From 62004c5972ac301c30d14e034181d9f4b49b66c1 Mon Sep 17 00:00:00 2001 From: Jon Douglas Date: Thu, 26 May 2022 13:14:09 -0500 Subject: [PATCH 1/3] Initial Package Status Indicators spec --- .../StatusUpdateAvailable.png | Bin 0 -> 555 bytes .../PackageStatusIndicators/StatusWarning.png | Bin 0 -> 572 bytes .../package-status-indicators.png | Bin 0 -> 16731 bytes proposed/2022/package-status-indicators.md | 120 ++++++++++++++++++ 4 files changed, 120 insertions(+) create mode 100644 meta/resources/PackageStatusIndicators/StatusUpdateAvailable.png create mode 100644 meta/resources/PackageStatusIndicators/StatusWarning.png create mode 100644 meta/resources/PackageStatusIndicators/package-status-indicators.png create mode 100644 proposed/2022/package-status-indicators.md diff --git a/meta/resources/PackageStatusIndicators/StatusUpdateAvailable.png b/meta/resources/PackageStatusIndicators/StatusUpdateAvailable.png new file mode 100644 index 0000000000000000000000000000000000000000..4d020e055b0acac6e40349d8504d48aa27f682f7 GIT binary patch literal 555 zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`Ea{HEjtmSN`?>!lvI6-E$sR$z z3=CCj3=9n|3=F@3LJcn%7)lKo7+xhXFj&oCU=S~uvn$XBD8ZKG?e4lFzu{gbVqM^4_p~%tt>n0P_9*UZ9^zGcUQL#GJ z`HFghW)W|#Vr|p2V;*mrZ+zM3a3d(n!erMDuRKi?F422z)h~a~p20Hr?Y#g0=TuvW z|KpgMz?UbJqS(KJIcec7*C&iiTvERm?mGA_cE*p}s!GR$uWP1SO=Q|Smw!H2z5O{M z{_9UW_A@`J)nYjiSbADy`DDYW=h90iZ}gm;V=8KLVd7%_Z!xpCURAZZKF>sQ24})$ zb)hhk^IK1f%w|aG^0m3Hmgsss*}{!I>8H!?>*;^rbe65>KT!MH)SzB9&P*sH-zM?F zXMSU+>jo37J}(qAktkqXwSQXsmn@NE#~Hb=9g?eSaZRY^sf2h{>`N` zPJ{&?w(e$L!=S(7nxl8jd-G>+Udeyp{5L(idy~%5o50XiEpd$~Nl7e8wMs5Z1yT$~ z21bUu29~;pW+4U!RtDx)24>nIhQWk0!rUkta`RI%(<*UmcsOzOcAy3ZPgg&ebxsLQ E0AdKs)c^nh literal 0 HcmV?d00001 diff --git a/meta/resources/PackageStatusIndicators/StatusWarning.png b/meta/resources/PackageStatusIndicators/StatusWarning.png new file mode 100644 index 0000000000000000000000000000000000000000..5abc5981d64456fcafa22b4bca14edaa9d6093c9 GIT binary patch literal 572 zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`Ea{HEjtmSN`?>!lvI6-E$sR$z z3=CCj3=9n|3=F@3LJcn%7)lKo7+xhXFj&oCU=S~uvn$XBD8ZKG?e4y(9a&Zp+ z?;a80?4qHV;ubPN;EI5Wi=wX6!*_RH$pe|)AtGxPQ~7wcewns>y7c~KQ2FnD#picE zzr+1MluKoHQdr}cSH^Q15++qHD6l^M_badKa=Yp8jOC9ySTG43Ewp=OYxPuJ-LrLtr0w;e+_u2$AxCU3B|U^(~Zn<=~h?zwef z7590i{hR-Gw5*&mZmdKI;Vst0LPruL;wH) literal 0 HcmV?d00001 diff --git a/meta/resources/PackageStatusIndicators/package-status-indicators.png b/meta/resources/PackageStatusIndicators/package-status-indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..e3398c89b0683ddab6ca5f4284a364915c5a1ca5 GIT binary patch literal 16731 zcmbWfby!thgEx#IQX(ZFBBhkHbayC?(nv@hx;v$$yQE9Hq&ua%yCe?X(g*k!_jBL# z&dfXCTr=+tKr{w)bcdJ*MDKl4$$dVE7g>vF5i|Nd<5k}w}>KID$vg~5be!O&g%PqsT zIXkOLV=34}@UHG@#92xy&dIl=b=i#+9VH^;V5E?CA47^LrJzA4-c^QKQ`7SAMaj0a zaqH+ZSsI-1FHWW+^j?We8{M2XGmhbbID^IoMG6Z`?9u{A0kJzL=SDV$`ogYRF z=Q!BmY`G?&dhSxfZw()mrm#r9YCGA$3_j*q!Lwv4+2oa-$-+NpXOqRxZf|cXhHJF$ zm9Njb5-hFEeHu;%aK1DqdMT~M&|fu6pSYjU>2Ti@Tr(!