search

nix-community / vulnix

Vulnerability (CVE) scanner for Nix/NixOS.
BSD 3-Clause "New" or "Revised" License
476 stars 36 forks source link

[feature] Automatically create PR adding knownVulnerabilities #38

Closed matthewbauer closed 4 years ago

matthewbauer commented 6 years ago

I'm not sure if this has been looked into, but this could be a neat feature.

So, alongside the weekly updates, why not directly append to meta.knownVulnerabilities of vulnerable packages? The generated PR could be merged very quickly and let us avoid including vulnerable software (especially when patches are not immediately available).

I am not sure what the best way to modify Nix expressions is in Python.

ckauhaus commented 4 years ago

Discussion about standardised vulnerability metadata has not come to a conclusion yet. I'd close that for now.