Using snyk for package vulnerability verification

[Justin Obara]

I’ve added the fluid-project repos to Snyk with the exception of repos that
were forks ( unless they were named fluid-* ).

Thanks
Justin


On April 12, 2017 at 11:47:42 AM, Tirloni, Giovanni (gtirloni at ocadu.ca)
wrote:

Hello,

By lazy consensus rules, there have been no objections to adopting this
tool.

Unfortunately I don't have admin privileges to the fluid-project
organization to add the repositories to Snyk myself. Anyone with those
privileges, please feel free to login to Snyk, select the 'Fluid Project'
organization in the top dropdown, click on 'Add my GitHub repositories to
Snyk' and then select the ones from the 'fluid-project' GitHub
organization.

Thank you,
Giovanni

On 04/06/2017 09:48 AM, Tirloni, Giovanni wrote:
> Hello,
>
> There was a discussion in the GPII Architecture mailing list that started
in Oct 2015 when snyk.io was released and I believe it would beneficial to
adopt it for Fluid repositories.
>
> Here are the relevant threads:
>
> http://lists.gpii.net/pipermail/architecture/2015-November/thread.html
> http://lists.gpii.net/pipermail/architecture/2017-April/thread.html
>
> And here's more information about Snyk:
>
> https://snyk.io/docs/faqs/
> https://snyk.io/plans
>
> I took the liberty of creating a "Fluid Project" organization in Snyk and
invited the Fluid Project's GitHub administrators to it (as I don't have
permission to add repositories).
>
> Enabling Snyk for a repository means:
>
> * A WebHook will get added to notify snyk.io of new PR and commits
> * A notification will be added to new PRs to identify if they introduce
security vulnerabilities (within snyk's scope)
> * The repository will be constantly monitored for new vulnerability
>
> To clarify, Snyk is not a static code analyzer. It simply inspects
dependencies that have known vulnerabilities.
>
> If there is consensus on adopting this tool, I would like to request that
someone with admin privileges to the Fluid Project in GitHub to access
Snyk.io and add the repositories.
>
> Regards,
> Giovanni
>
>
> -------- Forwarded Message --------
> Subject: Re: [Architecture] snyk node package vulnerability checker now
live!
> Date: 04/06/2017 04:50 AM
> From: Tony Atkins <tony at raisingthefloor.org>
> To: Tirloni, Giovanni <gtirloni at ocadu.ca>
> CC: architecture at lists.gpii.net Architecture <architecture at lists.gpii.net>

>
>
>
> Hi, Giovanni.
>
> Personally I would be happy to have this for every repo and PR. Even
though many of us regularly run "npm outdated" (or "yarn outdated") and
test our work with newer libraries, having a report on known bad versions
gives us a consistent "trailing edge". By that I mean that if we haven't
managed to otherwise update our dependencies when snyk identifies a
problem, we have a good reason to take a moment and review.
>
> Anyway, +1 from me.
>
> Cheers,
>
>
> Tony
>
> On Wed, Apr 5, 2017 at 6:20 PM, Tirloni, Giovanni <gtirloni at ocadu.ca
<mailto:gtirloni at ocadu.ca>> wrote:
>
> Snyk can monitor repositories and test new PRs for vulnerable packages.
>
> Is there interest in having this tool automatically monitoring our
repositories? It's free for open source project.
>
> https://snyk.io/docs/github
>
> On 10/29/2015 02:29 PM, Steve Lee wrote:
> > https://snyk.io/
> >
> > Steve Lee
> > OpenDirective http://opendirective.com
> > _______________________________________________
> > Architecture mailing list
> > Architecture at lists.gpii.net <mailto:Architecture at lists.gpii.net>
> > http://lists.gpii.net/mailman/listinfo/architecture <
http://lists.gpii.net/mailman/listinfo/architecture>
> >
> >
> _______________________________________________
> Architecture mailing list
> Architecture at lists.gpii.net <mailto:Architecture at lists.gpii.net>
> http://lists.gpii.net/mailman/listinfo/architecture <
http://lists.gpii.net/mailman/listinfo/architecture>
>
>
> _______________________________________________________
> fluid-work mailing list - fluid-work at lists.idrc.ocad.ca
> To unsubscribe, change settings or access archives,
> see http://lists.idrc.ocad.ca/mailman/listinfo/fluid-work
>
_______________________________________________________
fluid-work mailing list - fluid-work at lists.idrc.ocad.ca
To unsubscribe, change settings or access archives,
see http://lists.idrc.ocad.ca/mailman/listinfo/fluid-work
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.idrc.ocad.ca/pipermail/fluid-work/attachments/20170412/cb626490/attachment.htm>