&SjgxD|Xf!($(E^NE8l zYwOA^JT^~qe}vewEG40(gBxr6J9y@DM-!c_qo8aDepB+vU|U<;pWUgcsXx2J?gzGF zrC0mQcjgXu`)T&=4fPRsNe?c9M=G3A*pl895LM@R-Izp(=< zSx1nn5+P}kofOM+)NIdh{{G_v+OSppae=yrH;R_y?`^)xg>zzDQwm3(kBT5KX!__&%5V@#;Elv^H-9Z(Q^cq3rWM zx?E{S#AtfgI#kJ%!JO0l%)LMMh$lG03vP7Sq7*=5uyB)V(LtQZP!AE&s#EmzEF+Ney^9DNWy zO1$ZcYg)ie)#a!%o0Y{p58wG7yH4d>n_U#t%Eigq)7mQ7R2X@_9xaCl`!M_G&T~NW zK3}e={~BNCwp4D6^``LUq)|-ZV?pnq7CO$t1S}Ssm)E?QL_Man&cd^LSq$2~5lEQ` z`BO@4SNU7wT}6r)WOlfjWq!zbB+Ne*iC79XW@SbudY|3XDq6H1>`V4Fchn-LHV>%P zc0Sx9lb8Hf?CK+rA%%^?0&o~rx4esU(zA(AziS9Yx;I$5ZfZ=3Q|&X5z6&w-f@lvR zIcXr#;H||oW4QFlK*^QbUT$J5L32&)3}obOMwd`RWXXN3l2xB87Snq6`WL1Q4J^lJ zEbNi02#XoijAjT=XlEv=AzSyGZ1oC(c|%ReYPr;?cH&0AW3}25SfuBAaX_DVceohe zLMB`g%szdsou=<_dT4uEy{u|?%MhxOZc=IRD)>4URwCE)Ojaq+-h)=%Lf3oLr1Y&u zH49D+U;4`Q^QUlf$QtU&!bK?Pgq*oKIkhflCbRa57<_+5$|u_nFH~ah3h(p$8V(y1 z9bunHEDcZk+}cbnz=w5nIuy`UynXLW5a3+^saZ8?s;GN-rdmkQD;`>>~O*n}1{vu%o6$^dyWWuZ9Pxb>7 zs>y|DGHgt`*4_s;SltBp_7L|zsu%3^M}K~oaJSe*Eha&kP_$*O0=om++c_ch{l)C1 zoiY0-SSX=cmondQ_|-nqcF>pn?&eepK09?RLfkE*?m zC2P3pLnb)Y6N4<~L{Z(}H~7qu$=h^o@sjc6qK%65?CA(996^XHeDtd-XogDR4@j$L zf7_YnFn_X_=IMx7h1hZRS6yJqGxy0rl~~>D%ClyjGbA~RF-^tB&vvKd9UTT={=92C zw7nU=pNu-W+|onB7noAZ7M%$;w1Xmj0N7&iLB$-Mb@0xn*SRRkz2ONPmN0VJ!jHo0 zC;auB3Q&%`4V*Zp77yD{lQ#evxIU~Dc_r;0=pPIXPc*y)Fr@r7~=HMM?9&&ulOy6R?6&-+xl`n_qskkg@fu(>9600D#6*mT`+5)7_4W1E;bEzf%tkSlkP~T8 z0l^<2Y!*35@Y#XJI{y7Mj(56)Vq>}Dg1tgZX-W8b#;FEj@`${ z$Ijlq%>CvZw^T$*3XLHiExupO)s^Sdr%!?#N#u0mx-%Ug*`DIBaQl{+eE)^w#udrJ zm(dNU$?`L*TWOIzDwbVnrtpg@fj=+Vp3d*PIKx6wvvDv%&p0qKGLFk4&T@JQ#@2j9ww8)|Hw6Dt=(I1E_LYD~G7_E`7u-}g`FczP`|5Xg zEc6ntuUNLXG@>Iz0~-5sm2WQZgK^FD5qU z=>)A2JS@qQ>fytybz7vm#CWc4_i(cxsYJupElU|i&{sP$IW^<^gd;x1tY7MDNfoz$ zMvx`WG1Q%BuQtayiD~ZI*!>kf+ZWm$u$sYGYRWNNuEBf%lvEup6p5Q+0n) zr}WEjNWI7H!qL8c`h9}WdC8J?T)0yXKHm#|7qK9T*Ht+3J=uvp$Yeu1btHrnoIHLl4?bYGd?EHP64x(59#a%-w}@H> z{jefES8M%dSm54G)7$W^U%knrsZvv#2p5!~P?Q`BswqW6-p~7XQADk)Udh>SJ8LmA z3h}-zxAqZAX?}-&sufE}L|&(Ah-Z^+)vyrp=k!W0nf2Cd0e9y^y-9R^LxWmNvqz2I zZVui-y&lmt|Mybr+uM1LsY=*ogqNRx^T)-+19ztY-KU+$N(=Yfltw!tCLS^CzNAVV zD9)@f1C5m4Y$oNqAL({SRd^>dA4=Ekkjg~TFLBG`_2xDjG_ts^3dUq;eXV+YiUZ2wLga1O4KJioGfNx~jXdMx3PTM~h7YMA1M=&Ty%ZJyIq{QJW_9^rG(4=J;Wm8jAzamRy z6te56v<$HWeaA}xI1+Mlaw1QLZ5Te+w)&yr!(Hw{1o|NYH?un|fk^VOQSV${GD7G2 z_y+_SumzBl{!Sw``*W?87r;TdXGGkUwXG;$gDk|4K2&@_CPR&CO_=xxozyinwhs?C z=c-I;rzQcHeoy_pkDHyDIqK}DpRpzRS;X5(hu=VFs`8>Ff8ek*6o{*=sfjOCDP?A2 zYW;>zc-g1Y{4w4I{n@jV>)q0LnG1kaaU%ZDvb6y`s}h%oRruznx&%#4DL+9%s&l)t z(cHmA^`m)~tbKP9e{~Yy(pcohLM$)e_yzkIE-1#%GO_*wejU}OQofEoVaq2mkfb*+t<6czD|3u<2@BW%v# z?}>@4D{Vdl!^5_)OY3UOWvzIZkdTm-i<|x&*QxRYJMGGyDtBsA~7=R7uU*_2z zOz@1|kUz1c=v9ZB`yYwkay>#L4bl!QV~ib|P{{IV)M5-`m(@Nv9@u@*qmNt)Uf~cS z&=a^V-0e-Tr!s`jSiA-|6m|-Cr0p$Y40ANrb6C* z5=Z5ml3KUkKE2s?gn`Mw-nF^p?@tZ2g4bpq%(g}gFJUnWu|PG#T;5X(Gi>|n}4Oyzg9c&(Tj zq7DDKSBEbZHPTvFA@*4X(NiD5pyts70~O?