[RFC 0127] Nixpkgs "problem" infrastructure

[piegamesde]

Rendered

Implementation PR

Matrix discussion room: #nixos-rfc-127:lossy.network

Pre-RFC discussion

Discussion notice: please try to attach all discussions to a thread by using the code review feature. If your comment doesn't refer a specific line to attach to, use the header line instead.

[edolstra]

This RFC is now open for shepherd nominations!

[lheckemann]

I nominate myself as a shepherd for this RFC.

[mweinelt]

I will also nominate myself as shepherd.

[wamserma]

Two remarks after having a quick glance (sorry if I missed any relevant discussion):

otherPackage.CVE1234 = "ignore"; maybe we should widen the scope of names for auto-inferred kinds and add more intelligence?

given:

meta.problems = {
 CVE-2023-XXXX = {};
 CVE-2023-YYYY = { message = "duh"; };
}

would infer:

meta.problems = {
 CVE-2023-XXXX = {
   kind = "insecure"; 
   url = "https://nvd.nist.gov/vuln/detail/CVE-2023-XXXX";
};
 CVE-2023-YYYY = { 
   kind = "insecure"; 
   url = "https://nvd.nist.gov/vuln/detail/CVE-2023-YYYY";
   message = "duh"; };
}

The other remark is re: deprecation/removal: These should take a version = "24.11" attribute, so based on nixpkgs release version we can warn on pre-deprecation and fail afterwards. And we are reminded on scheduled removal.

[7c6f434c]

widen the scope of names for auto-inferred kinds

I think given the existence of auto-inference, expanding the scope should be non-controversial enough to review as the implementation becomes technically ready for inclusion? Maybe mention in future work.

[wamserma]

widen the scope of names for auto-inferred kinds

I think given the existence of auto-inference, expanding the scope should be non-controversial enough to review as the implementation becomes technically ready for inclusion? Maybe mention in future work.

Definitely. We should just be careful to keep that path open in the RFC.

[mweinelt]

Linking to NVD is not the best URL I could imagine. When it comes to security issues, advisories are often a far better understandable resource, than a central database that advertises CVSS scores, which are often so-so.

Hence, I don't think auto-referencing NVD is really important here.

[7c6f434c]

Linking to NVD is not the best URL I could imagine. When it comes to security issues, advisories are often a far better understandable resource, than a central database that advertises CVSS scores, which are often so-so.

As NVD usually has more or less reasonable summary and links to better write-ups, I think auto-linking NVD when there is no better link provided is useful (and fetching their links is impure so can't be done within Nix).

[RaitoBezarius]

Linking to NVD is not the best URL I could imagine. When it comes to security issues, advisories are often a far better understandable resource, than a central database that advertises CVSS scores, which are often so-so.

As NVD usually has more or less reasonable summary and links to better write-ups, I think auto-linking NVD when there is no better link provided is useful (and fetching their links is impure so can't be done within Nix).

I feel like this is security team's call to decide what to do on this and is tangent to this RFC though.
In some future, we could have our own security tracker and those would be naturally the goto URLs.

[piegamesde]

The url field is an array for a reason. We can link to NVD and advisories and Nixpkgs-specific issues all at once.

About generating those automatically, I don't know. I'm not a fan of doing some fuzzy matching on inputs in general, and also is pasting in a link every blue moon really so much effort that it is worth automating away? (https://xkcd.com/1205/ says no)

[wamserma]

Linking to NVD is not the best URL I could imagine. When it comes to security issues, advisories are often a far better understandable resource, than a central database that advertises CVSS scores, which are often so-so.

I agree with you on the quality statement. :)
My intention was that there should be at least a pointer to further resources when no URL is given.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-50/29793/1

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-51/30870/1