Gentoo Archives: gentoo-dev

From: "Michał Górny" <mgorny@g.o>
To: gentoo-dev@l.g.o
Subject: [gentoo-dev] [RFC] Removing separate "security supported" arch list
Date: Thu, 21 Oct 2021 08:05:35
1 Hello,
3 Splitting from the discussion in [1] (moving more arhitectures to
4 ~arch), I'd like to propose that we remove the "security supported"
5 architecture list from [2] and instead level security support with
6 the general architecture support in Gentoo, e.g. by having all
7 architectures with stable profiles be "security supported".
9 Rationale:
11 1. The architecture list seems to date way back and doesn't seem to have
12 been maintained properly. According to CVS history, the last time a new
13 architecture was marked "supported" was in 2005; since then,
14 architectures were only removed. After the migration to new website,
15 the points of contact for architectures aren't even listed anymore.
16 The presence of 'ppc' on the list is doubtful at best. At the same
17 time, 'arm64' is not supported.
19 2. Keeping a separate list can cause confusion, if not make users of
20 architectures such as arm64 feel belittled. I don't really see why
21 the Security team should be overriding the overall Gentoo architecture
22 support status.
24 3. Per the policy, Security team "will not wait for a stable fix on
25 these arches before issuing the GLSA and closing the bug". The former
26 I don't have a problem with but how could you close the bug before
27 cleaning up old versions, and how would you clean up the old versions
28 when the new ones aren't stable yet everywhere?
30 4. In the end, Security team isn't really respecting this policy.
31 In the end, this leads to absurdities like GLSA being released before
32 a package is stable on amd64, and confusing the users [4].
34 While I agree we could probably establish some criteria when GLSAs
35 should be released, the current policy is incorrect and obsolete. In my
36 opinion removing the list is the first step towards cleaning stuff up.
39 [1]
40 [2]
41 [3]
42 [4]
44 --
45 Best regards,
46 Michał Górny