We currently have a long-running, protected Phabricator task used to track the status of various production-applied (but not disclosed) security patches within Wikimedia production releases. In some recent discussions on that task, it was determined that there might be better ways of tracking these patches. Some potential paths forward:
# a yaml file that lives under `/srv/patches` on the deployment servers
# a json file that lives under `/srv/patches` on the deployment servers
# a script that reads the contents of `/srv/patches` and generates output based upon what is actually there
# a script that looks at patches that are actually applied under various mediawiki staging directories on the deployment servers
# something else?
# the status quo
Each of the above options have their limitations, but in the aforementioned discussions on the protected tracking task, I think the consensus arrived at one of the first two options. Anyhow, this might merit further (public) discussion and input, so I filed this task.