})?EW|g1rkIagDg@A1J{aao#O01RCSYa(=wMJXajVcuF8LsDkHfR7&dIJmZjnYEr?FSh*ORA zM`C7k2&i|8!Am&pah+wtMcm*Nthyr$jm|8snOzK@rWp!Fzk6-gc7GW#}40n%LdI3(nE>JxwLjA z2nG*d;|a5}qa+i6>F9iSwMj^01kZcif%Cc9jmz@ZkP8Wecs-CRRW(OFHd-e$u2@C| zKhZ>|WA*VO#cK$23K!P5ydXnLk&hZk1qRH#3xU}tbRC1bdSyedFC4D@^Dl3{@&pjU zcb5LnwmP!g*?xolQsOx2DV5upJ#7cg>k5--c8i6X2qBh@qu;;498o;8y*&CIo1a{m zB1`&GLscCMV?D&4p$XH?ojBmSSE~(+Dx!+KgCM?AI$A*~i`lIyRAj{no`C#9)o*d{XgOs`9j~P5P!sH*3m2h|txE4492nlZ)DZ=* z{R2{PKMIn3dDYFkIme6Z_N-;)dWKMaOBm26nFNPlbxX_sDWl`Ig^<;`iS9A9YoW{Z zewQoS`F_4yub|nCOsT~xBJ$3D;60Bh{(&5~=XMUR?xbFJE#$wgM>Z6^%8S*)v7rC-2G(5(6b#)21Hx~~Nw0@!rJMbs|;KVxFkZ^#~2TCNRt&TvP&rL3|&CSiY z^o|x5VFw2mLumrq)-L0$S4$Vo66DxlcBhJC@$oRyFSDHefiPH&#-#GaB-KmC<+5IV z46Hi)w>L9oddUKwspj+5#{(?Gn1Q04PDeVkyCqspeWO_t_zIao;LbRlbWgO6$ip9t ztyB17))1p48%(em4Gj)j?@YXf12T!zY6XtR@n9VcLU8X2_s$-q;hQ&aqzZle{WA(N ziAa-G)s=;jt!X1#)r9$cC|f&&@yGQNiHL~QHb0m2)ypnBt%Xud|C-Fs(0%7&+^dEH zyf`YaiU1cR8LKJ#oMbLr%3Bxk+*Ik5Pt;FmmBqD|Iu=5=vsKo|IF+yCAAc$J&eVrJ z-|H%7O?g9XHRd!vI44;ej?*KZ<%B|&thcm4Y4bXSgQb{5+TsnjQn=&}ov&(=zK#4N zptqhreY#F$X=0*2>Y~rU#pQfLZrOZA$q*k5&SvAVf5_)XD4BGc>uz*&8MPbv{RJZL zo-M*Lne<>s*bnta;E9r0N_0KW6n#-@2u!LOtPA0K!QZe4X$7F-&5un|B@Nk;lvoDT zJT=Sq55X3?H=jAZ)I`uKsY>lVI7Z&>Pna#Q+T#fqX^yQ9D9{z zH6`)6p8qr+r%b(GB|_^KFc@XMzgtBMMH+dECPy7W*h(~z@MRa6hIF=^i!Q+!1gZsL z3C|2=>vg6M!$fD2NLb_5!}1|WGT6TMRILo_+W=5{UoGLPn&I z;kyQh{nhQf`HkLS7N1G)8T zO4zv-nP6JnHa@kO!uk=d33kB$Di=D14tCAczGg9kuWY_}4Od1o#O!R4O4Tybe(k8e zp5;os0j=ku?I{!7W%L;@-YMFbw$JK%Sm<`A80usmbA#jI5NhJ?@(uqk zzY`J9yKaHQmM5)?gh`i8C2yxxCU@vwV;Pd7rbcKo%_xaYzPsrfg>kLLRWVSBP+Zmd zuscMof6pT^P>d%E^Tkvnw}Ss`QWJU6j4mx{ow(WB+D;wT$TY#Vx)L-{=V+CBUWoD6 z-~8q7g*Y|N);vePCLuPA@_qnI75p0B5y z>;R1>LCzYs$^krtAG^xPk(ALsFK32Qcuu|basmSb|73MfwOqI-8s2Ne5nmVk9f}0? z*EJhk1kEp9O^wmSyy6Mz!izKNK;Y7g*#5wAmz@2|8s0C?q1NYneUO0>TE9fW+ivC& z=2KvjLCpzk<#YFFI#7PZ|5%@9BnId{N+I+KIZ{YH8NDbw+Yc;LdWnW@r{m+}ulQVI zHd9?0fRB1LK{a(;L3`@9gM+plI(2_dUXkSKiBc>J>DtMIN_^;|e9$$Odu0-inDa{# zf@<%PWL1pG7_=YbFeYYXe3zXz>fHEFBpYv1@Jgw>Qsn7dkMfs!+f(M}oVir`jFrk+ zvu9$l7V2c8{Lb8xK1r#m&{i)5X*vAmo|XGcNLmKuUU8~S;Bs2!>bIPLE}e_q)Nwe! zLj=a*ZEpX^>8{^J8$Y`Ae*A?l^GEFFa~<2`xw91zxlvXm;`%5@X=^r!{cKLr{n>{^ zLrFThZ1= zT){}IjTUf&g*CF8>JAPnq4Mp6gE=_>#`Da@iaFwVQD7PH_EevYt$xl9 zs$wrBD+d3~OReNo$rvxBX{XW<>)+Et0&7Q-f`Ufv`+EVKb#}}xl z><@pNg_>0W`5uC;k}uKG(T&$Tg$uRTAUwkYXa$Tv)vP6#U3wsZ6A}`>OqXaT^SjqC zDPe%ZHM>oJ{PWv6j*$*OvgM)j^Eor~}F)9rD z<2H(R=-(2{ABFe*D)&=02aG?=#l;0Ugqr}0&q`2N9uEQx)^hso7i2gG!0}5WWjNpY z3vfSzX;`q%GpQw)2RT;Srz0bH)wE;U@N*M5pwTWx;?Apwzj!ZPtWTNiG4+Tc6k-2$xOG}#Rbjj%ayhc1XxS9W+ zF8sw82051X_4R+O|HBs^$b1#%AX@tKUxqv z(UtpUyA)oKq^520pvUa|OfZS9nsp3d+SXT3?LPf_5wwO@{|H|*G3Xs8G(w}kx$^`# z65O@UEUxjtz*-C*+lv=3Ryy&ui=Lx3r0#<(m3z}h>HOWFE<#Jin355s-^IU- zl@^(?e|?YhZ!ThdghDB9tv*p5SfZRb{WvSnu2MF5TO@!EU2}qPTTNM>f%p=;K;j z?={^*Jd8JJ!Fw;tUxu#AXHRvrviwwiqQCv>btYawbqO#RV*>xUTV#n;F;UnA8Blsv zJo*n_FXw!XrS>uR-|R>GdMuvP?UG6RvK`-~fkIo?TcNeWl1n{F0VWyZ4g~i6OitL# zv$Zo9g-Yvdn{bF2JJrgyg#Cab_dMl#;A*MSNguo;lP?mQNTE)9kU{#k&X2yQ&ZMNI z>27^(4H^oqrW?3!uu zU1c9HC~#Z*7t_}7B|#(SCwVEtin zHJhuVNw#L`{Fn%#i5h zo?Z49&7ssW?yiNd<0BXhJ|KKKft?O>NP}cI%jaX8wXSaFR#vx`>pmOYbFus)rucB+ z6&e^J#%oPvjYgnC)rZJaodj(i2J@W;jgtj4dKr%4?x^#wGj`yu%1wD*YV?fee_~5e zeWC7+W!B*(Hj}=wzrvBM%H&ZG3 z_zRhdh{Ll2AAk;1rItk+%VT5hcegk1WGYs!KwR~(O4|1TG(yHlCnr)L3lX z-5i!S3IbxpFFI2gNn)vF$KrT_4^b|Tj4r?4pAWLS3YgIZZHmMwg`fhxxyb`joX*nq zp(Sfd4yEP!oqx&lk7@<=A9}KWmtLZM^N*Nq`y>18Zs2*tsnUcI7wYMCVvnO2q@aMSU+jtdg7PW ze^4oYKVNB#lPj0@Ff+x*A0(*2?YO{3q4q6JOcVP6KH{xTbSzpk3!