Re: [gentoo-dev] why is the security team running around p.masking packages

[Anthony G. Basile]

On 7/6/16 7:30 AM, Kristian Fiskerstrand wrote:
> On 07/06/2016 01:15 PM, Anthony G. Basile wrote:
>> I'm also disappointed that no one else in the security team has
>> recommended any internal policing in response to this.  I maintain that
>> forced p.masking and version bumping should not be done by the security
>> team but passed to QA for review.  Only QA is mandated with such powers
>> by GLEP 48.
>
> We're discussing this in another thread already (i.e possibly a GLEP for
> Security project), I'm discussing that as a member of security.
>
> As for any internal policing outside of public policies it is done
> within the team and not on a public mailing list. The relevant public
> policies are:
> https://wiki.gentoo.org/wiki/Project:Security/GLSA_Coordinator_Guide
> https://www.gentoo.org/support/security/vulnerability-treatment-policy.html
>
> But I agree these needs reviewing and codification in the form of a
> GLEP, but as said in the other thread, need to discuss that within the
> project first (I'm not lead, but have requested a team meeting already)
>


I like this.  So let's make sure we have clear expectations and an
escalation process with review before we pull the p.mask with 30 days
till poof.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@g.o
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA