Release notes / Security mapping to Docker images

Feature Requests
1

While we saw the in-platform note of the recent security updates, one thing this brought up for us was that most detection tools (update bots like Renovate / Dependabot, scanners like Trivy / Snyk, image scanning tools like AWS Inspector, etc) don’t seem to pick up the security finding, even though, as your security page mentions, GitHub advisories are published.

A few things that I think would help

  • Add org.opencontainers.image.source (and possibly image.revision or image.version tags to the Docker images. This should make it a little easier to map release notes to Docker images
  • Publish release notes on GitHub for all releases vs. just some.
  • Even the changelogs at, e.g., Metabase 63 changelog don’t seem to reflect notes for each patch version?
  • Publish the GH release advisories with an actual package “coordinate” vs ecosystem:"other"

If anyone has other ideas for how to put these things together, would love to hear them. I setup pinning of the Docker image, and Renovate regex matching so that it’s possible to have it bump the image tag…. but it would be really nice if it were possible for security updates to get flagged as such in the sorts of platforms / tools mentioned above.

While I understand that Metabase’s release processes may not line up exactly with all normal open source software, and also that we could probably create alerts within Metabase itself, I think some (hopefully small) adjustments could make some of the above tools work more seamlessly and correctly.

2

Release notes & changelogs used to be published for each version, but that practice stopped or was put on hold while the current security situation was dealt with. I hope they return soon.

1 Like
3

Got it. I was wondering if that was a factor, though going through the historical release notes, seemed like there were some missing in there as well (as far as each patch release specifically)?

4

I can’t speak to old stuff. I’ve been running Metabase since 55 and don’t recall any significant omissions in the changelog, though I only track one major version at a time. Until the recent situation, anyway.

5

It also sounds like the results are in the repo (Security Advisories · metabase/metabase · GitHub) but, according to AWS inspector team, they are not showing up in GitHub Advisory Database · GitHub