{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13515","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13515/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13515/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13515/events","html_url":"https://github.com/NixOS/nixpkgs/issues/13515","id":136963535,"number":13515,"title":"how to subscribe to security advisory notices for nixpkgs / nixos?","user":{"login":"dckc","id":150986,"avatar_url":"https://avatars.githubusercontent.com/u/150986?v=3","gravatar_id":"","url":"https://api.github.com/users/dckc","html_url":"https://github.com/dckc","followers_url":"https://api.github.com/users/dckc/followers","following_url":"https://api.github.com/users/dckc/following{/other_user}","gists_url":"https://api.github.com/users/dckc/gists{/gist_id}","starred_url":"https://api.github.com/users/dckc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dckc/subscriptions","organizations_url":"https://api.github.com/users/dckc/orgs","repos_url":"https://api.github.com/users/dckc/repos","events_url":"https://api.github.com/users/dckc/events{/privacy}","received_events_url":"https://api.github.com/users/dckc/received_events","type":"User","site_admin":false},"labels":[{"id":6314754,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/0.kind:%20question","name":"0.kind: question","color":"84b6eb","default":false},{"id":126506420,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/1.severity:%20security","name":"1.severity: security","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":{"login":"domenkozar","id":126339,"avatar_url":"https://avatars.githubusercontent.com/u/126339?v=3","gravatar_id":"","url":"https://api.github.com/users/domenkozar","html_url":"https://github.com/domenkozar","followers_url":"https://api.github.com/users/domenkozar/followers","following_url":"https://api.github.com/users/domenkozar/following{/other_user}","gists_url":"https://api.github.com/users/domenkozar/gists{/gist_id}","starred_url":"https://api.github.com/users/domenkozar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenkozar/subscriptions","organizations_url":"https://api.github.com/users/domenkozar/orgs","repos_url":"https://api.github.com/users/domenkozar/repos","events_url":"https://api.github.com/users/domenkozar/events{/privacy}","received_events_url":"https://api.github.com/users/domenkozar/received_events","type":"User","site_admin":false},"assignees":[{"login":"domenkozar","id":126339,"avatar_url":"https://avatars.githubusercontent.com/u/126339?v=3","gravatar_id":"","url":"https://api.github.com/users/domenkozar","html_url":"https://github.com/domenkozar","followers_url":"https://api.github.com/users/domenkozar/followers","following_url":"https://api.github.com/users/domenkozar/following{/other_user}","gists_url":"https://api.github.com/users/domenkozar/gists{/gist_id}","starred_url":"https://api.github.com/users/domenkozar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenkozar/subscriptions","organizations_url":"https://api.github.com/users/domenkozar/orgs","repos_url":"https://api.github.com/users/domenkozar/repos","events_url":"https://api.github.com/users/domenkozar/events{/privacy}","received_events_url":"https://api.github.com/users/domenkozar/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/NixOS/nixpkgs/milestones/9","html_url":"https://github.com/NixOS/nixpkgs/milestones/16.09","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/milestones/9/labels","id":1599653,"number":9,"title":"16.09","description":"The next release after 16.03. Perhaps it will be 16.09","creator":{"login":"vcunat","id":1785925,"avatar_url":"https://avatars.githubusercontent.com/u/1785925?v=3","gravatar_id":"","url":"https://api.github.com/users/vcunat","html_url":"https://github.com/vcunat","followers_url":"https://api.github.com/users/vcunat/followers","following_url":"https://api.github.com/users/vcunat/following{/other_user}","gists_url":"https://api.github.com/users/vcunat/gists{/gist_id}","starred_url":"https://api.github.com/users/vcunat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vcunat/subscriptions","organizations_url":"https://api.github.com/users/vcunat/orgs","repos_url":"https://api.github.com/users/vcunat/repos","events_url":"https://api.github.com/users/vcunat/events{/privacy}","received_events_url":"https://api.github.com/users/vcunat/received_events","type":"User","site_admin":false},"open_issues":31,"closed_issues":153,"state":"open","created_at":"2016-02-23T13:45:20Z","updated_at":"2016-11-17T10:04:26Z","due_on":"2016-09-29T00:00:00Z","closed_at":null},"comments":38,"created_at":"2016-02-27T20:29:23Z","updated_at":"2016-11-24T21:04:17Z","closed_at":null,"body":"tl;dr: I suggest an issue label or combination of labels dedicated to security advisories (vulnerabilities and updates / patches).