From 2ab28c356811b5c068b336e671c2978aa1da3911 Mon Sep 17 00:00:00 2001 From: Zac Dover Date: Sun, 10 Jul 2022 04:05:47 +1000 Subject: [PATCH] doc/dev: add Dependabot section to essentials.rst This PR adds a section to the Developer Guide chapter "Essentials" that explains what Dependabot is. This section is adapted from an email from Ernesto Puerta to the CLT that was sent on 08 Jul 2022. Co-authored-by: Ernesto Puerta > Signed-off-by: Zac Dover (cherry picked from commit 2711e8de80edea121503e022cca37683f8abdfa9) --- doc/dev/developer_guide/essentials.rst | 30 ++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/doc/dev/developer_guide/essentials.rst b/doc/dev/developer_guide/essentials.rst index a4d716d23c200..082858c91b6cd 100644 --- a/doc/dev/developer_guide/essentials.rst +++ b/doc/dev/developer_guide/essentials.rst @@ -301,6 +301,36 @@ The rest (including the actual backporting) will be taken care of by the .. _`tracker issue`: http://tracker.ceph.com/ .. _`Stable Releases and Backports`: http://tracker.ceph.com/projects/ceph-releases/wiki +Dependabot +---------- + +Dependabot is a github bot that scans the dependencies in the repositories for +security vulnerabilities (CVEs). If a fix is available for a discovered CVE, +Dependabot creates a pull request to update the dependency. + +Dependabot also indicates the compatibility score of the upgrade. This score is +based on the number of CI failures that occur in other Github repositories +where the fix was applied. + +With some configuration, Dependabot can perform non-security updates (for +example, it can upgrade to the latest minor version or patch version). + +Dependabot supports `several languages and package managers +`_. +As of July 2022, the Ceph project receives alerts only from pip (based on the +`requirements.txt` files) and npm (`package*.json`). It is possible to extend +these alerts to git submodules, Golang, and Java. As of July 2022, there is no +support for C++ package managers such as vcpkg, conan, C++20 modules. + +Many of the dependencies discovered by Dependabot will best be updated +elsewhere than the Ceph Github repository (distribution packages, for example, +will be a better place to update some of the dependencies). Nonetheless, the +list of new and existing vulnerabilities generated by Dependabot will be +useful. + +`Here is an example of a Dependabot pull request. +`_ + Guidance for use of cluster log ------------------------------- -- 2.39.5