Re: [gentoo-dev] GLEP 14 follow-up / security project

[Grant Goodyear]

I'm glad to see this project underway.  I do have a couple of questions,
though.

> Security bugs should be kept in bugzilla,

What's the rationale for keeping GLSA's in bugzilla, since bugzilla is
going to have to be hacked to make it work?

> The actual filing and editing of these bugs should be done with a new
> interface that is specially designed for security bugs and GLSA
> information. Once a security bug is marked as fixed a GLSA generation
> script is run that generates the GLSA, GPG-signs it (depending on
> policy) and distributes it on mailing lists, http- and rsync-servers.

Where is this script run? If it's on a gentoo server, then I don't
really like the idea of the script signing the GLSA. Perhaps I'm just
being paranoid, but I would really prefer the signing to be performed by
the user issuing the GLSA. If, on the other hand, there is a GLSA tool
that devs can run on their own machines that assists the dev in creating
the GLSA, then signs the GLSA and uploads it to the appropriate
location, that would be just fine with me.

> The update script then can take the GLSAs from /usr/portage/glsa or the
> http repository (to avoid unneeded syncs just to get the GLSA).

Drobbins has said that he would prefer the update script to be
incorporated into emerge as soon as possible.  I get the impression from
Carpaski that we can, indeed, do that.

Nice job!
-g2boojum-
-- 
Grant Goodyear <g2boojum@g.o>