Gentoo Weekly Newsletter 14 February 2005

-------------------------------------------------------------------------=
--
Gentoo Weekly Newsletter
http://www.gentoo.org/news/en/gwn/current.xml
This is the Gentoo Weekly Newsletter for the week of 14 February 2005.
-------------------------------------------------------------------------=
--
=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
1. Gentoo News
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Gentoo Forums platform and software switch
------------------------------------------
 =20
As anticipated in a Future zone[1] article three weeks ago, the Gentoo=20
Forums[2] have switched to a new hardware platform and an upgraded versio=
n=20
of phpBB, now running on a clean codebase, normalizing all the patches=20
that had been applied to the old version, and more feature-rich than the=20
release that was powering the Forums before. Among the embellishments are=
=20
better language packs for the non-English forums, new URI styles with=20
absolute links that enable search engine spiders to index the entire=20
Forum, and a few things of lesser visibility, like the moderators' new=20
ability to join threads -- displacing posts from threads where they're ou=
t=20
of context to a more appropriate location was never possible before. A fe=
w=20
glitches aside, the changeover went so smoothly that none of the users=20
realized it until it was all over and done. Congratulations to Christian=20
Hartmann[3] and Lance Albertson[4] for a flawless migration!=20
 1. http://www.gentoo.org/news/en/gwn/20050124-newsletter.xml#doc_chap2
 2. http://forums.gentoo.org
 3. [email protected]
 4. [email protected]
   =20
Gentoo event calender for February/March 2005
---------------------------------------------
 =20
Busy days for Gentoo evangelists: Their schedule has never been so packed=
=20
with shows, conferences and presentations as over the next four weeks.=20
Here's a list of the upcoming events, with a last reminder for tomorrow's=
=20
LWE in Boston at the top.=20
=20
 * Linux World Expo[5] - 15-18 February in Boston, MA: Hynes Convention=20
Center =20
 * FOSDEM[6] - 26 and 27 February in Brussels, Belgium: Universit=C3=A9 L=
ibre=20
de Bruxelles =20
 * CPLUG Security Conference[7] - 5 March in Grantham, PA: Messiah Colleg=
e=20
=20
 * Chemnitzer Linux-Tage[8] - 5 and 6 March in Chemnitz, Germany:=20
Technische Universit=C3=A4t =20
 * Gentoo UK Conference[9] - 12 March in Manchester, UK: University of=20
Salford =20
 5. http://www.linuxworldexpo.com/live/12/events/12BOS05A/
 6. http://dev.gentoo.org/~pylon/fosdem-2005.html
 7. http://cplug.net/conference
 8. http://dev.gentoo.org/~dertobi123/clt2005
 9. http://dev.gentoo.org/~stuart/2005/
=20
Note:  Links point to official event websites or -- if available -- Gento=
o=20
developer pages organizing our own presence.=20
   =20
Gentoo Linux Security Team -- Interview with Thierry Carrez
-----------------------------------------------------------
 =20
If you have a habit of watching the pattern of security issues and=20
responses in the Linux world, you've probably noticed that Gentoo's alert=
s=20
and responses to those issues tend to follow rapidly on the heels of=20
initial discovery. In fact, Gentoo Linux Security Announcements (GLSAs)=20
are a frequently cited resource for security notifications and fix status=
=20
even outside the Gentoo community. This reputiation of responsiveness is =
a=20
remarkable feat for a community which does not have a commercial arm=20
supporting a dedicated security response center.
=20
Thierry Carrez[10] (koon), one of the Operational Managers for Gentoo's=20
Security Team[11], was kind enough to take a few minutes to explain some=20
of the practices that have allowed the team to be so efficient in=20
identifying and responding to security issues.
 10. [email protected]
 11. http://www.gentoo.org/proj/en/security/index.xml
=20
Could you give us a rough overview of the process involved in identifying=
=20
and fixing security flaws? What steps are involved? Who performs them?=20
What tools are used?
