- Issue created by @catch
The Drupal Association commissioned a security audit of php-tuf and related packages, as well as rugged. I don't think this audit explicitly included package manager and automatic updates.
It's my understanding that the audit found some PHP issues all of which were minor and could be fixed in public. And some rugged code and workflow issues which could nearly all (or perhaps all) be fixed in public.
However, I am not aware of a way to find out:
1. Which issues were reported against which projects without reading the full audit.
2. Which issue/MR these issues were worked on.
3. Whether those issues/MRs were already resolved.
If there are still issues being worked on in private that also aren't fixed yet, we can't disclose those publicly, but we could maybe put 'private issue 1, project A, in progress' or alternatively just state when there are no open private issues.
Document in this issue or somewhere else the above information.
Active
3.1
Code