Re: CRA compliance

On Thu, Oct 09, 2025 at 09:51:44AM -0300, Gustavo Padovan wrote:
> Hi Greg,
> 
> ---- On Thu, 09 Oct 2025 07:48:45 -0300 Greg KH <[email protected]> wrote ---
> 
>  > On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote: 
>  > > Hello everyone, 
>  > > 
>  > > as per the discussion of last week, 
>  > > for moving on with the CRA compliance topic. 
>  > > I propose to create a private mailing-list called 
>  > > [email protected] or [email protected] 
>  > > 
>  > > any objection ? or suggestion? 
>  >  
>  > Why is this needed?  Kernel.ci isn't going to be a "steward" of anything 
>  > used in a commercial offering, is it?  If not, what would it be for? 
> 
> Indeed. Although KernelCI offer free testing services to the community, we are not offering any
> products or commercial engagements. So we don't need CRA per se.  However, on a related front
> we are working with LF Legal to protect the testing services surfaces as stuff that KernelCI creates
> gets to run in internal networks across the industry.

That's great, but that has nothing to do with the CRA :)

> Then for security breaches in KernelCI, it would be a best practice to create kernelci-security@
> mailing list for people to report issues and for us to community privately with parties running 
> KernelCI infra too.

"communicate privately" == "private communication channels" which opens
up a TON of legal issues, as I am want to talk at length with :)

Be VERY VERY VERY careful with this, there's a whole boatload of
problems that you can get into when doing this as you are taking a
public project's communications private to specific companies/entities.

Anyway, having a security@ address is great to REPORT bugs to, but
please refrain from using that to attempt to coordinate security fix
rollouts.  That way lies a death by a thousand paper cuts and
potentially talking to government entities when you least expect it.

I can go into much more detail if people really want.

thanks,

greg k-h