=20
We follow the Vulnerability Treatment Policy[12] to handle security bugs.=
=20
In brief, public vulnerabilities get submitted by users, our security=20
scouts or the security developers, whoever finds it first. Sometimes we=20
get notified by confidential channels (the vendor-sec list or direct=20
contact from the upstream developers or auditors). Then the security bug=20
progresses through upstream status (where we wait for a fix from upstream=
=20
maintainers); ebuild status (where we call the Gentoo maintainer for the=20
package and ask for a fixed ebuild); stable status, where we ask all=20
security-supported arches to test and mark the fixed package stable; and=20
finally to glsa status where we issue a GLSA if necessary. Sometimes we=20
get stuck at one of those intermediate statuses and have to work out a=20
patch ourselves. Sometimes we don't find a solution and we mask the=20
package because it's a security risk to leave it in the tree without a fi=
x.
 12. http://www.gentoo.org/security/en/vulnerability-policy.xml
=20
Security bug handling is mostly calling the right people at the right tim=
e=20
to try to get the ball rolling at all times. This task is performed by th=
e=20
GLSA coordinators, and it's not automated. We rely heavily on the other=20
Gentoo developers (package maintainers and arch teams) to do the patching=
=20
and testing.
=20
Where do you find out about security flaws? Mailing lists? Alerts? Do we=20
do testing ourselves?
=20
We rely on our user base to submit as many public vulnerabilities as they=
=20
can. The security team tries to get all those that go unnoticed. Security=
=20
flaws come from public mailing-lists like BugTraq or Full-Disclosure, and=
=20
also upstream security advisories and other distribution advisories. We=20
are more and more accepted as part of the general Linux security communit=
y=20
and therefore we get notice of some vulnerabilities before they go public=
.=20
To contribute back we have recently set up a Security Audit subproject to=
=20
find vulnerabilities by ourselves, and our package maintainers also find =
a=20
lot of vulnerabilities in their testing.
=20
When a flaw is identified, how is it documented?
=20
Most of the time we just copy the public advisory information, and then=20
proceed in verifying that it applies to Gentoo Linux, and rate its=20
severity. This severity seeds priorities, as we try to respect the delays=
=20
indicated in the Vulnerability Treatment Policy.
=20
Is there a formal process where the resolution of a flaw is assigned to=20
someone? How are priorities set? How is the fix documented and tested?
=20
Each GLSA Coordinator can take a bug and be tasked to ensure the ball=20
keeps rolling on this bug at all times. But if a bug gets stuck, every=20
security developer can intervene to unstick it. Priorities are set by=20
severities, following the rules described in the Vulnerability Treatment=20
Policy.
=20
When a fix is available, how is it documented? Who does the GLSA? How are=
=20
GLSA's transmitted? How are they archived or stored?
=20
We document the fix in a GLSA draft, which must get at least two positive=
=20
peer-reviews before getting released. We use a tool called GLSAMaker to=20
help in ensuring consistency between all GLSAs. The GLSA is written by th=
e=20
GLSA Coordinator or sometimes by one of our Security Apprentices (GLSA=20
coordinators in training). GLSAs are sent by mail to gentoo-announce and=20
other security lists, automatically appear in a live RDF feed[13] and on=20
the Gentoo Security page[14]. Finally, they get copied by forum moderator=
s=20
to appear as forum announcements. GLSA XML sources are part of the portag=
e=20
tree (in metadata/glsa) and get synced on all user boxes, to enable the=20
use of the (for the moment still experimental) glsa-check tool (which is=20
part of the gentoolkit package).
 13. http://www.gentoo.org/rdf/en/glsa-index.rdf
 14. http://security.gentoo.org
=20
Who are the upstream consumers of GLSA's? Other than Gentoo users, are=20
there other organizations that are alerted?
=20
We warn linuxsecurity.com so that they include GLSA in their advisories=20
page[15]. The MITRE CVE dictionary[16] also includes GLSA references.
 15. http://www.linuxsecurity.com/content/blogcategory/0/76/
 16. http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=3DGENTOO
=20
Are there any automated tools or scripts that the team uses to manage=20
these jobs?
=20
We use GLSAMaker, a tool written by Tim Yamin[17] (plasmaroo), to help in=
=20
writing GLSA XML source and the text counterpart.
 17. [email protected]
=20
What's the status of "emerge security" functionality to identify and fix=20
security issues using portage?
=20
"Emerge security" functionality is currently under testing with the=20
"glsa-check" tool, part of the gentoolkit package. It allows us to=20
identify which GLSAs affect your system and to automatically fix the=20
vulnerable packages. When this is ready, the portage tool team will=20
integrate this into mainline tools like emerge. Users are encouraged to=20
use the latest glsa-check and report any oddities using bugzilla[18].
