How to handle security advisories

[adriendupuis]

Question	Answer
JIRA Ticket
Versions	4.6 (TODO: something to reuse on 5.0??)
Edition

#3235 and #3246 show that maintaining an exhaustive list of Security Advisories (SA) for both update and install is fastidious.

This PR proposes to explain how to handle SA in general.

Also document how to suppress deprecation messages breaking ibexa:install on PHP 8.4

• The new "Security advisories" page
• During install:
  • Link to SA while creating project
  • Ignore deprecation errors while installing DB
• Link to SA in 4.6 update process
• About packages kept up-to-date and SA in "Security checklist"'s "Track dependencies" section

Move CI code_samples.yaml from deprecated config.audit.ignore to config.policy.advisories.ignore-id, update its SA list, and sort alphabetically.

Checklist

• Text renders correctly
• Text has been checked with vale
• Description metadata is up to date
• Redirects cover removed/moved pages
• Code samples are working
• PHP code samples have been fixed with PHP CS fixer
• Added link to this PR in relevant JIRA ticket or code PR

[github-actions]

Preview of modified files

Preview of modified Markdown:

• docs/getting_started/install_ibexa_dxp.md
• docs/infrastructure_and_maintenance/security/security_advisories.md
• docs/infrastructure_and_maintenance/security/security_checklist.md
• docs/update_and_migration/from_4.6/update_from_4.6.md

[mnocon]

Initial pass, like the direction a lot - seems much more maintanable than maintaing the list of advisories 💪

[glye]

Great improvement.

[glye]

Maybe also add a point about considering whether you should update to very freshly released packages. There is a potential security benefit to avoiding the newest packages, because of supply-chain attacks. Composer doesn't have a setting for this yet, but minimum-release-age is coming:
composer/composer#12633

[adriendupuis]

@glye Some like this?:

Suggested change

	- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions.
	- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions. Delay the installation of recently released version that aren't fixes. Only install fixing versions and one-month-old versions.

[glye]

Feels too definite and specific to me. "that aren't fixes" isn't very helpful since attacks will likely camouflage as fixes. I would only advise people to consider the risk of supply chain attacks, and whether they ought to have a policy for avoiding recent releases newer than X time.