magma
proposal: triage alerts at severity "high"
Update
After the August 12 TSC discussion, I am rewriting the proposal as follows. Note that performing this rewrite clears the votes on the earlier proposal, so that votes prior to Aug 19 2024 are cleared.
Problem
There are too many Dependabot alerts with high severity. We have to find the resources to get them under control.
Solution
To get started on this problem I will work through the alerts for necessary security patches:
- Merge any pull requests that don't break the build or any test
- Identify and dismiss false positives
- Implement upstream patches when feasible
- Analyze dependency paths to CVEs and manually update packages as necessary
I will work on this for four calendar weeks.
Non-goals
This work is time-boxed. I am not promising to cover every alert.
This work excludes patching Magma source code. In places where an upgrade requires changes to, for example, React code, that is out of scope.
Bid
I am asking for $5,000 to complete this work.
This deliverable is time-boxed. It is one month best-effort labor. I assume an extra month for billing work. The acceptance criteria is believing that I did a credible job within the time limit.
As many alerts as possible will be triaged. I will either merge a PR, create a PR, write a well-researched ticket and help engineering get underway, or dismiss the item as a false positive.
Note that I am submitting this bid as the first party, under my own name, and not via OSPOCO.
Motion: @lucasgonze Seconded: @jordanvrtanoski +1: TBD
More details are requested.
@jim and Som raises a flag on both the gross amount and the budget - would the money be better spent elsewhere.
The proposal has been rewritten. The following is the original proposal.
ORIGINAL BID
Problem
Dependabot severe alerts are up to 78. We have to get them under control.
Solution
To get started on this problem I will work through the alerts for necessary security patches:
- Merge any pull requests that don't break the build or any test
- Identify and dismiss false positives
- Implement upstream patches when feasible
- Analyze dependency paths to CVEs and manually update packages as necessary
Non-goals
This work excludes patching Magma source code. In places where an upgrade requires changes to, for example, React code, that is out of scope.
Bid
I am asking for $10,000 to complete this work, using the completed proposal for severity "critical" alerts as a yardstick.
Note that I am submitting this bid as the first party, under my own name, and not via OSPOCO.
Acceptance:
- No upgrades at severity Severe will be untriaged. I will either merge a PR, create a PR, write a well-researched ticket and help engineering get underway, or dismiss the item as a false positive.
I started working on this and did a fair amount of work, but did it in the master branch, which is no longer viable. I think this is probably stale until we get master and 1.9 merged and master to a functional state. Blocked on https://github.com/magma/magma/issues/15573