Reconsider criteria to align with GHSA
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 1.2k
- Forks
- 544
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 45
Description
In https://github.com/rustsec/advisory-db/issues/1808, it became clear that at least two separate people (one of which was me) got confused by the fact that a GHSA was issued for rustix without a RustSec advisory being published. The maintainer made a (convincing) argument that the issue didn't meet the RustSec criteria. IMO it's unfortunate if the RustSec advisory database is "incomplete" in that issues for which GHSAs were filed are not included.
Opening this issue to discuss what could be done about this.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading issue #1808 and the linked discussion about the rustix GHSA and RustSec criteria. Identify the specific discrepancy between GHSA coverage and RustSec publication criteria, then document an agreed direction for addressing it; the issue is complete when the criteria or handling process has a clear decision.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100