RFC: OpenScanHub Prototype for Fedora

[Siteshwar Vashisht]

Hello,

I am writing this email to get feedback from the members of the Fedora
development community about OpenScanHub for Fedora.

# tl;dr

OpenScanHub does static and dynamic analysis of rpm packages and it may be
helpful in the Fedora community. Please take a look at our staging proof of
concept[4] and provide feedback. The proof of concept is in its early
stages so there may be some bugs here or there! If the feedback is positive
we may roll this out in official infrastructure and integrate with Fedora
CI and Packit.

# What

OpenScanHub is a service for static and dynamic analysis. It has been in
development inside Red Hat[1] for more than 12 years and was open sourced
on GitHub[2] earlier this year. You can read a brief explanation of this
service on my blog[3]. We would like to deploy this service on the Fedora
infrastructure and start scanning packages shipped in the Fedora project
through it.

# Why

I am sharing a prototype[4] of this service to get feedback from the
community. This prototype is running on the staging instance of the Fedora
infrastructure, so you would have to login[5] to the staging instance
before submitting any scan. If you have never logged into that account, it
may require you to do a password reset.

Once you are logged into the staging instance, you can login through the
`krb5login` button[6] on the top right corner of the homepage and submit a
scan through this form[7].

There are 3 different types of scans supported by OpenScanHub:

   -

   MockBuild performs a full scan of the package including downstream
   patches. Example[8] mockbuild for `openssl-3.1.1-4.fc39`.
   -

   DiffBuild performs a differential scan on the downstream patches. So you
   can find only the defects that are introduced by the downstream patches.
   Example[9] diffbuild for `openssl-3.1.1-4.fc39`. This option would not work
   if the package fails to compile without patches.
   -

   VersionDiffBuild performs a differential scan between 2 different
   versions of the package, and you can see defects introduced by the “newer”
   version of the package. Example[10] differential build between
   `openssl-3.1.1-4.fc39` and `openssl-3.0.9-2.fc38`.

All the submitted scans can be seen on the tasks[11] page.

This prototype is running on very limited resources, so please do not
submit scan for any resource consuming package. Not all defects reported by
OpenScanHub may be actual bugs, so please avoid fixing reported defects
without careful examination. If we receive positive feedback on this
prototype, there may be a possibility of integrating this service with the
Fedora CI and Packit projects.

This is a very early stage prototype and may behave inconsistently. Please
keep the discussion in this thread constructive. Thank you!

[1] https://kdudka.fedorapeople.org/muni23.pdf

[2] https://github.com/openscanhub/openscanhub

[3] https://situ.im/posts/openscanhub

[4] https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/

[5] https://accounts.stg.fedoraproject.org

[6]
https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/auth/krb5login/
<https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/auth/krb5login...

[7] https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/scan/new/

[8]
https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/task/6/log/ope...

[9]
https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/task/9/log/ope...

[10]
https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/task/7/log/add...
[11] https://staging-openscanhub.apps.ocp.stg.fedoraproject.org/task/