Collect Fedora

[pombredanne]

See https://fedoraproject.org/wiki/FSA
https://fedoraproject.org/wiki/SecurityBasics#Subscribing_to_Security_Announcement_Services

[pombredanne]

There is no clear and structured security data feed.
Instead we would need to parse this mailman list archives https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/ and identify announces that deal with security such as https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JQOGVCB6T3VQPBVJJXWJTPVKF4NT7NHD/

[pombredanne]

Other sources could include

• Bodhi https://bodhi.fedoraproject.org/updates/?releases=F31&status=testing https://bodhi.fedoraproject.org/updates/FEDORA-2019-aa99c99f24
• https://lwn.net/Alerts/Fedora/

[armijnhemel]

On https://fedoraproject.org/wiki/Security_Bugs the following is linked: https://bodhi.fedoraproject.org/updates/?type=security which has a (not so clean) RSS feed.

[pombredanne]

@armijnhemel Excellent!
The updates are great and there is a REST API too https://bodhi.fedoraproject.org/docs/server_api/rest/updates.html#service-2

[armijnhemel]

@armijnhemel Excellent! The updates are great and there is a REST API too https://bodhi.fedoraproject.org/docs/server_api/rest/updates.html#service-2

It seems that that last link no longer works.

[armijnhemel]

Also, it should be noted that not all of the security bugs listed in the Fedora security advisories are linked to a CVE.