The Arch Linux Security Tracker is a lightweight flask based panel for tracking vulnerabilities in Arch Linux packages, displaying vulnerability details and generating security advisories.
This is a hacked-up version of said tracker, currently being evaluated for coordinating NixOS's security team.
- Issue tracking
- Issue grouping
- Todo lists
- Advisory scheduling
- Advisory generation
- SSO or local users
The trackerctl
script provides access to the command line interface
that controls and operates different parts of the tracker. All commands
and subcommands provide a --help
option that describes the operation
and all its available options.
Defaults can be seen in config/00-default.conf
. Further values will be
loaded from the directory specified by the TRACKER_CONFIG_DIR
environment variable, or /etc/security-tracker
if this is not set.
A simple test environment for SSO can be configured using Keycloak:
-
Run a local Keycloak installation via docker as described upstream.
-
Create an
arch-security-tracker
client in Keycloak like in test/data/openid-client.json. Make sure the client contains a mapper for the group memberships calledgroups
which is included as a claim. -
Create a local tracker config file with enabled SSO and configure OIDC secrets, groups and metadata url accordingly.
Help is appreciated, for some guidelines and recommendations check our Contribution file.