>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2153139. --> Reported by: [kreynen](https://www.drupal.org/user/48877) >>> <p>I was reviewing the status of distribution security messages for <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/2137095" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/2137095</a></span> when I noticed these distributions hadn't been updated since several security updates had been release, yet didn't show a warning about the potential security problem. These distributions aren't built from a .make file, but simply committed copies of Drupal core and all the modules they wanted directly to git. They should be flagged as not secure since they include versions of core &lt; 7.32 and several modules w/ security updates, but I believe the security update messages are being derived from the .make. No .make = no warning, but potentially even worse this has really created several forks of core and copies of several popular libraries.</p> <p>The following distribution projects are not sandbox repos and have a database.inc file in them that has a security issue (from @mmlhess). Those with a strikeout has had their releases pulled and maintenance status set to "Unsupported".</p> <table> <tr> <th>Distribution</th> <th>Reported Usage</th> <th>Last Updated</th> <th>Warned</th> </tr> <tr> <td><a href="https://www.drupal.org/project/1087726"><del>Arabic Installation Profile</del></a></td> <td>0</td> <td>2 years ago</td> <td></td> </tr> <tr> <td><a href="https://www.drupal.org/project/commerce_drupalgap_kickstart"><del>Commerce DrupalGap Kickstart</del></a></td> <td>1</td> <td>5 days ago</td> <td></td> </tr> <tr> <td><del><a href="https://www.drupal.org/project/dcco">DrupalCamp Colorado</a></del></td> <td>0</td> <td>4 months ago</td> <td></td> </tr> <tr> <td><a href="https://www.drupal.org/project/education_profile"><del>Education Profile</del></a></td> <td>46</td> <td>11 months ago</td> <td></td> </tr> <tr> <td><a href="https://www.drupal.org/project/fuse">Fuse Media Management</a></td> <td>8</td> <td>8 months ago</td> <td><a href="https://www.drupal.org/node/2452107">3/13/2015</a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/onepage"><del>OnePage</del></a></td> <td>29</td> <td>December 10, 2012</td> <td></td> </tr> <tr> <td><del><a href="https://www.drupal.org/project/spanish_distribution">Spanish Drupal Distribution</a></del></td> <td>5</td> <td>11 months ago</td> <td></td> </tr> <tr> <td><a href="https://www.drupal.org/project/spinetta">Spinetta</a></td> <td>4</td> <td>May 8, 2014</td> <td><a href="https://www.drupal.org/node/2452117">3/13/2015</a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_blog_starter"><del>TB Blog Starter</del></a></td> <td>318</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_events_starter"><del>TB Events Starter</del></a></td> <td>260</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_hadelis_starter"><del>TB Hadelis Starter</del></a></td> <td>466</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_methys_starter"><del>TB Methys Starter</del></a></td> <td>568</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_mollise_starter"><del>TB Mollise Starter</del></a></td> <td>548</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_neris_starter"><del>TB Neris Starter</del></a></td> <td>283</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_palicico_starter"><del>TB Palicico Starter</del></a></td> <td>118</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_purity_starter"><del>TB Purity Starter</del></a></td> <td>470</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_rave_starter"><del>TB Rave Starter</del></a></td> <td>804</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_simply_starter"><del>TB Simply Starter</del></a></td> <td>134</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tb_sirate_starter"><del>TB Sirate Starter</del></a></td> <td>2,503</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/2153271">December 9, 2013 </a></td> </tr> <tr> <td><a href="https://www.drupal.org/project/tr_kurulum"><del>tr_kurulum</del></a></td> <td>12</td> <td>1 year ago</td> <td><a href="https://www.drupal.org/node/1969292">April 12, 2013</a></td> </tr> <tr> <td><del><a href="https://www.drupal.org/project/xeditor">xEditor 2.0</a></del></td> <td>10</td> <td>1 month ago</td> <td></td> </tr> <tr> <td><a href="https://www.drupal.org/project/zircon_profile"><del>Zircon Profile</del></a></td> <td>706</td> <td>11 months ago</td> <td></td> </tr> </table> <p>As discussed in <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/infrastructure/issues/2385919" title="Status: Closed (fixed)">#2385919: Unpublish all 7.x distributions packaged with &lt; 7.32</a></span>, because the Security Team has the authority to define the specifics of their policies and procedures within the limits of their charter, changing their policy for distributions to include distributions with &lt; 1.0 release would give them the authority to unpublish the releases of all distributions that include core. </p> <p>It should actually be much easier to unpublish the non-make distributions because they also violate the <a href="https://www.drupal.org/git-repository-usage-policy">Git Usage Policy</a>. All of these violate "do not branch/fork Drupal modules/themes". Many of them also violate "DO NOT include code from a non-Drupal project in the repository." </p>