Triaging suggestions by maintainers #325

New issue

Open

opened 2024-11-01 18:21:58 +00:00 by fricklerhandwerk · 1 comment

fricklerhandwerk commented

2024-11-01 18:21:58 +00:00

(Migrated from github.com)

As a package maintainer I want to help the security team with triaging. This should work exactly the same way as for the security team, except that my proposals for state changes need to get reviewed and confirmed by the security team.

fricklerhandwerk commented

2024-12-05 12:43:23 +00:00

(Migrated from github.com)

One way to display user/maintainer proposals to the security team could be by showing a up/down vote count. This approach would require or at least beneft from infrastructure also needed for #200

graph TD
    suggestion --> user-dismissed & user-selected
    suggestion --> |secteam| draftIssue & secteam-dismissed
    user-dismissed --> |secteam| secteam-dismissed & draftIssue
    user-selected --> |secteam| draftIssue --> nixpkgsIssue
    nixpkgsIssue --> aborted & addressed

Discussed with @erictapen: We need to take into account that work done by maintainers or regular users always needs to be validated by the security team (https://github.com/Nix-Security-WG/nix-security-tracker/issues/324). So while maintainers may dismiss items, they will not actually be fully dismissed. We still may remove user-dismissed/selected items from the user view in order to reduce their queue, but only visually. And this may need to be done per user. One way to display user/maintainer proposals to the security team could be by showing a up/down vote count. This approach would require or at least beneft from infrastructure also needed for #200 ```mermaid graph TD suggestion --> user-dismissed & user-selected suggestion --> |secteam| draftIssue & secteam-dismissed user-dismissed --> |secteam| secteam-dismissed & draftIssue user-selected --> |secteam| draftIssue --> nixpkgsIssue nixpkgsIssue --> aborted & addressed ```