.com/Nix-Security-WG/nix-security-tracker/issues/334

As a security team member, when reviewing the version constraints in a match suggestion, I want to be able to asses wether the constraints are indicating a security issue. The CVE can offer *version constraints*, while the selected Nixpkgs packages offer a set of versions, one for every channel and package. - **No usable version constraints** should indicate a need for manual review - An **existing version constraint** that **matches** with one of our versions needs high visibility - An **existing version constraint** that **doesn't match** needs low visiblility Specifically for Nixpkgs package versions, - if **stable** and **unstable** version matches, we summarise - if **stable** and **unstable** don't match, we list separately - if the version in one channel differ (e.g. nixpkgs-unstable and nixos-unstable-small), we show these differences Depends on: - https://github.com/Nix-Security-WG/nix-security-tracker/issues/334

fricklerhandwerk commented

2024-11-28 16:11:10 +00:00

(Migrated from github.com)

Closed by https://github.com/Nix-Security-WG/nix-security-tracker/pull/365