Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat/data enhancement spike #417

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

willmurphyscode
Copy link
Contributor

draft for getting feedback

@@ -0,0 +1,8 @@
# pretend the following PRs were merged
include-prs:
- https://github.com/github/advisory-database/pull/2630
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From Josh: This probably isn't needed; if we need to update GitHub's data, it's probably because they refused an update, not because they're being slow. And this really solves the "being slow" problem rather than the "we have a change they don't want" problem.


# assuming the following GHSAs were reviewed, even if they
# are not returned by the API
assume-reviewed:
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From Josh: This mechanism probably isn't needed. If we're going to include an unreviewed GHSA, we're going to have to change it anyway. So just have a mechanism for changing fetched GHSA data, and assume any changed GHSA should be included in our output, regardless of whether GHSA has reviewed it.

@@ -0,0 +1,73 @@
{
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could also be in GHSA's graphQL or rest API format.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From Josh: But whatever we do, we should only record changes, not all the data. Otherwise it's too hard to read what we changed.

@willmurphyscode
Copy link
Contributor Author

From Josh: For fixing the severity of CVE-2023-44487 in debian namespaces, we could solve the immediate problem by updating it to "high".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant