[gentoo-dev] RFC: GLSA-2, a new DTD for GLSAs

[Robert Buchholz]

Hello,

the Security Team would like to create a new DTD for our GLSAs. GLSAs 
are distributed via our web site and the tree. Their format is defined 
by a DTD.

When the format was initially defined in 2004, some use cases were 
considered that never got implemented or used. Other use cases only 
came up later. For this reason, we want to update the GLSA for the 
needs of 2009. Since this includes changes that make existing GLSAs 
invalid we are going to introduce a new DTD called glsa-2.dtd.

I would like to announce the changes we want to introduce. If you have 
any feedback, please speak up. This can include feature requests. After 
this discussion, we would like to freeze the DTD and ask all consumers 
of GLSA XML files (such as package managers) to implement said changes. 
The first GLSA using the new DTD will be at the earliest six weeks 
after the DTD was frozen. Once the new GLSA format is in use, we are 
going to convert some or all of the existing GLSAs to use the format.

Find the existing DTD here:
http://dev.gentoo.org/~rbu/glsa-2/glsa.dtd

The new DTD here:
http://dev.gentoo.org/~rbu/glsa-2/glsa-2.dtd

And a diff between them here:
http://dev.gentoo.org/~rbu/glsa-2/glsa-2.dtd.diff

Here's a list of changes:

(-) Dropping of the product type. GLSAs will be used solely to announce
    security issues in the Portage Tree. The "infrastructure" 
    and "informational" product type are not needed and the type 
    attribute will be dropped altogether.
(-) Dropping of service tag. Same rationale as above, if we
    drop "infrastructure", we do not need the service tag.
(-) Drop the 'name' attribute to unaffected. This is not implemented in 
    glsa-check or Portage 2.2 and it was never part of our Policy to mix 
    GLSAs with package moves or similar.
(+) SLOT support. An implied attribute 'slot' to the 'vulnerable' 
    and 'unaffected' tag will be introduced. This limits the scope of 
    the range specifiers to ebuilds in the specified slot. The default 
    is '*' meaning all slots.  [1]
(+) Addition of a 'count' attribute to the 'revised' tag. We stop 
    formatting revision dates as 'May 26, 2009: 03' and use
    '<revised count="3">2009-05-26</revised>' instead.
(*) UTF-8 support. We would like to release GLSAs containing UTF-8
    characters in places where they make sense (that is, not package
    names, version information, etc.). Please check whether your tools 
    support this.

A GLSA XML file containing said changes, including UTF-8 characters, is 
up here:
http://dev.gentoo.org/~rbu/glsa-2/glsa-200012-34.txt



Robert

[1] This does not allow for undefined situations if you employ the 
following algorithm: An ebuild is vulnerable if falls into any of the 
ranges specified by the 'vulnerable' tags unless it also falls into any 
of the ranges specified by the 'unaffected' tags.