Unfortunatly, I don’t have time to continue the maintainership of vulnix nor am I able to prepare any more vulnerability roundups. We have had some discussions at last year’s NixCon but they did not result in an actionable plan.
So I reach out to the community today if someone would be willing to take over.
Big thanks to everyone who contributed suggestions, feature requests and patches. And apologies that I was not able to take care of them appropriately during the last year or so.
This sounds really exciting! I’m glad that you guys are willing to take care of the project. And I would completely appreciate changing the tool to support a SBOM-based workflow. This would improve modularity.
@ctheune Would you be so kind to transfer the repo if you are fine with this as well? I cannot do this.
I’m no lawyer, but I don’t expect license itself needs to change, just generalize the lines that claim that copyright belongs (fully) to Flying Circus, at least in files where other people make significant changes (i.e. AFAIK no action needed immediately).
So typically I’d expect that the foundation needs a copyright assignment when doing a transfer like this. I’m happy to scrub the copyright headers (this is all mushy anyway WRT German copyright law) while under our control to make this more explicit regarding the history. I’m unsure who is in charge about copyright etc. – the github organisation page didn’t help.
The foundation exists as a legal entity, but I see no need for it to own copyright of this tool. I don’t think it owns any code so far; copyright just remains with individual authors – which saves the need for copyright assignments.
I have set up a vulnix team and added both you and @ckauhaus as maintainers.
You’re all set in the nix-community org for now.
I’ve also created a PR to move the CI over to Github Actions which is what most nix-community projects uses for CI.
This will give you access to the nix-community binary cache.
