mozilla-services / mozilla-services/updatebot
Have Updatebot run `cargo audit`
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 9
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
cargo audit is the rust 'tell me if any of the things I am using have CVEs' tool. It's a little awkward to have this run in TC; because one day everything will break because of external purposes and we may not be able or want to fix it on e.g. -release/-esr.
But it fits perfectly in with Updatebot - when a new issue occurs, we can file a bug, developers can investigate it and decide if they want to do something about it or not, and then fix or wontfix the bug. And Updatebot won't re-file a new issue for an existing RUSTSEC advisory.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how Updatebot detects dependency updates and files issues, then determine where a cargo audit run fits in that workflow. The work is done when new RUSTSEC advisories produce actionable bugs without repeatedly filing issues for an existing advisory, while allowing developers to decide whether to fix or wontfix them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100