Skip to end of banner
Go to start of banner

2020-12-11 Meeting Notes

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

Date

11 Dec 2020

Attendees


Discussion items

TimeItemWhoNotes

Review Security IssuesTeam Review Kanban board (no new issues that haven't been reviewed)

Snyk tokenJulian Ladisch

Synk has two ways to analyze maven projects:
a) Run maven to create a dependency tree from all pom.xml files and use the result for Snyk analysis, or
b) Snyk directly fetches the pom.xml files but doesn't resolve the dependency before analyzing.
The reports from b) are unusable because it has many false positives and false negatives, see this screenshot. On the left a) with julianladisch/raml-module-builder where a GitHub action runs maven and then the snyk analysis and on the right b) with folio-org/raml-module-builder where Snyk directly fetches the pom.xml files.

To run the GitHub actions for a) we need to put the SNYK_TOKEN into the GitHub secrets settings. Temporarily the ryandberger Snyk token is used in the julianladisch repository. Should we create a folio-org Snyk organisation and token to be used for https://github.com/folio-org/ that is free for open source, or should we use the ryandberger Snyk organisation and token?


Safe harbor, policies
  • No labels