Support #21310: Requirements to have security alerts related GlideinWMS dependencies in GitHub repository - GlideinWMS - Fermilab Redmine

Support #21310

Requirements to have security alerts related GlideinWMS dependencies in GitHub repository

Added by Lorena Lobato Pardavila over 2 years ago. Updated about 2 months ago.

Status:

New

Priority:

Normal

Assignee:

Category:

Target version:

v3_7_4

Start date:

11/05/2018

Due date:

% Done:

Estimated time:

Stakeholders:

Duration:

Description

During the WMP meeting, security alerts in GitHub¹ have been discussed. There is an option of having a dependency graph and security alerts enabled in the repository, which checks all listed dependencies and checks reports (ex:[2]). This way, we’d be notified when a vulnerability is detected in any of the GlideinWMS project dependencies and even it would suggest known fixes from other experiences reported in GitHub community.

We'd need to have the file that gathers all the requirements[3 ] to get vital vulnerability information to GlideinWMS project. An example of something similar would be [4].

[1]https://blog.github.com/2017-11-16-introducing-security-alerts-on-github/
[2]https://github.com/dmwm/WMCore/network/dependencies
[3]https://help.github.com/articles/listing-the-packages-that-a-repository-depends-on/
[4]https://github.com/dmwm/WMCore/pull/8880/files#diff-b4ef698db8ca845e5845c4618278f29a