{uay;U+ssdt5ar$}_Kg_y+9E1NwAo_mg z^Djy&D(ACFl{)J+@uosh)+zk9_o`C7>1;~F&e0LL0KY&Rh131ouBnh59Q3Z_+$D|7 zyDv%8)6?7T_6-dQdG4m# zsv3liXk?GU+ZTW|HQl1EqOOjM@h<_tH}ejxLP`!}^0u}t4^1E-;mu~t4Y&$Hn2Rn_ zZ?c=0o9hoK(qE};0i5i}-oXLX4__Eyws|Mlbvw7nho|5U_z)DL$L!abR^7 zf|g1wWY*~~f>X0JTqZsBX3dbYUF*4++NGK(5#Yf~-kzd*$(|o?60ujO#*?IF@?fBps}V*`G8O9juDHi1U~4aL$`)*Xw%S+a1CcEnkpA=98sZq%ilYj-}TduPhaAvH6q!srO=)}c^L*YYM071H#stfsDi!iZ?)uo z_wUs_Zv^X)2)J_$W6)WTzj_O(*Net83NzineY40Uc(*F#*bDJij`EBHUZ(f9rkycO z7f8_#B%7ZiD-aoDPqcw}I$Usne?J>MLocsKT5iXk^%L8xox$4&vteOjMYas_r=u0t z!&-9~_X?xw3ER`Br*5~KheusXYS51yAgk^d(eC(Spg0siH9X|uJ9Y&O) z2T|X3o^P2kPO{sok6>w^?biTHH}9n;1!FP8Jy@iF^8UFBYH9#}1lp(9xj+pm&BNv7 zzZSa!n!aXdinu28~CqC1n(^sBRTxzoUT%e8RI zyEsuVQfF9S1FZMlHNNU@HuDk}dA54o{QE1&X;^`(G8NgpL;cfF-8=(+7<-qPAaa%X zNU~xLFDd&H?(fW8-3rVj?KdM9_y-4eV3AKCs_8A`wF^;f4rJ0Agj?)5uNyP26m&hm z{5uy{&NWJvTEiR)W27MU*T6;)rl-JWo?iy8h1Xm4JKyjfP|maZ!aMkHMCwSma1coCE?$(6-Pi1rtV=)tI6C;6BriX1I@3OCes|`tJcEd;L9?8xf+eed z_N1OzlT*YQhn$)z?EBkU-H%}U-BLYN64u#o=73)nHEC7wUGg$G2$B;kW`7PScu7C&B(iiqAnT)ik2}fPrL9VzNH6xWA+-_h5X^%5wWVH^pLh zVC5=!HaxD>n=OVw`r~31n9(g!QyOAX^pr~7beKgCVF!+wDIt9F!KP6@BV*O-3D&!| zLV~T|CE18uPH>*Axg0_P+`vMWC?qq&vvIdb^>n;4hpRuRODb_actU!7hu$u5Z@@hG zd2y%4sCNTBRX)2jtGO3g$49F>hylyTLN^mvN@J&Zsv|0s5E(B3+D^5T7&=1)}%iSraB%oyhs_D*HUH=tNL+ zP-Ma~Dw{{dD=MH03Er7dGJ(Ed5_Q$y2Y*^mNJ?6RU7bE8(?HN?hs(Lwhbq`RDmn8xT!=Tr0$ois#T3ezqahYT zLnj%y$!v5}uTYXRX{OFDu39{f8Cp`)7?Y|uISvf(Ef<>LtAOl(_jFc^+U+X<>7AM!{fRbcc|~!{^yUskp)cPpJN`rb&Y| z>i@T?_Fob+alL(32IYbOI_W8+0ZGp@?7-{8SKRFET>~MfdjpY?k$*sW3=d_Txpk%H*5kM|)oFu6kuJp^+(*05J(z zTI4s>RA8w+j1G{6g+fxDzr81KZ}UN_7^^+Jd+h0cuLol^Zwa-Twp`yRJ6IjA-6yuyn!GnM1E)VH#N3aVGN8U}U8WKa7=sBhf{I3H15 z4GgTiGubm$+FYz)ui-ffCtM77Rlm6`PwWpKY=PMWt`^oN|Hg9~E3*p-)Q7^y^%?M? zwsv3`yXSE5s(2808z^7qg~~}v_kbIP;tUF) zcl^f=d9a8{B@Iato^U1JU6#i=_b%(uWQuA0Hn` zpN>|88K<&k0d<#l9Com?(@(Lj`wWAcJ2Iv7wts`}eCxEt5Ho6KO|UN-L9$^0)`~wh z!XyU|p@!~@@sp8w3+#s_?P#z627WXp4hPJC`1P4`@T}!tLr0G%3n1z zX_5iD|07n`c8*l|Eb(nk%jG6P3+|2J(8j+ard*0oI-eOa9lPdO5zqpz(ZXY);kn9F znKGK2GEa^NteYhJ1`BQ<$k$KI-Q)x1D#1UtRgUmk(sXZ0>Dlj1N=*MYq1c4sAqf9h z)uVaUzUQ-z&B^+Q=0Dkt)|W?LnveV#e>yh@O0ZjM+AYagwnV>MQiCCIsc874PI1P6 zL;^k;m!3s6Q9DAd4|{cfR@6IaJlnUt6_Uw!EM4#-snmDOdif9Rxgax%9ZMUyrDGe= z23Cs<6HVvE#+3cw@4sA)U!kFi^j|VZ@F+mau0X429JQ*8F;>B0v=sqkqCxU&Mbb!54>H{S76_3gG`9FYr z3G@xSEFEx4t9EHqb`_fnTkU0~dYN=Pd=82PZQt&7TB+8m>jyc zBmBuW%wS4pa!b7rUDfPPNlWF3AJsZIs#T2&Soi3-tn>5p!Kn?`qy9r^w2zkW3U@rT zTyef$(I<^vWyd96N)7ObBEdv^RjVUmq~To!n$xOg4h%8LzjvSM`tz!OQ~tHG{kp|# z_Z2OxtJ6$n!ToB)i>`r0x2hQ!zO^Q#A;dC>O$f+1vxVBo%{0&EFTe}~Mi^KZ7@Q6m zbM6E-{rDb5wiFy}R*@hu-6xn6aMhzEa+^$O>ol-K>H=BbQrUV3qiLs&qYh{tfHK83 z-z<9ayrd1um;yZleQpupfwOH?{twNG4IfCP4Vv+;{Hb>&&x>|F0waP$TCAyeHdC%p zi?euSKztulam2~nhlCst{9<`T%R+cp&yH@R$D-w+}@XhvY1naDdv9LZLPe{;6*Y)eCkI{C8 zxCDmMo?fs2Nd0qDkZ!