Re: [gentoo-project] Call for agenda items - Council meeting 2016-12-11

[Aaron Bauman]

On 12/01/2016 07:50 AM, Rich Freeman wrote:
> In two weeks from now, the council will meet again. This is the time
> to raise and prepare items that the council should put on the agenda
> to discuss or vote on.
>
> Please respond to this message with agenda items. Do not hesitate to
> repeat your agenda item here with a pointer if you previously
> suggested one (since the last meeting).
>
> The agenda for the meeting will be sent out on Monday, 2016-12-05.
>
> Please reply to the gentoo-project list.
>
I would like the council to consider dropping IA-64 and SPARC from the
supported list of stable architectures to increase the security posture
of the tree.

Rationale:

1. Both architectures are behind in stabilization bugs tree wide [1] and
do not currently have leads elected.  While other architectures may rank
up with IA-64 and SPARC in outstanding stable bugs their commitment to
security is seen in the rest of this rationale.

2. The lack of stabilization is leaving the tree in an undesirable and
vulnerable state for all arches.  This is directly related to
dependencies and proper cleanup of vulnerable ebuilds, which cannot
occur until all previously stable arches have been stabilized.  The
current list of outstanding security bugs pending stabilization for
IA-64 [2] (50 bugs) and SPARC [3] (57 bugs) are indicative of this
issue.  This is the focal point of why these should be considered for
inclusion as unstable architectures.

3. Both architectures are impeding the release of security advisories in
a timely manner following cleanup [4].  The inability to properly inform
our users of such vulnerabilities, in a timely manner, is contradicting
our commitment to security [5].

4. ppc & ppc64 have progressively worsened as well concerning security
stabilization, but only recently.  These may be considered in a future
council meeting or proactively considered now.

Thank you,
Aaron Bauman

[1]: https://download.sumptuouscapital.com/gentoo/wg-stable/main.pdf

[2]:
https://bugs.gentoo.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&component=Vulnerabilities&email1=ia64%40gentoo.org&emailcc1=1&emailtype1=substring&list_id=3364582&product=Gentoo%20Security&query_format=advanced&resolution=---

[3]:
https://bugs.gentoo.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&component=Vulnerabilities&email1=sparc%40gentoo.org&emailcc1=1&emailtype1=substring&list_id=3364584&product=Gentoo%20Security&query_format=advanced&resolution=---
 
[4]:
https://www.gentoo.org/support/security/vulnerability-treatment-policy.html

[5]: https://www.gentoo.org/support/security/