pidgin/nest

Add extra way to report security vulnerability

2021-07-15, Sorvival
ade72caa087d
Add extra way to report security vulnerability

- Add an extra way of reporting a security vulnerability in the project. This
is done by creating a new issue in our issue tracker and ensuring that the
visibility of it is set so that only Pidgin Developers can view it.
- Fix a simple mistake in markdown link syntax in the contributing page which
links back to the Security page.
- Change hardcoded link to list of advisories to a Hugo ref link (if we ever
change the location of the advisories page this will make Hugo throw an error
since it won't be able to find the page, otherwise the link would just end up
being broken without us necessarily knowing about it.

Testing Done:
Ran `dev-server.sh` and verified content looks as intended.

Reviewed at https://reviews.imfreedom.org/r/806/
---
title: "HGKeeper and Mercurial 5.8 Issue"
date: 2021-06-08T23:29:09-05:00
---
We recently noticed an issue with version 5.8 of Mercurial after it got deployed
on [keep.imfreedom.org](https://keep.imfreedom.org/) that causes freshly cloned
repositories to be in a bad state.
As of right now we believe this is only affecting the main Pidgin repository.
Our repository has 20+ years of history and has been converted from
[CVS](https://en.wikipedia.org/wiki/Concurrent_Versions_System) to
[Subversion](https://en.wikipedia.org/wiki/Apache_Subversion) to
[Monotone](https://en.wikipedia.org/wiki/Monotone_(software)) and finally to
[Mercurial](https://en.wikipedia.org/wiki/Mercurial). Almost none of those
conversions happened without issue, some more than others. Regardless to say
our repository isn't very pristine and this is not the first time we've broken
a version control system.
We are still working with the amazing Mercurial team to figure out exactly
what's happening, but for the time being we rolled the version of Mercurial
on [keep.imfreedom.org](https://keep.imfreedom.org/) back to version 5.7.1.
We also recommend rolling back your client version back to 5.7.1 as we have
been able to reproduce the issue with the server running 5.7.1 and the client
running 5.8.
Most of the discussion around this has been in #mercurial on freenode, but
we have opened an issue on Mercurial's
[Bugzilla](https://bz.mercurial-scm.org/show_bug.cgi?id=6528) if you're
interested in keeping up to date on what's going on. We will of course post an
update here when we have everything figured out.