Spurious Updates on Photon-OS Advisories
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
The various commits to Security Advisories Wiki repo: https://github.com/vmware/photon/wiki/Security-Updates-4/_history are spurious in nature, and often will just shuffle around terms and keywords making it appear as if the advisory has been modified, when there is no such change.
Reproduction steps
- Track https://github.com/vmware/photon/wiki/Security-Updates-4/_history and https://github.com/vmware/photon/wiki/Security-Updates-3/_history
- See the diff on any given page
- Validate the diff as a real or a spurious change.
As an example, here is a recent commit: https://gist.github.com/captn3m0/86e64df90395b8ece0d4af952cce2af8 (Commit ID: 6002f52291d96d6c5f6b3ab8782a178d519c462b)
Changes are mostly spurious like:
-Updates of ['PyYAML', 'postgresql', 'haproxy', 'ansible', 'libxslt'] packages
+Updates of ['PyYAML', 'haproxy', 'postgresql', 'ansible', 'libxslt'] packages
This adds up to 30k lines of change, which makes it hard to validate if there is an actual real change or not.
Expected behavior
- Advisories should only be modified when there is a real change (ie, addition or removal of actual information).
- The code that generates these advisories should canonicalize the advisory so as to generate the same advisory with same information, and avoid spurious commits.
Additional context
cc @smaliakkal
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the Security-Updates-3 and Security-Updates-4 wiki histories and the linked example diff to identify how equivalent package lists are reordered. Trace the code that generates these advisories, then verify that unchanged advisory information produces no spurious changes or commits.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100