tickets #152482
closedRequest for security team blog on security.opensuse.org
0%
Description
We from the product security team would like to publish a blog-type of page where we could post write-ups of code reviews and security vulnerabilities that we found. This way people can see what our distribution puts into its security. The idea is currently a static page with opensuse or suse branding and we would have full access to the content to be able to update content quickly. The page should be found when using a regular search engine.
From discussion with Georg we gathered that there is already such a setup, which could pull in a jekyll page from a git repository and publish the build results to a page at a chosen subdomain.
We could provide such a repository and we would prefer the subdomain if possible: security.opensuse.org
Please let us know if that would be possible and if so, where we should provide the repository :)
Thanks a lot!
Updated by cboltz 9 months ago
- Tracker changed from communication to tickets
I can offer to create a repo on github for you. Would github.com/openSUSE/security-team be a nice place? Also, who (which github usernames) should get access to it?
For hosting the page - security.opensuse.org is available, and if you use jekyll, deploying your blog is easy (adding 5 lines in our salt config).
Updated by hellcp 9 months ago
You can also use https://github.com/openSUSE/jekyll-template/ to make it easier, though you may need to adjust the index page to display posts. I can probably help out a bit with that
Updated by cahu 9 months ago
Thanks a lot for the help! I will definitely take a look at the jekyll-template.
Regarding the repository, I was wondering if it would be possible to pull this in from a private repository? Reason is that we could internally review PRs to the repo before they are merged and being published without having the drafts or comments public.
If that would be a lot of work, we can probably also find another workflow with a public repo.
My colleagues suggested the repository name to be "openSUSE/security-team-blog". I just checked and we have already have a team in github, maybe you could just assign the repository to us:
https://github.com/orgs/openSUSE/teams/security
If that does not work, please just add me (github username: ca-hu) and I will add the others.
Thanks a lot!
Updated by cboltz 9 months ago
I created https://github.com/openSUSE/security-team-blog with you as admin, and the security team as maintainers (I'm not a big fan of making everybody repo admin). Feel free to adjust as needed.
Just wondering - what's the reason why you consider to keep drafts and comments private? Just a preference ("nobody should see my typos"), or are there serious reasons like planned articles about embargoed vulnerabilities?
Our jekyll setup assumes that repos are public and can be cloned over https. Therefore I'd prefer if you keep the repo public (or tell me how we can access it over https if it's private ;-)
Speaking about jekyll - as soon as you have something in the repo, please tell me so that we can add it on our jekyll server and publish it.
Updated by cahu 9 months ago
Thanks a lot for creating the repo, we will let you know when we created the page, probably in the next week(s) :)
Just another question, what is the interval that the server pulls from the repo and deploys?
About the private drafts and comments: we won't have embargoed vulns on there, it is more to avoid confusion or drama (sometimes upstream projects feel they are wrongly represented by a draft report, so we try to find a solution privately before publishing).
I talked to my colleagues and the public repo that you created will be fine for the use case, we will just review the changes via other means, thanks a lot :)
Updated by cboltz 9 months ago
Jekyll pages get updated and deployed hourly (at or a few minutes after the full hour).
I'm a bit surprised that some upstream projects don't like public PRs - maybe you should tell them that a PR is a draft? ;-) (but then, open source projects should already know this...)
Updated by cahu 8 months ago
Hi :)
sorry for the long delay, we pushed content to the repo now: https://github.com/openSUSE/security-team-blog
If you could deploy the page, that would be great :)
Thanks a lot!
Updated by cboltz 8 months ago
- Status changed from Workable to Resolved
https://security.opensuse.org/ is up and running :-)
BTW: Feel free to send a PR to https://github.com/openSUSE/planet-o-o/ to get security.o.o added to planet.opensuse.org