Re: [gentoo-dev] [RFC] A new GLSA schema

[Michał Górny]

On Wed, 2022-11-09 at 20:27 -0600, John Helmert III wrote:
> The first GLSA in glsa.git is GLSA-200310-03, the third GLSA of
> October 2003. It used roughly the same format of the GLSAs we release
> today, in 2022, making that format almost as old as me.
>
> Somewhere along the way, it started to become necessary to target
> multiple version ranges within the same package. The GLSA format
> isn't capable of expressing this. Thus, I propose a new format (an
> example of which I've attached inline below), with the following
> changes from the old format:
>
>  - Rework affected to use XML-ified logical operators to specify the
>    affected versions, and *don't* use different fields to specify
>    vulnerable and unaffected versions. Instead, only list vulnerable
>    versions, unaffected versions are implicit.

Does that imply op="" will now be limited to the standard ebuild
operators?  Perhaps it'd be cleaner to take a step further and remove
the attribute in favor of going 100% ebuild syntax (yeah, escaping is
gonna suck there).

>
>  - Drop synopsis and description fields. These fields contain the same
>    information and will be superceded by the existing impact field.

Well, I'm not saying "no" but it feels a bit weird reading a GLSA that
doesn't say a word what the problem is but specifies impact.

BTW have you considered switching to JSON or TOML?  ;-)


-- 
Best regards,
Michał Górny