Gentoo Archives: gentoo-security

From: Paige Thompson <erratic@×××××.ws>
To: gentoo-security@l.g.o
Subject: Re: [gentoo-security] Security project meeting summary
Date: Tue, 22 Jul 2008 18:01:54
Message-Id: 5061b39c0807221101s60d8f697h98ca6518cbdd2014@mail.gmail.com
In Reply to: Re: [gentoo-security] Security project meeting summary by Robert Buchholz
1 misfit[1004]:~% sudo emerge -uva nethack
2 Password:
3
4 These are the packages that would be merged, in order:
5
6 Calculating dependencies |
7 !!! All ebuilds that could satisfy "games-roguelike/nethack" have been
8 masked.
9 !!! One of the following masked packages is required to complete your
10 request:
11 - games-roguelike/nethack-3.4.3-r1 (masked by: package.mask)
12 /usr/portage/profiles/package.mask:
13 # Tavis Ormandy <taviso@g.o> (21 Mar 2006)
14 # masked pending unresolved security issues #125902
15
16
17 For more information, see MASKED PACKAGES section in the emerge man page or
18 refer to the Gentoo Handbook.
19
20 misfit[1005]:~%
21
22
23
24
25 On Tue, Jul 22, 2008 at 3:42 AM, Robert Buchholz <rbu@g.o> wrote:
26
27 > On Monday 21 July 2008, Aleksey V Lazar wrote:
28 > > Hello. Would it be reasonable to suggest adding a ~security (or
29 > > something like it) flag to denote packages masked for security
30 > > reasons?
31 >
32 > Hi Aleksey,
33 >
34 > since entries package.mask only contain free text description as an
35 > additional information, such a feature would require the package
36 > manager to decide which entries are security maskings, and which are
37 > feature maskings. While that could be done using
38 > restrictions/conventions within the text, I am sure our package manager
39 > developers would disagree with such a design. A "package.security.mask"
40 > file might be more appropriate for that.
41 >
42 > My question now is, why would you want such a thing? Masked packages all
43 > have different reasons to be there, and you should decide to use one on
44 > a case-by-case basis.
45 >
46 > Regards,
47 > Robert
48 >
49 >

Replies

Subject Author
Re: [gentoo-security] Security project meeting summary Robert Buchholz <rbu@g.o>