Why are Github security advisors not used?

[Warmek]

Question

I can see here: https://github.com/eclipse/leshan/security/policy that Github security advisors are not used. Why is that?

[sbernard31]

It sounds not possible if we are under Eclipse Github Organization, see https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/449 for more details.

Note that maybe it would be possible by moving Leshan under a dedicated organization : https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/1705

[Warmek]

What benefits would the use of security advisors bring for Leshan?

[sbernard31]

Mainly :

You can use repository security advisories to privately discuss, fix, and publish information about security vulnerabilities in your repository.

(source : https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/about-repository-security-advisories)

[sbernard31]

Eclipse IT Team ask us if we want to move to our own organization that way we will be able to enable GitHub security advisories for Leshan : https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/449#note_1115464

@Warmek, @jvermillard, @JaroslawLegierski any opinion about this ?

[sbernard31]

Regarding answers provided by Eclipse Team.
I plan to ask us to move Leshan in its own organization to have access to GitHub security advisories.

I will probably give them the green light next week.
So @Warmek, @jvermillard, @JaroslawLegierski, you have until the end of the week :

• to let me know if you think this is a bad idea
• OR to ask me more time to think about it. (On my side there is no urgency, so do not hesitate)

[jvermillard]

👍

[Warmek]

The only thing that we need is for https://github.com/eclipse/leshan url to be working and redirect to https://github.com/eclipse-leshan/leshan

[sbernard31]

The only thing that we need is for https://github.com/eclipse/leshan url to be working and redirect to https://github.com/eclipse-leshan/leshan

This should be done : Regarding answers provided by Eclipse Team.

[sbernard31]

I give the green light to eclipse for the move : https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/449#note_1153533

[sbernard31]

leshan project was moved to its own eclipse-leshan organization that means that security advisors will be available soon are now available.

I will update the SECURITY.MD file then I think we will be able to close this issue ?

[sbernard31]

SECURITY.MD is updated (commit a356488).