\n## Describe your issue here\n\nNix is great, and as I use it more for hobby stuff, I'm thinking about using it at work ([KUMC medical informatics](http://www.kumc.edu/ea-mi/medical-informatics.html)) where we safeguard research data about a large collection of patients.\n\nWe have a few dozen linux servers; SLES in particular. We regularly apply SLES updates, so we get those updates whether we read their [SUSE Update Advisories](https://www.suse.com/support/update/) or not. For stuff we install on top of that, our general policy is to subscribe to security notices directly. For example:\n- [Oracle Critical Patch Updates, Security Alerts and Third Party Bulletin](http://www.oracle.com/technetwork/topics/security/alerts-086861.html) esp. JDK/JRE updates\n- [Apache Security Updates](https://httpd.apache.org/security_report.html)\n\nI have been looking for something similar for nix packages. I sort of expected to see something on/near [NixOS support](https://nixos.org/nixos/support.html), but no joy. Then I stumbled across the [issues with the 1.severity: security label](https://github.com/NixOS/nixpkgs/labels/1.severity:%20security).\n\nStuff like #12437 on ffmpeg and #13506 on openssl are exactly what I'm looking for. But #7220 also bears that label, and it's more of a wide-ranging design discussion, not a particular vulnerability or update. It would work for me to filter out the \"0.kind: enhancement\" label or add \"9.needs: package (update)\" as a constraint, provided that emerges as the norm among the nix maintainers. An explicit link from [NixOS support](https://nixos.org/nixos/support.html) would be most helpful.\n\nFor reference, when I asked for reference information on the current list of labels, I learned about the [NixOS/Nixpkgs repository labels](http://comments.gmane.org/gmane.linux.distributions.nixos/18637) thread.\n\nFor inspiration, a few more lists I found while researching this request:\n- [Debian security advisories](https://www.debian.org/security/)\n- [Node.js security updates](https://nodejs.org/en/security/)\n\nIt seems conventional to document \"how to report security issues\" on the same page.\n### Expected result\n\nA security update policy on/near [NixOS support](https://nixos.org/nixos/support.html).\n### Actual result\n\nNo clear security update norms.\n### Steps to reproduce\n\nLook at [NixOS support](https://nixos.org/nixos/support.html) and pages nearby.\n"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/262844417","html_url":"https://github.com/NixOS/nixpkgs/issues/13515#issuecomment-262844417","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13515","id":262844417,"user":{"login":"vcunat","id":1785925,"avatar_url":"https://avatars.githubusercontent.com/u/1785925?v=3","gravatar_id":"","url":"https://api.github.com/users/vcunat","html_url":"https://github.com/vcunat","followers_url":"https://api.github.com/users/vcunat/followers","following_url":"https://api.github.com/users/vcunat/following{/other_user}","gists_url":"https://api.github.com/users/vcunat/gists{/gist_id}","starred_url":"https://api.github.com/users/vcunat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vcunat/subscriptions","organizations_url":"https://api.github.com/users/vcunat/orgs","repos_url":"https://api.github.com/users/vcunat/repos","events_url":"https://api.github.com/users/vcunat/events{/privacy}","received_events_url":"https://api.github.com/users/vcunat/received_events","type":"User","site_admin":false},"created_at":"2016-11-24T21:04:17Z","updated_at":"2016-11-24T21:04:17Z","body":"Note: the pciutils commit has no security implications, I believe (I authored it)."}}
{"actor":{"display_login":"vcunat"}}