Re: [gentoo-project] Council meeting 2015-01-13: call for agenda items

[William Hubbs]

On Wed, Jan 07, 2015 at 12:45:07PM -0500, Rich Freeman wrote:
> On Wed, Jan 7, 2015 at 11:30 AM, William Hubbs <williamh@g.o> wrote:
> > That's the whole point of a last rites, to get people to step up and
> > take responsibility for packages. Also, this was cleared with the qa
> > lead before it was ever sent out.
>
> Define "take responsibility for packages."  As far as I'm aware there
> is no policy that requires maintainers to fix any upstream bug, and
> security issues are almost always upstream bugs.

You're right, there isn't a requirement for us to fix upstream bugs, and
there shouldn't be.

>
> A package with a security bug for 10 years could be perfectly
> well-maintained, with regular updates/etc as often as upstream
> publishes them.  Some software projects are fairly mature and don't
> get a lot of upstream updates, so a package might be untouched for 5
> years and have security issues and still be "well-maintained."
>
> I think the solution to this is to have the community agree on just
> what "well-maintained" actually means and documenting this as policy,
> versus just making individual judgment calls.  To be sure there will
> still be grey areas, but I think that right now the policies are too
> vague to try to enforce something like this.

Based on our conversation on irc, what about this -- this is really
about information in package.mask.

If we want to keep proprietary packages with security issues in the
tree, they should be marked as proprietary in package.mask so it is
obvious that they will never be fixed.

If there is an upstream security issue with a non-proprietary
package:

When a version or revision with the fix is available, it should be
fast stabled.  Once that is done, all older versions should be removed
if possible.  if this is not possible right away, the older versions
should go in p.mask with a removal date.

Thoughts?

William