<infinisil>
So gchristensen might have a webhook for this one too?
<samueldr>
hmm, maybe
<gchristensen>
well
<gchristensen>
I have every event from the nixos org on github being sent to rabbitmq
<gchristensen>
so changes.sh could be rebuilt in to a more dynamic fashion but eh
<gchristensen>
so I can send whatever to whoever
orivej has quit [Ping timeout: 268 seconds]
globin has quit [Ping timeout: 245 seconds]
globin has joined #nixos-borg
orivej has joined #nixos-borg
NinjaTrappeur has joined #nixos-borg
<andi->
What would be the smartest/most efficient way to retrieve a list of rebuilds for every commit to master/release-...?
<andi->
Executing the rebuild-amount.sh script isn't really a thing I want to do on every commit :/ I am trying to run my CVE audit on every commit and only running it against packages that were actually changed reduces the runtime by a lot
<andi->
nvm, channel bumps are probably frequent enough
<infinisil>
andi-: Channels are sometimes delayed by a lot though
<infinisil>
andi-: unstable was occasionally a month old
<andi->
I know
<infinisil>
Maybe just run the script every 10th commit or so?
<andi->
but channels are usually what people care about. I plan to run on on master/branches every 6h or so
<infinisil>
Security fixes don't help much when the channel is already updated though, it should optimally happen before that
<andi->
sure, but I would like to know what drive-by fixes we did. Or even more important which things are fixed that were still embargoed
<andi->
Thus the list of open things isn't everything that matters
<gchristensen>
seems like a pretty good strategy
<andi->
It made *click* in my head a few weeks ago when I decided to no longer care about open stuff but about when things were fixed.
<andi->
The open issues are simple.
<andi->
I have a tool, there is vulnix, others have tools..
<gchristensen>
yeah! that is awesome
<andi->
a run that just checks everything *gnome* was about 2min..
<andi->
doesn't sound to bad
<andi->
lets see how the complete thing looks like
<gchristensen>
what does the tool actually end up doing?
<andi->
Gets a commit hash/branch. Fetches (HEAD first, then eventually GET) of the current NVD database. Checks every package that nix-env knows about against known issues. Extracts patches per derivation and matches them against the list of known issues. The result is a simple reprot with commit hash, package, CVEs and patches (that might fix them)
<andi->
nothing special
<andi->
but I plan to write a frontend that aggretates them and then you have a nice way to check what is open, what was fixed & when
<andi->
oh, it also checks for updates to thoes packages from release-monitoring.org.. but thats going to be removed..
<gchristensen>
so cool
<andi->
I think it is pretty simple :)
<andi->
Last nixcon the code was there already.. since then I have been mind boggling what I want to do with it..
<infinisil>
Oh NixCon, I need to register!
<andi->
The biggest difference to vulnix is probably that I am not trying to parse the derivation output. Not sure if that was a wise deciscion
<andi->
I currently end up spawning a `nix eval` per package that I want patches from.. I tried to make it all in one go but that ate all my RAM..
<LnL>
andi-: you where at the last nixcon?
<andi->
LnL: yes
<gchristensen>
he was but he ran away before I could meet him
<andi->
hrhr
<andi->
I had to catch a train + I lost my bagguage..
<andi->
gchristensen: I think we met at the pre-dinner :)
<LnL>
well, if I did talk to you I have no idea who you are
<andi->
:)
<infinisil>
Let's all write our nick names to the name plates from the start next time :P
<gchristensen>
andi-: did we? :o
<andi->
infinisil: yes..
<andi->
infinisil: I was bit lost with the names on the plates..
<gchristensen>
infinisil: I didn't even really know andi- before nixcon last year tho
<infinisil>
Yea..
<LnL>
I was also at the pre dinner :p
<andi->
hrhr
<gchristensen>
andi-: maybe if I saw a picture of you I'd recognize you but other than that, I have no idea :$
<andi->
gchristensen: I was thinking about that.. not sure what hair-cycle I was in.. I usually bounce between long and short hair every 1.5y
<gchristensen>
haha
<LnL>
there was somebody who put like a regular sticker on his shirt with his nick, I wouldn't have realised who we was if he didn't have that
orivej has quit [Ping timeout: 240 seconds]
<infinisil>
Just signed up for it :)
jtojnar has quit [Remote host closed the connection]