>gl<`)7i4QnMr<90b9!r+m#=WpV|KR$m2wi5nRJ%ouKS32O zCpVW1Q~^K?=)Ae$=;y|R5O$^Ja85KDh?bS{?ftUhdEm0ax$XU$jgl>{t$K<$>*njSz)C(hzGJzSa;OQwK zxabW5A+^>>GGKcT#Sm`$g1sLZP^jVg;qvhBU;eY@*;pKQ;W+ZJkR8g%Mt>d-2ItiP z%ut#Ctxc4C5~{gU-VYxufD7Wa~%&%d-95iN&oHV>0& z&pcU(RT1vB#T3Bp*y@RVgO1A^PQ=r7b-FoQZB97Md-@c3hCWCbaZLwcCmKkgEBnS2 z?Z&&RKM8<6ONrR&*Ws;`9U?tiPRnHBei_9lD+GVVTv5Y#GQLQpF~>D*_7iz6K`YS5 zx`RJa(=^XvO-AC7uI0B^o-A+V>wSjGGBj=k3aJ5P{T~OYxtSk0Km@N|6=|e^@DOB% z&*9wN-CuE9eFf!H8vtG4F)N*4PiuRo03Jy((dsumq7aC!AwnX4po5Ho2R$+gO-5-) zP*A+Z%$KlfaKkE39o|3r0xIZw1})D!5m19N707dn-``bUe3=u%3wnRIT*-`(9n2s@ z!A)8`RP`QQ&O&3tEqTp$2|3WV814pL5tUypyzz+ISz{8dI?2yhrGI@{}bAvD(3vT!NJ@(ww5)_FK8g1K6YO7!2bmpg!h;j=}W)}1oK98I!BGzXgyb<6aX z&Hpzv^-|Mcb197gQR48Lt|-GI6YvT7`#VdzuaTa29y*&*J_=S zg(g=H*YmwE<2f=?)NSn}%AsSN?sXbEpSG z+ZTw(g3LxxI%{hr8N12$o}`U(rrBK1+}(x70$q1GoV&Q#w&V^pMsmPsI(n!m>T?0 z9ks_Lil<37c(M3X-d^uF0>|IG@4EH=-hEe?Hc!9xaGe)qiF}1q>}=A-Q5(;*4}=mf zly-q)eS8cJaBAmqWBn~5eb}) zA5~RV8QzAjuCBeOAb%Gd-k&K$(CH=YY{1~!;X;wCIL&HUxs57&j#=z^L^0C~tK9fd;+0_Zf=Ud5aU zgfbN#?s|*YadCJ6*usqy5r;uf-}cXzLaOUQUD2ArWgCXmMy$$Ay*=&4vgdu&?r+eH z6-S3HJsSuJPtRv5xKfCECqF48OpNYn7~D_P!OnAJ_(Np!-9DyBkiepQ{4-8vac;bm z(96%VTA;-xscbrlQ*Js@5U@J@w$YBGs9}#UZ_E9!E-b`2R9By}M?Li;y^1T9>KYwg zk5xtKc$%hoIkAIG7fL*jr@w*G`t!(jvX~{MEuehu0PC_X{-+(=q0Yp|HweTmNaz?6 z4Z*kq-FUFpl{THfe8>{vep`KSa=j=~R1*7TH5C$eQM^}c_2#{AlTi+(T$!2=xm6Gy zsHnUGkp{{AWjAj2GWgVcB?K&ofyOH*p?BJ!mfFJxU6ONy?V!bS%ra>wCuTGG@^1pV(|EIn0%(+lE@FfAL58n&$Ki?$p*X1HA5hnWD zt6ymuz1YL~N&+^S=I%91=vR{}WxQxZqRF?seh|J~Bh2=&Zyy7lh;ulFr`w;zqi4GL zysCck_kQp@L(9)1w>O@u%!?h%FbS>O7J*?1@ky+7&E0u}yhm=l{qD=_DZtvOGk*&- z`G5O116t!ir`s1x)U|R6T##A1-wPZ?-@huNZqdZ>tiqcFq_C_V>?DSN*dId2n1LA(u96`S^;t<5q^9Ok{mb+|tmEx&U6^JUvY8~971yZ1;* Z`-J%|Pq50tmnOh{5R(-x5!Uhk{{Wz2DFpxk literal 0 HcmV?d00001 diff --git a/proposed/2022/package-status-indicators.md b/proposed/2022/package-status-indicators.md new file mode 100644 index 0000000000..3bc4b44b00 --- /dev/null +++ b/proposed/2022/package-status-indicators.md @@ -0,0 +1,120 @@ +# Title + +- [Jon Douglas](https://github.com/JonDouglas), [Tim Heuer](https://github.com/timheuer), McKenna Barlow +- Start Date (2022-05-26) +- [#11547](https://github.com/NuGet/Home/issues/11547) + +## Summary + + +Providing developers important information about their package dependencies is one of NuGet's top priorities to secure development environments and encourage the ecosystem to shift left. While NuGet currently provides important information regarding security vulnerabilities, deprecations, and outdated packages in the NuGet package manager inside Visual Studio, there is an opportunity to provide this data in a more common and visible location inside of the solution explorer in Visual Studio, also known as the [common project system](https://github.com/dotnet/project-system). + +This proposal introduces package affordances in the solution explorer to help developers take regular action on their dependencies. + +## Motivation + + +An experience in which