 18. http://bugs.gentoo.org
=20
Where can users get information about the security team?
=20
Our main page is the Gentoo Security portal at security.gentoo.org[19]. I=
t=20
contains all the pointers to our policy documents, the latest GLSAs and=20
lots of useful information. People that would like to join the Gentoo=20
Security project should read the Security project webpage[20], and in=20
particular the GLSA Coordinators guide[21] and the Security padawans=20
page[22] to get a feel of what we need.
 19. http://security.gentoo.org
 20. http://www.gentoo.org/proj/en/security/
 21. http://www.gentoo.org/security/en/coordinator_guide.xml
 22. http://www.gentoo.org/security/en/padawans.xml
=20
What are some of the initiatives the security team have undertaken=20
recently?
=20
In the last year, we put procedures in place so that all unwritten rules=20
followed by the team have a reference policy document. We also put=20
together a new team that will ensure that we keep a consistent security=20
watch at all times.
=20
What did we forget to ask that we should know about?
=20
Maybe our management structure. Kurt Lieber[23] (klieber) is our strategi=
c=20
manager, Sune Kloppenborg Jeppesen[24] (jaervosz) and myself are the=20
operational managers.
 23. [email protected]
 24. [email protected]
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
2. Future Zone
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Open-Xchange in Gentoo Linux
----------------------------
 =20
Open-Xchange (OX)[25] is the open-source groupware server on which=20
Novell's SuSE Linux Openexchange Server (SLOX)[26] is based. Open-Xchange=
=20
was closed source until 30 August 2004 when it was released under the GNU=
=20
Public License. OX leverages popular open-source server technology by=20
integrating existing projects (SMTP, IMAP, LDAP, Apache, Tomcat, and=20
PostgreSQL) to deliver a powerful messaging and collaboration environment=
.=20
Some features of interest include e-mail, project management, a versionin=
g=20
document store, shared calendaring, and a knowledge base. It can be=20
accessed via both a web interface or through fat clients such as=20
Evolution, the Mozilla suite (Thunderbird and Sunbird) and any other thir=
d=20
party application that supports WebDAV. Currently, Open-Xchange is in=20
development with a slated stable release (v0.8) in March 2005. If you wan=
t=20
to see what OX is like before undertaking the somewhat daunting install,=20
you can try it out using the online demo[27].=20
 25. http://www.open-xchange.org
 26. http://www.novell.com/products/openexchange
 27. http://mirror.open-xchange.org/ox/EN/community/online.htm
=20
Installation and support
=20
There are currently two ways to install OX in Gentoo Linux: using the=20
ebuild from Bugzilla[28] (not currently in the Portage tree), or manually=
=20
installing it. A Wiki page[29] explains the installation using the ebuild=
,=20
but for most of the necessary steps to get OX successfully running, an=20
additional manual installation HOWTO[30] covers the prerequisite=20
configurations as well as extending and enhancing Open-Xchange. For=20
Gentoo-specific questions a Gentoo Forum thread[31] with several hundred=20
posts has most of the answers that are available so far.=20
 28. http://bugs.gentoo.org/show_bug.cgi?id=3D62197
 29. http://gentoo-wiki.com/HOWTO_Open-Xchange
 30. http://www.mikefetherston.ca/OX/
 31. http://forums.gentoo.org/viewtopic-t-233291.html
=20
If you are not already familiar with the servers that OX uses be prepared=
=20
for a steep learning curve and to do a lot of reading. A majority of the=20
problems experienced so far involve LDAP configuration, Apache/Tomcat=20
integration, and SASL authentication. All of the servers that OX relies o=
n=20
need to be properly configured and working before you can proceed with th=
e=20
actual Open-Xchange install.=20
=20
Note:  Author Mike Fetherston was a dedicated Slackware user who turned t=
o=20
Gentoo in early 2004. Upon Netline's release of SuSE's SLOX server under=20
the GPL he covered his initial installation experiences and tremendous=20
feedback from the Gentoo user community in a document of currently more=20
than 40 pages.=20
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
3. Gentoo security
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
OpenMotif: Multiple vulnerabilities in libXpm
---------------------------------------------
 =20
Multiple vulnerabilities have been discovered in libXpm, which is include=
d=20
in OpenMotif, that can potentially lead to remote code execution. (NB:=20
This is the same vulnerability that was fixed in xorg-x11 last November)=20
=20
For more information, please see the GLSA Announcement[32]=20
 32. http://www.gentoo.org/security/en/glsa/glsa-200502-07.xml
   =20
PostgreSQL: Local privilege escalation
--------------------------------------
 =20
The PostgreSQL server can be tricked by a local attacker to execute=20
arbitrary code.=20
=20
For more information, please see the GLSA Announcement[33]=20
 33. http://www.gentoo.org/security/en/glsa/glsa-200502-08.xml
   =20
Python: Arbitrary code execution through SimpleXMLRPCServer
-----------------------------------------------------------
 =20
Python-based XML-RPC servers may be vulnerable to remote execution of=20
arbitrary code.=20
=20
For more information, please see the GLSA Announcement[34]=20
 34. http://www.gentoo.org/security/en/glsa/glsa-200502-09.xml
   =20
pdftohtml: Vulnerabilities in included Xpdf
-------------------------------------------
 =20
pdftohtml includes vulnerable Xpdf code to handle PDF files, making it=20
vulnerable to execution of arbitrary code upon converting a malicious PDF=
=20
file.=20
=20
For more information, please see the GLSA Announcement[35]=20
 35. http://www.gentoo.org/security/en/glsa/glsa-200502-10.xml
   =20
Mailman: Directory traversal vulnerability
------------------------------------------
 =20
Mailman fails to properly sanitize input, leading to information=20
disclosure.=20
=20
For more information, please see the GLSA Announcement[36]=20
 36. http://www.gentoo.org/security/en/glsa/glsa-200502-11.xml
   =20
Webmin: Information leak in Gentoo binary package
-------------------------------------------------
 =20
Portage-built Webmin binary packages accidentally include a file=20
containing the local encrypted root password.=20
=20
For more information, please see the GLSA Announcement[37]=20
 37. http://www.gentoo.org/security/en/glsa/glsa-200502-12.xml
   =20
Perl: Vulnerabilities in perl-suid wrapper
------------------------------------------
 =20
Vulnerabilities leading to file overwriting and code execution with=20
elevated privileges have been discovered in the perl-suid wrapper.=20
=20
For more information, please see the GLSA Announcement[38]=20
 38. http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml
   =20
mod_python: Publisher Handler vulnerability
-------------------------------------------
 =20
mod_python contains a vulnerability in the Publisher Handler potentially=20
leading to information disclosure.=20
=20
For more information, please see the GLSA Announcement[39]=20
 39. http://www.gentoo.org/security/en/glsa/glsa-200502-14.xml
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
4. Heard in the community
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
gentoo-dev
----------
 =20
Remove no [insert feature here] USE-flags from the tree
=20
Michiel de Bruijne [40] writes: "There are quite a few ebuilds in the tre=
e=20
that make use of a no [insert feature here] USE-flag. So basically by=20
disabling the USE-flag you get more features. Pulling in extra=20
dependencies by disabling the USE-flag is a possibility. This has some=20
nasty side effects ..." The following discussion shows quite well why=20
these USE-flags are not good.=20
 40. [email protected]
=20
 * Remove no [insert feature here] USE-flags from the tree[41] =20
 41. http://thread.gmane.org/gmane.linux.gentoo.devel/25197
=20
Automatic stabilization of packages
=20
Approximately every 6 months the same discussion comes up: How can the=20
packages in portage be kept up to date? The naive approach would be=20
automatic stabilization after a certain period of time. This thread shows=
=20
why for the most part that is not a good idea ...=20
=20
 * Automatic stabilization of packages[42]=20
 42. http://thread.gmane.org/gmane.linux.gentoo.devel/25254
=20
Closing or resolving bugs, which is it?
=20
Marius Mauch[43] writes: "I noticed a new trend lately introduced by a fe=
w=20
new devs: changing bug status from RESOLVED to CLOSED. Personally I just=20
find it annoying and completely useless. Can we agree to not do that=20
unless there is a technical reason? Don't see any benefit in this, just=20
means that closed bugs are now split between two "categories" with no=20
actual difference."=20
 43. [email protected]
=20
 * should we close bugs?[44] =20
 44. http://thread.gmane.org/gmane.linux.gentoo.devel/25168
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
5. Gentoo International
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
USA: Gentoo Bugday event at Oregon State University LUG
-------------------------------------------------------
 =20
Gentoo Bugdays[45] are regularly held every first Saturday of each month,=
=20
with developers and users everywhere gathering on IRC and skimming=20
Gentoo's bugzilla for anything that looks like it needs fixing. On 5=20
February, the Linux User Group of Oregon State University took the=20
opportunity and turned the virtual event into a real one[46]. Twelve OSLU=
G=20
members met at Weatherford Hall, the OSU residential college building.=20
Aided by a precompiled list of bugs prepared by Gentoo's Bugday organizer=
s=20
for this occasion, they kept squashing bugs from 9:00 to 16:00, with the=20
official IRC channel #gentoo-bugs being projected overhead, and assorted=20
computers scattered around the classroom, each with a determined Gentoo=20
bug hunter in front of the screen.=20
 45. http://bugday.gentoo.org/
 46. http://lug.oregonstate.edu/wiki/index.cgi?GentooBugDay
=20
Figure 5.1: The Klendathu, OR bughunt: Deedra Waters, Dunbar (background)=
=20
and Micheal Clay
http://www.gentoo.org/images/gwn/20050214_oslug.jpg
=20
Note:  More photos are available at the OSLUG website.=20
   =20
Germany: Storage tool release for Gentoo Linux
----------------------------------------------
 =20
Commercial releases of Linux applications with official support outside=20
the RedHat/SuSE/Mandrake realm are scarce and far between. A German=20
company, SEP AG[47], has now announced the availability of their storage=20
management product "SEP sesam" for Gentoo Linux. "We're traditionally tie=
d=20
to SuSE Linux, but had Gentoo on our radar ever since we watched the=20
impressive installation Lars Weiler[48] did on an HP Proliant cluster at=20
last year's LinuxTag in Karlsruhe," recalls SEP's sales manager Johann=20
Krahfuss (cf. GWN report 28 June 2004[49]). "So when our first customers=20
demanded an adaptation of SEP sesam to Gentoo Linux, it didn't exactly=20
take us by surprise." The German federal research institution Fraunhofer=20
Gesellschaft[50] were the first to request a SEP sesam installation insid=
e=20
a Gentoo Linux environment, "and since we didn't encounter any problems=20
whatsoever, we feel it's ready for official release," says Krahfuss. A=20
30-day-test version (including support) can be downloaded from the=20
corporate website's download section. SEP sesam is designed for data=20
storage management in heterogenous networks, including Linux, BSD,=20
Solaris, TRU/64, OpenVMS, Windows and Mac OS X. The company will be=20
present at next week's CRN Storage Solution Days 2005[51] in Neuss (link=20
in German only).=20
 47. http://www.sep.de
 48. [email protected]
 49. http://www.gentoo.org/news/en/gwn/20040628-newsletter.xml
 50. http://www.fhg.de
 51. http://www.solutiondays.de/storage
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
6. Gentoo in the press
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Newsforge (8 and 9 February 2005)
---------------------------------
 =20
Newsforge published an article in two parts about using MySQL to benchmar=
k=20
OS performance[52], as analyzed and written by Tony Bourke[53]. The=20
performance check spans server operating systems Open-, Net- and FreeBSD,=
=20
Solaris 10, and Linux as platforms for MySQL database execution, and=20
"among a multitude of distributions" Gentoo was chosen for the Linux part=
=20
of the test, running both 2.4 and 2.6 kernels (gentoo-sources) on=20
ReiserFS. "With Gentoo it was also relatively easy to install NPTL for=20
2.6, which I used in the 2.6 tests," says Tony Bourke, "although they=20
didn't make any difference when compared to non-NPTL 2.6 results." While=20
the first part just explains the tools and the methodology, the actual=20
performance comparison is published in a separate article[54] - with=20
amazing results, Gentoo Linux clearly winning all individual benchmark=20
tests. Funnily enough, Gentoo's outstanding performance even triggered=20
complaints about the "unfair advantage"[55] of using a source-based,=20
possibly processor-optimized Linux distribution as a platform for the=20
comparison.=20
