Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deduplicate security advisories by generating blog articles from the PGP messages #791

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

TheLortex
Copy link
Member

A solution for #779

Source of truth is PGP signed messages. The site generator reads them and automatically generates blog post articles according to the content. In particular is looks for the Announced field to set the blog post date, and the Affects field for blog post subject.

For consistency I have moved the advisories under the data/security folder. I have also edited the content of the advisories so that they have a consistent style, that is easier to parse. This means that the PGP signatures are not correct anymore, @hannesm you will have to update the signatures.

@hannesm
Copy link
Member

hannesm commented Jan 9, 2023

Dear @TheLortex, thanks for this PR. But since PGP signatures carry a timestamp, I'm hesitant to re-sign all advisories without adding any information inside of them.

In addition, some of your formatting changes are done by the sign operation (such as adding trailing whitespaces, but also leading dash handling is special). Did you test that removing the signature and signing the raw data will lead to something your ad-hoc parser is able to use?

I would also refrain from moving the advisories to another random place once again - I don't see any benefits in doing that, but please elaborate why this is needed?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants