NixOS / NixOS/nix-security-tracker
Set tracking of build time dependants on vulnerable packages
Open
Nobody has claimed this yet.
security team
user story
- Dominant language
- Python
- Stars
- 116
- Forks
- 41
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 70
Description
As a security team member, I want to mark build time dependencies of a package as affected.
Acceptance criteria
Given a vulnerability matching suggestion,
When I set a package's build time dependants as being affected,
Then all these dependants are added to the suggestion as (indirectly) affected packages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how vulnerability matching suggestions and package dependency relationships are represented and updated. Implement handling for build-time dependants so they are added as indirectly affected packages, then verify the acceptance scenario where all such dependants appear on the suggestion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100