 52. http://software.newsforge.com/software/04/12/27/1238216.shtml
 53. http://vegan.net/tony/
 54. http://www.newsforge.com/article.pl?sid=3D04/12/27/1243207
 55.=20
http://www.newsforge.com/comments.pl?sid=3D43141&op=3D&threshold=3D0&comm=
entsort=3D0&mode=3Dthread&tid=3D152&pid=3D106968#106970
   =20
CNET (7 February 2005)
----------------------
 =20
Sun's President Jonathan Schwartz nods his head to Gentoo's OpenSolaris=20
effort in an interview published on CNET last week. While explaining the=20
OpenSolaris governance model to interviewer Stephen Shankland, he claims=20
"Solaris is now officially platform-neutral"[56] and expects "10 or more"=
=20
non-Sun OpenSolaris distributions to appear in the market.=20
 56. http://news.com.com/Suns+open-source+gamble/2008-1082_3-5564283.html
   =20
Security Focus (2 February 2005)
--------------------------------
 =20
Columnist Jason Miller says Linux kernel security handling is broken, "an=
d=20
it needs to be fixed right now." The article at securityfocus.com[57], a=20
publication mainly read by security professionals, is highly critical of=20
the way security bugs in the Linux kernel are being addressed. But the=20
author, a self-proclaimed "huge follower of BSD-based operating systems,"=
=20
has some good news, too: "Once we start looking at actual distributions o=
f=20
the Linux kernel as a complete operating system, we find some=20
distributions with official security contacts, as well as security-relate=
d=20
pages similar to those provided by the major BSD-based operating systems.=
=20
Gentoo Linux Security is a good example of that."=20
 57. http://www.securityfocus.com/columnists/296
   =20
R=C3=A9seaux & T=C3=A9l=C3=A9coms (3 February 2005, in French)
--------------------------------------------------
 =20
Directly responding to the Security Focus column by Jason Miller, the=20
French network and telco magazine looks beyond the kernel as a security=20
issue: Both flaws in individual applications not depending on the kernel,=
=20
and the distribution of security-related information are identified as=20
equally important fields of activity for the "bug hunters of open source.=
"=20
The article "Noyau Linux : Mais o=C3=B9 est la s=C3=A9curit=C3=A9 ?"[58] =
acknowledges=20
Miller's conclusion of "things changing, fast and in the right direction,=
"=20
and praises Thierry Carrez (see our interview above[59]) as an example fo=
r=20
"impressive work." With the current pace of discussion around the=20
structure of security handling and the distribution of information, it's=20
"time to show some optimism," says author Marc Olanie, pointing out that=20
it took Microsoft eighteen years to standardize their own security=20
procedures -- "or have they?"=20
 58.=20
http://www.reseaux-telecoms.com/cso_btree/05_02_03_194507_984/CSO/Newscso=
_view
 59.=20
http://www.gentoo.org/news/en/gwn/20050214-newsletter.xml#doc_chap1_sect2
   =20
Sun blogs (31 January 2005)
---------------------------
 =20
Eric Boutilier, an engineer at Sun, Inc. is gearing up for Gentoo=20
development on OpenSolaris, and posted his first attempts at familiarizin=
g=20
himself with Portage on Linux to  his blog at the Sun website[60]. While=20
his choice of installation material is peculiar - Gentoo-clone Vidalinux=20
rather than a standard install, and on a five-year-old Port=C3=A9g=C3=A9 =
laptop - he=20
quickly falls in sync with normal Portage user behaviour for lengthy=20
compiles: "Oh well. I left it happily building away and went to work."=20
 60. http://blogs.sun.com/roller/page/eric_boutilier/20050131
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
7. Bugzilla
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Summary
-------
 =20
 * Statistics=20
 * Closed bug ranking=20
 * New bug rankings=20
   =20
Statistics
----------
 =20
The Gentoo community uses Bugzilla (bugs.gentoo.org[61]) to record and=20
track bugs, notifications, suggestions and other interactions with the=20
development team. Between 06 February 2005 and 13 February 2005, activity=
=20
on the site has resulted in:=20
 61. http://bugs.gentoo.org
=20
 * 860 new bugs during this period=20
 * 699 bugs closed or resolved during this period=20
 * 37 previously closed bugs were reopened this period=20
=20
Of the 8036 currently open bugs: 102 are labeled 'blocker', 243 are=20
labeled 'critical', and 600 are labeled 'major'.=20
   =20
Closed bug rankings
-------------------
 =20
The developers and teams who have closed the most bugs during this period=
=20
are:=20
=20
 * osx porters[62], with 179 closed bugs[63] =20
 * Gentoo's Team for Core System packages[64], with 53 closed bugs[65] =20
 * Gentoo KDE team[66], with 30 closed bugs[67] =20
 * AMD64 Porting Team[68], with 24 closed bugs[69] =20
 * Gentoo Security[70], with 23 closed bugs[71] =20
 * media-video herd[72], with 19 closed bugs[73] =20