developers can quickly glance at the various nodes in the solution explorer (dependencies, packages) to understand if there is an issue that needs their attention can assist them in making quicker resolutions to common problems like security vulnerabilities, deprecated packages, and outdated dependencies. + +According to GitHub's "Securing the world's software" report in 2020, there is a 59% chance of getting a security alert in the next year on any active repository with supported package ecosystems including NuGet. Developers today frequent the use of open source dependencies in active public repositories of .NET totaling 90%. In many ecosystems, 80% or more of the application's code comes from dependencies in the respective package ecosystem. + +When a security vulnerability is disclosed, it is important that it is addressed as soon as possible to [protect against potential cyberattacks](https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/21/fact-sheet-act-now-to-protect-against-potential-cyberattacks/). + +While majority of software vulnerabilities are mistakes, there is an increasingly amount of malicious attacks throughout them. Of a given sample of over 500 advisories across all package ecosystems, up to 17% of the advisories are related to explicit malicious behavior including popular attack vectors and attack tactics that can lead to significant disruption or loss of some kind. + +Currently a vulnerability takes approximately 4.4 weeks for the community to identify and release a fix for a vulnerability. It then takes 10 weeks to alert on the vulnerability of a security update to when a fix is applied. The fix will take one week to resolve. We want to reduce the total time that a developer is aware of a security update and for them to remediate it. + +To take regular action, we want to ensure that dependencies are checked for vulnerabilities, deprecations, and outdated statuses regularly and can be remediated within Visual Studio to keep codebases current. + +**Further reading:** https://octoverse.github.com/static/github-octoverse-2020-security-report.pdf + +One of the top themes from both the NuGet (Visual Studio) and NuGet.org surveys include "warnings for known package security vulnerabilities and suggested fixes" and "deprecation and vulnerability indicators" averaging 18 points being spent on the feature areas out of 100 total points (7,403pts over 418 responses and 4,405pts 247 responses respectfully). These are two of the top areas that developers would love improvements to. We have confidence that security is on top of developer's minds and they would like to see these experiences in more locations. + +## Explanation + +### Functional explanation + + + + +When a developer is working within Visual Studio, they may regularly check their "Dependencies" node within the solution explorer. When expanded, a "Packages" node is available to show the hierarchy of top-level and transitive packages included in a project. + +NuGet