search

freedomofpress / securedrop-tooling

Contains standard tooling configuration for SecureDrop repositories
GNU Affero General Public License v3.0
0 stars 0 forks source link

complete consolidation of Safety ignore-lists #14

Open cfm opened 1 year ago

cfm commented 1 year ago

Witness what's been needed to ignore Safety 61601 (urllib3 CVE-2023-43804) to date:

legoktm commented 1 year ago

Now that we have fpf-misc-resources is there value in the having per-repository safety jobs? My initial impression is that there isn't - the only thing it would catch is if we were adding a new library that happened to have a security vuln, but there's no guarantee it would get caught because CI uses the free safety repo that is up to a month behind, while the fpf-misc-resources job uses the up-to-date version.

zenmonkeykstop commented 1 year ago

I do think we should pick one - but I'm not sure this is the one that I would pick. In much the same way as we're looking at moving debian/s back into their respective repos to reduce overhead, these ignore lists relate to dependency manage within individual projects and are probably going to be easier to manage there. But for sure, the ~month delay is a pain.