 * Gentoo Games[74], with 19 closed bugs[75] =20
 * Text-Markup Team[76], with 17 closed bugs[77] =20
 62. [email protected]
 63.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 64. [email protected]
 65.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 66. [email protected]
 67.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 68. [email protected]
 69.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 70. [email protected]
 71.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 72. [email protected]
 73.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 74. [email protected]
 75.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
 76. [email protected]
 77.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2005-02-06&chfieldto=3D2005-02-13&=
resolution=3DFIXED&[email protected]
   =20
New bug rankings
----------------
 =20
The developers and teams who have been assigned the most new bugs during=20
this period are:=20
=20
 * AMD64 Porting Team[78], with 30 new bugs[79] =20
 * Gentoo Sound Team[80], with 18 new bugs[81] =20
 * Gentoo X-windows packagers[82], with 15 new bugs[83] =20
 * Net-Mail Packages[84], with 11 new bugs[85] =20
 * Mobile Herd[86], with 11 new bugs[87] =20
 * media-video herd[88], with 11 new bugs[89] =20
 * Gentoo KDE team[90], with 10 new bugs[91] =20
 * Portage team[92], with 10 new bugs[93] =20
 78. [email protected]
 79.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 80. [email protected]
 81.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 82. [email protected]
 83.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 84. [email protected]
 85.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 86. [email protected]
 87.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 88. [email protected]
 89.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 90. [email protected]
 91.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
 92. [email protected]
 93.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2005-02-06&chf=
ieldto=3D2005-02-13&[email protected]
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
8. Tips and tricks
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Portage magic: Identify obsolete packages
-----------------------------------------
 =20
Gentoo developer Brian Harring[94] designed a clever way to identify all=20
merged versions of packages not available in Portage anymore -- both the=20
official tree and packages from PORTDIR_OVERLAY. Here is the method he=20
came up with, packing as much Python neatness as fits on a single command=
=20
line:=20
 94. [email protected]
=20
-------------------------------------------------------------------------=
--
| Code Listing 8.1:                                                      =
 |
|Python scriptlet                                                        =
 |
#1-----------------------------------------------------------------------=
--
|                                                                        =
 |
|python -c 'import portage; print [x for x in                            =
 |
portage.db["/"]["vartree"].getallcpv() \=20
|if len(portage.portdb.xmatch("match-all","=3D"+x))=3D=3D0]'             =
       |
|                                                                        =
 |
-------------------------------------------------------------------------=
--
=20
If that just went a little over your head, let's look at what exactly it=20
does. For example, if a package, say, foo-1.2.3 is merged, and that=20
version 1.2.3 is no longer in the tree, the script will point it out. A=20
simple check for packages that aren't available any longer regardless of=20
versions, would look like this:=20
=20
-------------------------------------------------------------------------=
--
| Code Listing 8.2:                                                      =
 |
|Python scriptlet                                                        =
 |
#2-----------------------------------------------------------------------=
--
|                                                                        =
 |
|python -c 'import portage; print [x for x in                            =
 |
portage.db["/"]["vartree"].getallcpv() \=20
|if len(portage.portdb.xmatch("match-all",portage.pkgsplit(x)[0]))=3D=3D0=
]'   |
|                                                                        =
 |
-------------------------------------------------------------------------=
--
=20
Finally, if you want to ignore package foo-1.2.3 even if it isn't in the=20
tree any longer, but a revision foo-1.2.3-r1 is, the following script wil=
l=20
ignore the package, only triggering on installed applications that have=20
completely vanished from Portage.=20
=20
-------------------------------------------------------------------------=
--
