Re: [gentoo-dev] GLEP 14 follow-up / security project

[Marius Mauch]

On 09/23/03  Grant Goodyear wrote:

> I'm glad to see this project underway.  I do have a couple of
> questions, though.
>
> > Security bugs should be kept in bugzilla,
>
> What's the rationale for keeping GLSA's in bugzilla, since bugzilla is
> going to have to be hacked to make it work?

As other people are also against this we should drop it. I just picked
that up from the previous discussion in #gentoo-security. So we make a
separate tracking system, not sure if it will be easier or harder to do,
but definitely a cleaner approach.

> > The actual filing and editing of these bugs should be done with a
> > new interface that is specially designed for security bugs and GLSA
> > information. Once a security bug is marked as fixed a GLSA
> > generation script is run that generates the GLSA, GPG-signs it
> > (depending on policy) and distributes it on mailing lists, http- and
> > rsync-servers.
>
> Where is this script run? If it's on a gentoo server, then I don't
> really like the idea of the script signing the GLSA. Perhaps I'm just
> being paranoid, but I would really prefer the signing to be performed
> by the user issuing the GLSA. If, on the other hand, there is a GLSA
> tool that devs can run on their own machines that assists the dev in
> creating the GLSA, then signs the GLSA and uploads it to the
> appropriate location, that would be just fine with me.

This should be decided by the security project, there are other people
who can comment/decide that better than me.

> > The update script then can take the GLSAs from /usr/portage/glsa or
> > the http repository (to avoid unneeded syncs just to get the GLSA).
>
> Drobbins has said that he would prefer the update script to be
> incorporated into emerge as soon as possible.  I get the impression
> from Carpaski that we can, indeed, do that.

I'm not against portage integration, but I'd rather want to finish and
test the script and the GLSA framework before we put it into emerge. We
wouldn't do anyone a favor if we put unfinished stuff in portage. The
integration isn't that difficult, just adding some files to the portage
tarball and changing a few calls to use portage functions instead of
emerge / portageq.

> Nice job!
> -g2boojum-

Thanks

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.