Re: Soliciting feedback for the GLSA-2 format

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Pi1jBTT6JiSPJGCSeEHxlWDkBGNvoMDjs
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

10.01.2014 19:02, Sascha Wolf =D0=BF=D0=B8=D1=88=D0=B5=D1=82:
> Hi,
>=20
> I  find  the  new  version of GLSA format very interesting, especially
> with the backdrop of the automated evaluation of vulnerabilities.
>=20
> Would  it  be  possible  to  specify  in  which branch of Gentoo, this
> program is usually installed? For example, "stable" or "unstable"?
>=20
> So you can better see if you are actively involved or not.
>=20

Current workflow will not be changed:

- for packages, having stable versions - new versions will be
stabilized, vulnerable versions - removed from tree. GLSA will be
released if it's necessary, AFTER stabilization will be finished for all
security supported arches.
- for packages, that never was in stable - GLSA will NOT be even drafted.=


One notable exception for 1) - we do not do GLSAs for kernel packages.

So, to conclude, we track all vulnerabilities, that are discovered in
main portage tree, but GLSAs mainly targeted for stable systems, e.g.
stable branch should not contain vulnerable software(ideally).

--=20
Best regards, Sergey Popov
Gentoo developer
Gentoo Desktop Effects project lead
Gentoo Qt project lead
Gentoo Proxy maintainers project lead


--Pi1jBTT6JiSPJGCSeEHxlWDkBGNvoMDjs
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJS1m2CAAoJECo/aRed9267EU8H/2WtuxeHTxuOgONnqhvKiqgv
1GTqqwn3I9RseNcNVxlHK/qlOPQ1ye8/orjCUL1AbrkdHLu6dOWIhuTglHEncuqd
uzNzzhadfNKdo13gexTVQGMyXfSZNRNQWbLSRAfMw2THoS9oNSw5ABBcW5VwXmB/
ZO3MNZtw2+mj5rjQjA1xgd/hrD4rLUYy4wFeRvHzgx0FnV+eUut1mXXdBKs9D2dh
7iAp4zJU0tgE6qFZN41c3bcqBtmhd5A4vnXmqc9HsCkbR4FDuOXn1TnZAk3KkmDt
GNsDXPUjmrKvKqSQ/Ftqj/R7DbYRuS0hpxP9V8qjmcQIVVw/Vo+M9wbrblVNsXs=
=UX9+
-----END PGP SIGNATURE-----

--Pi1jBTT6JiSPJGCSeEHxlWDkBGNvoMDjs--