| Code Listing 8.3:                                                      =
 |
|Python scriptlet                                                        =
 |
#3-----------------------------------------------------------------------=
--
|                                                                        =
 |
|python -c 'import portage; print [x for x in                            =
 |
portage.db["/"]["vartree"].getallcpv() \=20
|if                                                                      =
 |
len(portage.portdb.xmatch("match-all","~"+"-".join(portage.pkgsplit(x)[:2=
])
))=3D=3D0]'
|                                                                        =
 |
-------------------------------------------------------------------------=
--
=20
Lastly, none of the above take injected packages into consideration, only=
=20
those that were installed from an available tree. Now, suppose you'd like=
=20
to ignore those, too, here's what to do:
=20
-------------------------------------------------------------------------=
--
| Code Listing 8.4:                                                      =
 |
|Python scriptlet                                                        =
 |
#4-----------------------------------------------------------------------=
--
|                                                                        =
 |
|python -c 'import portage; print [x for x in                            =
 |
portage.db["/"]["vartree"].getallcpv() \=20
|if len(portage.portdb.xmatch("match-all",portage.pkgsplit(x)[0]))=3D=3D0=
 \   |
|and not portage.db["/"]["vartree"].dbapi.isInjected(x)]'                =
 |
|                                                                        =
 |
-------------------------------------------------------------------------=
--
=20
Yes, we knew you'd like this. All of the above do work for individual=20
packages you keep in an overlay tree, for example at /usr/local/portage,=20
those are being evaluated along with packages in the official Portage=20
tree. Try it out, you can't break anything, it just notifies you about=20
whatever it finds, leaving it up to the user to decide what to do with=20
that information.=20
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
9. Moves, adds, and changes
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
 =20
Moves
-----
 =20
The following developers recently left the Gentoo team:=20
=20
 * None this week =20
   =20
Adds
----
 =20
The following developers recently joined the Gentoo Linux team:=20
=20
 * Sebastian Bergmann (sebastian) - PHP =20
   =20
Changes
-------
 =20
The following developers recently changed roles within the Gentoo Linux=20
project:
=20
 * None this week =20
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
10. Contribute to GWN
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
  =20
Interested in contributing to the Gentoo Weekly Newsletter? Send us an=20
email[95].=20
 95. [email protected]
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
11. GWN feedback
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
  =20
Please send us your feedback[96] and help make the GWN better.
 96. [email protected]
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D
12. GWN subscription information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D
  =20
To subscribe to the Gentoo Weekly Newsletter, send a blank email to=20
[email protected].=20
=20
To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to=20
[email protected] from the email address you are=20
subscribed under.=20
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
13. Other languages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
  =20
The Gentoo Weekly Newsletter is also available in the following languages=
:
=20
 * Danish[97] =20
 * Dutch[98] =20
 * English[99] =20
 * German[100] =20
 * french[101] =20
 * japanese[102] =20
 * italian[103] =20
 * polish[104] =20
 * portuguese (brazil)[105] =20
 * portuguese (portugal)[106] =20
 * russian[107] =20
 * spanish[108] =20
 * turkish[109] =20
 97. http://www.gentoo.org/news/da/gwn/gwn.xml
 98. http://www.gentoo.org/news/nl/gwn/gwn.xml
 99. http://www.gentoo.org/news/en/gwn/gwn.xml
 100. http://www.gentoo.org/news/de/gwn/gwn.xml
 101. http://www.gentoo.org/news/fr/gwn/gwn.xml
 102. http://www.gentoo.org/news/ja/gwn/gwn.xml
 103. http://www.gentoo.org/news/it/gwn/gwn.xml
 104. http://www.gentoo.org/news/pl/gwn/gwn.xml
 105. http://www.gentoo.org/news/pt_br/gwn/gwn.xml
 106. http://www.gentoo.org/news/pt/gwn/gwn.xml
 107. http://www.gentoo.org/news/ru/gwn/gwn.xml
 108. http://www.gentoo.org/news/es/gwn/gwn.xml
 109. http://www.gentoo.org/news/tr/gwn/gwn.xml
  =20
Ulrich Plate <[email protected]> - Editor
AJ Armstrong <[email protected]> - Author
Mike Fetherston <[email protected]> - Author
Patrick Lauer <[email protected]> - Author

--
[email protected] mailing list