Re: [gentoo-dev] Server / security thing

[Evan Read]

On Sat, 7 Sep 2002 04:57, Tom Prado wrote:
> On Fri, 6 Sep 2002, Chris Sykes wrote:
> > On Wed, Sep 04, 2002 at 11:05:40PM +0300, Moilanen Mikko Antero wrote:
> > > Hi
> > >
> > > Would it be good idea to make additional cammand "emerge security" to
> > > check and upgrade any security things like now "emerge system" upgrades
> > > some standard system things?
> > >
> > > This would definetly be good for people who maintain servers or for
> > > people who maintain workstations or this would just be *good* for
> > > people.
> >
> > I agree that this would be useful functionality.  I think that the best
> > way to implement something like this is _not_ to label security fix
> > ebuilds as such, but to flag the ebuilds that are vunerable.
> >
> > e.g. (off the top of my head)
> >
> > For each package create a file that lists the ebuild versions that were
> > found to have security issues e.g.
> > /usr/portage/catagory/package/security
> >
> > Using a method like this an 'emerge security' could check all installed
> > packages against the versions in the security files and update them if
> > needed.
> >
> > All this would mean more work for the poor souls maintaining the portage
> > tree though.
> >
> > --
> > Chris Sykes
>
> Either this or have a /usr/portage/profiles/package.security file that has
> a list of minimum package versions to use.  This file can be modified when
> there is a security announcement.  I.e. for the latest gaim security
>
> announcement, a line can be added to it as such:
> >=net-im/gaim-0.59.1
>
> emerge security would check this file against all installed packages to
> see if any need updating.  It'd be up to whomever provides to new ebuild
> to update the security file as well.
>

Ok, I finally see where people are going with this.  I do not see why a 
separate "security" package is neccessary. Having a "release + major fixes + 
security" set of packages should be built into emerge.

There has been talk about "KEYWORDS".  Couldn't packages on the day of the 1.4 
release be tagged "release" and updates to the "release" set be tagged to 
"updates" or "security".  This information could be part of a 
/usr/portage/profiles/package.updates1.4 that could be brought down as part 
of an emerge update or something.

People that want the latest and greatest could change a configuration line in 
rc.conf to allow it to happen (by default, emerge will track 
release+security).

Or ask mention it in the install docs (Workstations will want to enable 
"latest" packages).

Just for thought.

Evan.