search

archlinux / arch-security-tracker

Arch Linux Security Tracker
https://security.archlinux.org
MIT License
123 stars 40 forks source link

Add group creation date to issues and group json #216

Open jakedane opened 1 year ago

jakedane commented 1 year ago

Through the json interface currently there is no way to find when a group was created. If an app for example uses /issues/vulnerable.json and needs this information it currently additionally has to download the group html for each group and parse the "Created date" from the html.

This MR adds group.created as 'date' to the issues and group json so for example downloading /issues/vulnerable.json would include this information and no additional download for each group is needed.

It uses Y-m-d date format same as is used for advisories creation date in package json.

jakedane commented 1 year ago

@jelly to the issues and group json tests I've added a check that date was set correctly.

anthraxx commented 1 year ago

@jakedane can you please give me a full user story to understand what you are trying to use this feature for?

jakedane commented 1 year ago

@anthraxx I'd use it for a security status check, part of a larger status app. I already download /issues/vulnerable.json (max once per 24 hours) to show which installed packages have a vulnerability but I'd like to add since when each vulnerability has been open and this PR would add that data to the json.

As alternative I have considered to diff the download with a previous download to find added groups and note the date each group was added in a client side cache, so from there I can get since when each vulnerability has been open. But as this is done client side that would be (wildly) inaccurate unless the status app is run every day. Another alternative, that is accurate, would be to download the html for each group and parse the html to get the created date and parse that back into a date value somehow. I figured it would be nicer to not cause a lot of downloads and instead have the data in the json already, which is what this PR does.