Re: [gentoo-project] Re: [gentoo-dev-announce] call for agenda items, council meeting 8/13

[Rich Freeman]

On Mon, Jul 31, 2017 at 6:13 PM, Mike Pagano <mpagano@g.o> wrote:
>
> When the motivation for a STABLEREQ is a high severity security bug
> (e.g. root exploit), this delay in stabilization results in us having to
> keep exploitable kernels in the tree in order not to drop the latest
> stable for a specific architecture.
>
> The procedure outlined below allows for auto-stabilization of minor
> bumps by the Gentoo kernel team for any previously stabled major version
> kernel.[1]
>

I'd suggest taking it further and allowing auto-stabilization of all
point releases whether they're security releases or not.  The kernel
team doesn't do a great job of identifying security issues in the
first place, and I think the risk is pretty low here.  The kernel has
far more upstream QA than we provide and has almost zero in the way of
dependencies (toolchain bugs really are the only thing that comes to
mind).

-- 
Rich