About sys-kernel/hardened-sources removal

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--OjuDGoMoE9dUG4ERsgUq3QKjxma2wIOCT
Content-Type: multipart/mixed; boundary="1wJ7R1Ggx3H4ExB4dUDpjIafltTJVTiEg"
From: "Francisco Blas Izquierdo Riera (klondike)" <[email protected]>
Reply-To: [email protected]
To: [email protected], [email protected]
Cc: [email protected]
Message-ID: <6d1b5295-7cb2-37f5-aea9-4e8528f02ef1-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
Subject: About sys-kernel/hardened-sources removal
References: <c5b21580-d44b-c683-8e33-fa83f8552a1f-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
 <CAAD4mYjxdnctm4j=OcYa36sa7DbZyQ+_y=88YGs9_D10fWQxpg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
 <e5a84eed-ab8a-4877-326a-bf579155b64c-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
 <CAAD4mYj4FMN=dVTQB_4HLBstW9yGgSoYqRXnf20i3umTZJKAJw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
In-Reply-To: <CAAD4mYj4FMN=dVTQB_4HLBstW9yGgSoYqRXnf20i3umTZJKAJw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>

--1wJ7R1Ggx3H4ExB4dUDpjIafltTJVTiEg
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi!

The gentoo-dev list is not the right place to keep up discussion on why
or how the hardened-sources will be removed. Not this thread which is
about the news item.

Most packages just get masked and removed in 30 days for example without
sending a news item just an e-mail to gentoo-dev-announce. The only
reason why we are sending it is because most Gentoo Hardened users were
using the hardened-sources and deserve a heads-up as to what will happen
to them and what can they do after (as there will be no clear and simple
upgrade path with similar features).

Please do send further answers to gentoo-hardened which is the porject's
mailing list.

El 18/08/17 a las 02:59, R0b0t1 escribi=C3=B3:
> On Tue, Aug 15, 2017 at 3:03 PM, Francisco Blas Izquierdo Riera
> (klondike) <[email protected]> wrote:
>> El 15/08/17 a las 17:50, R0b0t1 escribi=C3=B3:
>>> Where was this decision discussed?
>> https://archives.gentoo.org/gentoo-hardened/message/62ebc2e26d91e8f079=
197c2c83788cff
>>
>> And many other threads in that list for example, those are just bluene=
ss
>> (the package maintainer) conclussions.
>>> The last available kernel is
>>> apparently receiving long term support, there may not be any reason t=
o
>>> remove it.
>> Not by the original upstream, and definitively not in the way in which=

>> Grsec used to (manually cherrypicking security related commits and not=

>> just those marked as security related).
>>
> All blueness says in that is that he can't personally support the
> patches. That's fine, and nobody that I know of ever expected him to
> do that. However, until they are unfixably broken, why remove them?
> Keeping them until a suitable replacement is available seems like the
> best option available.
> There's no criteria in that notice for when they would be removed.
> What criteria was used to decide they are generating useless work and
> should be removed?
They are already unfixably broken. They are affected by stack clash
(when using certain obscure configs but nonetheless). They are to all
effects unmaintained (as in upstream not publishing patches we can
provide to you). And I'd rather not look at what other fixes came in the
4.9 tree since then that I have missed.
>> Although minipli's kernel patches are good and I personally recommend
>> them, this is not something the Gentoo Hardened team will do. Also the=
y
>> probably should be renamed something else.
> I'm not sure anyone is asking the hardened team to do anything, except
> for people on the hardened team who want to remove the patches.
Then please address blueness about this (on the aforementioned thread)
and not me. I'm just the messenger who was asked to deliver the news.
>>> If it isn't broken and creating work yet I'm not sure why
>>> anyone cares.
>> Go to #gentoo-hardened and see how there is people asking about this
>> again and again :P
>>
> I'm not sure what you mean. There are people asking about it, but that
> doesn't necessarily mean they want it to happen. If something is done
> people are going to discuss it regardless of what it is.
I mean people is asking "what happens with the hardened-sources?" and we
having to answer. Now at least we have a clear path of action announced. =

> Please understand, I don't want to keep an old version of the kernel
> and associated patches around forever, just until a replacement is
> actually found.
There are a few replacements, we aren't just providing an ebuild in the
portage tree for them (except for gentoo-sources, of course).

If you want to keep the ebuilds and patches I recommend you set up a
personal overlay instead.


--1wJ7R1Ggx3H4ExB4dUDpjIafltTJVTiEg--

--OjuDGoMoE9dUG4ERsgUq3QKjxma2wIOCT
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIxBAEBCgAbBQJZmBj0FBxrbG9uZGlrZUBnZW50b28ub3JnAAoJEPS90u/o/3j5
ydkQALVt980LGBI6lKt1qf5Qcb1T2NQOVPt/n3PU8GPP4hI5MfDW2OveiBofV6mn
3R5ufnsxecKIE94vQ/Wg0Sn6/gyfjW6CbwCDizsdFAM0b4J68b3WKhbC49B0E1wV
kGl/WrVAAblMw1MZr4X1MnikWSsFy3Yl3SIJwMbcvn7vZNU9ULEKMA9+SKGyNRTd
KILY4ndubvslIfx+kO7UYkdgZEDcqUtzpRo1JRUhKUiCnfIkT6Xmo3VCf7DDnoPC
ewPjV3/TdB0Sv19ijL3k5wXo5DKvHa56hY80ROJ/lggTvOOjGAUCX2kIdScr0v4o
XriLJZdc4TqtswpohIszuPjXTyB66q/0cu+EVPRGRYECBFJYH7cfGRm4fCGFcK8W
Adoas1l6MEtVHgiPAfFDXGhNxyQcqInrITi4fgZ5nQkf1U/HVQ4ZOKxS4LlHFw41
tjw2jWabRtONsUtCh3dO8XaRDL1zUCPXMny3tmMqOjvw2hycOjqQSwCxCearga8d
mVcIHjd1kOK6R25uAmRATGJPM6wMy1o6rX3h8rgPpRcNlbySgbSSxkKimNWBecKK
5g11oSvqwlYp/xhptP6ePZZAWmIfTzg3j++X8ebA5qt1nfHqgEKt7QaHTMXV6iEx
2U0rB75RqQ1vkRJVSDQ0dicdXHoKfOekNlzchx3sE3CD9CjQ
=+T7i
-----END PGP SIGNATURE-----

--OjuDGoMoE9dUG4ERsgUq3QKjxma2wIOCT--