Docs: Integration with Release Monitoring for Recipes

[Pheoxy]

Description:

We need documentation for contributors to integrate release monitoring for SerpentOS packages to ensure that they stay up-to-date with upstream releases. This involves setting up release-monitoring.org for each package, creating and configuring the monitoring.yml file, and establishing a process to keep packages current with upstream changes.

Example monitoring.yml file:

releases:
  id: <integer corresponding to package anitya id>
  rss: <valid URI to RSS/ATOM release feed>
  ignore:
    # ignore pertains to version to ignore. Supports globs. Example:
    - "253.*"
security:
  cpe:
  - vendor: somevendor
    product: someproduct
  # aliases/historical renames and/or multiple vendor/products in a single package
  - vendor: someoldvendor1
    product: someoldproduct1
  - vendor: someoldvendor2
    product: someoldproduct2
  ignore:
  - CVE-x
  - CVE-y
  - CVE-z

Action Items:

• Creating and configuring the monitoring.yml file:

  • Define the structure and required fields for the monitoring.yml file.
  • Include necessary metadata such as id, package name, upstream URL, and versioning information.
  • Ensure the file is correctly formatted and placed in the package directory.

• Ensuring that the package stays up-to-date with upstream releases:

  • Establish a process for regularly checking for updates via release-monitoring.org.
  • Automate notifications or updates if possible to streamline the process.
  • Document the steps for maintaining and updating the monitoring.yml file.

Additional Resources:

• Forum Post: Security Monitoring File Format Discussion