Re: [gentoo-dev] GLEP #14: security updates based on GLSA

[Karsten Schulz]

Am Samstag, 23. August 2003 07:58 schrieb Marius Mauch:
> Well, I've taken that from the existing GLSA format, it is currently
> not used by my code. I've no real opinion on that, someone from the
> security team (aliz, solar ?) should decide that.

I would really like to hear from the security people what they think.

> > communication works (Who creates and checks GLSAs, which public
> > keys are used, a.s.o.)
>
> Well, I think that's outside of the scope of this GLEP.

ack.

> I don't like the idea of GLSAs being used for that, a simple status
> update email on gentoo-security should do the job (again, that's
> outside the scope of this GLEP).

As I understand GLSAs (Gentoo Linux Security Announcements), they should 
be used to announce security related information. I cannot find a 
source, where they are defined to deliver fixes in any case. Again, we 
need information from the Gentoo security experts to make this point 
clear, I think.

> The DTD does not require the <fixed> tag to contain a <version> tag,
> so the special value none is not necessary.

ok, I see!

Karsten



--
gentoo-dev@g.o mailing list