search

Nix-Security-WG / nix-local-security-scanner

Reports on which security advisories may be relevant for a given system or derivation
MIT License
3 stars 0 forks source link

[Tracking issue] Demo Readiness #18

Open ApolloUnicorn opened 11 months ago

ApolloUnicorn commented 11 months ago

At our meeting 2023-11-15, we defined our demo target to be a CLI tool which does these four things:

  1. scan dependencies used locally (from some combination of derivation graphs, metadata provided by nixpkgs) Related tickets: https://github.com/Nix-Security-WG/nix-local-security-scanner/issues/19

  2. ingest some sort of vulnerability database(s) that are separate from the users configuration (these might be well-known upstream things like CVEs or new nix-ecosystem-specific databases) Related tickets: https://github.com/Nix-Security-WG/nix-security-tracker/issues/4 https://github.com/Nix-Security-WG/nix-security-tracker/issues/6 https://github.com/Nix-Security-WG/nix-security-tracker/issues/8

  3. match/align these two sorts of information (the config and the vulnerabilities) with fewer or more heuristics based on how "pre- cleaned-up" the information (meta and nix-specific database is cleaner, derivation graph and upstream database is messier) Related tickets: https://github.com/Nix-Security-WG/nix-security-tracker/issues/5

  4. produce an output of those matches

raboof commented 11 months ago

For '2', I don't think we need Nix-Security-WG/nix-security-tracker#6, for 2 reasons: I think that is useful mainly for the 'make the results more actionable' task that we might include in the first milestone, and even if we do, perhaps this information should be provided as part of the feed created by the online tracker rather than by subscribing to the GitHub PRs directly from the local tool.