Cyberus Linux pairs a five-year LTS lifecycle with a security process that looks beyond official vulnerability databases and feeds fixes back upstream to NixOS. Here is how that process works, and how it changes between the first six months of co-maintenance with the community and the four and a half years that follow.
Providing a five-year Long-Term Support (LTS) lifecycle for NixOS and Nixpkgs is not just applying patches. It requires a holistic view of the security process. Of course, we want to deliver dependable security to our customers. But we also aim to contribute to the upstream security and release management. Ultimately, the quality of Cyberus Linux depends on the excellent work done upstream.
Rather than relying exclusively on official vulnerability databases to identify issues, we monitor a wide range of unstructured information sources, such as release announcements and mailing list posts. This wide net gives us the ability to discover vulnerabilities the official sources do not contain and take the appropriate action. We combine both information sources into an internal vulnerability database. The tip of this information iceberg is visible on security.cyberus-linux.com.
Cyberus Linux releases typically have two phases. In the Co-Maintenance phase, where Cyberus Linux tracks the upstream release as closely as possible, we submit our patches upstream. In this phase, we use our security overview to spot updates the community might have missed and fix them upstream. We also contribute to improving the release process itself, for example, by improving the situation around automated security backports from NixOS unstable.
Once community support ends, we transition to the Stability phase. Here our work shifts to patching security vulnerabilities and backporting updates ourselves.
We want to give customers maximum transparency into their security posture. For that reason, we publish information about vulnerabilities that affect Cyberus Linux on security.cyberus-linux.com. You can track the timeline for every security vulnerability from our first encounter with it to the eventual resolution, together with any reasoning by our security engineers.
We follow the development of the community Nixpkgs Security Tracker with great interest. It is, in fact, one of the information sources we consume. We see the Cyberus Linux Security Tracker as complementing the community security tracker.
While the community tracker is built for coordinating the distributed community around resolving issues, the Cyberus Linux tracker is built for customer visibility. It focuses strictly on informing Cyberus Linux users about the stable foundation they rely on.
We have many ideas for improving the security process and the Cyberus Linux Security Tracker. The latter is still only a fraction of what we want to have in the long term. Ideas we are exploring range from customer-specific views, where users only see information about packages that are directly relevant to them, to an API that allows customers to integrate security checks in their CI/CD pipeline.
We’re curious to hear your thoughts about the security of Cyberus Linux and the NixOS ecosystem in general! Reach us via our Matrix channel or send us a message.
