vmware / vmware/photon

Spurious Updates on Photon-OS Advisories

Open
#1,404 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
3.2k
Forks
692
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

The various commits to Security Advisories Wiki repo: https://github.com/vmware/photon/wiki/Security-Updates-4/_history are spurious in nature, and often will just shuffle around terms and keywords making it appear as if the advisory has been modified, when there is no such change.

Reproduction steps
  1. Track https://github.com/vmware/photon/wiki/Security-Updates-4/_history and https://github.com/vmware/photon/wiki/Security-Updates-3/_history
  2. See the diff on any given page
  3. Validate the diff as a real or a spurious change.

As an example, here is a recent commit: https://gist.github.com/captn3m0/86e64df90395b8ece0d4af952cce2af8 (Commit ID: 6002f52291d96d6c5f6b3ab8782a178d519c462b)

Changes are mostly spurious like:

-Updates of ['PyYAML', 'postgresql', 'haproxy', 'ansible', 'libxslt'] packages
+Updates of ['PyYAML', 'haproxy', 'postgresql', 'ansible', 'libxslt'] packages

This adds up to 30k lines of change, which makes it hard to validate if there is an actual real change or not.

Expected behavior
  1. Advisories should only be modified when there is a real change (ie, addition or removal of actual information).
  2. The code that generates these advisories should canonicalize the advisory so as to generate the same advisory with same information, and avoid spurious commits.
Additional context

cc @smaliakkal

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the Security-Updates-3 and Security-Updates-4 wiki histories and the linked example diff to identify how equivalent package lists are reordered. Trace the code that generates these advisories, then verify that unchanged advisory information produces no spurious changes or commits.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.