uses three main words to describe these status of a package, the TL;DR are: + +- **Deprecated** - Please don't use this for a disclosed reason and please use a suggested alternative(if any). +- **Vulnerable** - Please don't use this due to a known vulnerability and update/replace/remove/do nothing accordingly. +- **Outdated** - Please consider using a newer version. + +Building upon Tim's initial mockup, there should be a UI affordance that demonstrates the truth of each package's status in the solution explorer representing these three words. + +![](../../meta/resources/PackageStatusIndicators/package-status-indicators.png) + +For the sake of not annoying developers, we should only bubble up a warning affordance to the top-level node (Packages and Dependencies) if there is a known top-level vulnerability or deprecated package in their package graph. + +Outdated packages would still show the indicators if the packages node is expanded however. + +Currently, NuGet only uses two icons to display status indicators: + +- A warning triangle (vulnerability and deprecation). +![](../../meta/resources/PackageStatusIndicators/StatusWarning.png) +- An up arrow (outdated). +![](../../meta/resources/PackageStatusIndicators/StatusUpdateAvailable.png) + +Hovering over the package and icon will display the respective information for the status. + +- Deprecated - "This package has been deprecated as it is ." +- Vulnerable - "This package has at least one vulnerability with severity." +- Outdated - "This package has version available. + +When right clicking a package, a developer should be able to get to the "Manager NuGet Packages..." context menu action like they can with the "Packages" and "Dependencies" nodes. + +Because this feature may need some experimentation to get the right signal from the noise and the potential for exponential transitive-level vulnerabilities, developers will need a way to opt-out from the experience as a whole, and options to opt-in to varying levels of information. + +This may need to include a new options panel inside the `Projects and Solutions > SDK-Style Projects` regarding the Package Settings where there's a top-level checkbox for the feature, and either a drop-down indicating a package status level or multiple checkboxes for each status mentioned above. + + + + + +## Drawbacks + + +While developers continue to seek this information in more locations, it can also be quite a bit of noise towards the general development experience. Developers tend to compare visual issues in the solution explorer akin to ["DLL Hell"](https://en.wikipedia.org/wiki/DLL_Hell) which we would like to avoid the perception as much as possible while providing valuable information about dependencies. + +This feature can potentially collide with existing experiences in which package dependencies may not exist on disk and/or assets file are incorrect and require a restore to resolve. There can also be false positives/negatives with the current state