Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add unmaintained advisory for syslog crate #1672

Closed
wants to merge 2 commits into from
Closed

Add unmaintained advisory for syslog crate #1672

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eefdf11
Add unmaintained advisory for syslog crate
bheylin Apr 1, 2023
20d9320
Add comments to message
bheylin Apr 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions crates/syslog/RUSTSEC-0000-0000.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "syslog"
date = "2023-04-01"
url = "https://github.com/Geal/rust-syslog/pull/64"
informational = "unmaintained"

[versions]
patched = []
```

# The syslog crate is no longer maintained by it's current owner.
#
# The PR referenced above has had no response for a year a three months.
# I tried to contact the owner through Github and the email associated with their Github account.
Comment on lines +13 to +16
Copy link
Contributor

@pinkforest pinkforest Apr 6, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please can we use formatting / fill the necessary detail accordingly per this example:
https://github.com/rustsec/advisory-db/blob/main/crates/buf_redux/RUSTSEC-2023-0028.md

Other than that don't see why this advisory should get merged as of now - it should also be actionable.

Our unmaintained advisories are reserved for completely unreachable maintainers and I don't see the necessary explicit communication that would support / merit flagging an advisory.

The maintainer seems very active and I don't see that maintainer would not merge security fixes if any.

@Geal just wondering if it would be worthwhile to nudge people to use other implementations ? Personally I don't see big reason to flag warning but just in case you would feel a gentle note would be warranted from your maintainer PoV that this crate may be deprecated possibly and you would be happy for people to not use the crate ?

Re; alternatives there seems another syslog implementation by name of syslog-rs but I'm not going to paint any alternatives at this stage since the maintainer hasn't had the word out.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

well that was a rude way to get my attention 😁
That crate is not unmaintained, it's just that as a very thin wrapper over syslog, it does not warrant a lot of releases (it's mostly 1 per year by now), unless there are serious issues or vulnerabilities, and that PR was neither.
@bheylin I'll get to it, chill a bit.

Copy link
Author

@bheylin bheylin Apr 6, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pinkforest I thought that a year plus response time on a PR would warrant a crate as unmaintained.
But fair enough, you use a stricter definition of unmaintained.

@Geal apologies for my rudeness. I understand that syslog doesn't warrant a lot of releases.
But it's a shame that I can't use the crate on FreeBSD.

Thanks for your time all