of the project system and the need to reload projects to refresh the package status in realtime. + +## Rationale and alternatives + + + + + +- [Dependabot](https://github.com/dependabot) provides vulnerability information at the repository level through PRs. +- NuGet.org, dotnet CLI, and NuGet Package Manager inside Visual Studio provide much of this functionality already, but they are multiple clicks and commands away from developers seeing them. + +## Prior Art + + + + + +- NuGet provides status indicators in the NuGet Package manager experience in Visual Studio. +- Visual Studio for Mac provides "outdated" status indicators in the solution explorer. + +## Stakeholders + +- NuGet +- .NET Project System +- Visual Studio (.NET Tooling) + +## Unresolved Questions + + + + +- Should NuGet consider a third icon metaphor for vulnerabilities? Previously we were not successful in doing so, but we can reconsider. + +## Future Possibilities + + +- In the future, we hope to streamline context menu actions to resolve individual package issues with a single click without having to open the NuGet Package Manager. From a8a8db87bb222f5f33bb799c9d2aa1b87d0600f2 Mon Sep 17 00:00:00 2001 From: Jon Douglas Date: Thu, 26 May 2022 13:18:00 -0500 Subject: [PATCH 2/3] Syntax fix --- proposed/2022/package-status-indicators.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/proposed/2022/package-status-indicators.md b/proposed/2022/package-status-indicators.md index 3bc4b44b00..aa479e56ef 100644 --- a/proposed/2022/package-status-indicators.md +++ b/proposed/2022/package-status-indicators.md @@ -62,9 +62,9 @@ Currently, NuGet only uses two icons to display status indicators: Hovering over the package and icon will display the respective information for the status. -- Deprecated - "This package has been deprecated as it is ." -- Vulnerable - "This package has at least one vulnerability with severity." -- Outdated - "This package has version available. +- Deprecated - "This package has been deprecated as it is ``." +- Vulnerable - "This package has at least one vulnerability with `` severity." +- Outdated - "This package has version `` available. When right clicking a package, a developer should be able to get to the "Manager NuGet Packages..." context menu action like they can with the "Packages" and "Dependencies" nodes. From f117be27b8b21a4094fcc6ea62a233bbe15b3dc0 Mon Sep 17 00:00:00 2001 From: Jon Douglas Date: Thu, 7 Jul 2022 09:16:11 -0500 Subject: [PATCH 3/3] Update title --- proposed/2022/package-status-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proposed/2022/package-status-indicators.md b/proposed/2022/package-status-indicators.md index aa479e56ef..2ffdf7b1c0 100644 --- a/proposed/2022/package-status-indicators.md +++ b/proposed/2022/package-status-indicators.md @@ -1,4 +1,4 @@ -# Title +# Package Status Indicators - [Jon Douglas](https://github.com/JonDouglas), [Tim Heuer](https://github.com/timheuer), McKenna Barlow - Start Date (2022-05-26)