On Tuesday 11 May 2010 18:51:08 Kevin Fenzi wrote:
On Tue, 11 May 2010 15:37:51 +0200
Jaroslav Reznik <jreznik(a)redhat.com> wrote:
> On Tuesday 11 May 2010 13:08:53 Rahul Sundaram wrote:
> > On 05/11/2010 03:43 PM, Daniel P. Berrange wrote:
> > > Do we have a security team who evaluate security issues that are
> > > filed against any package, and who have the privileges to
> > > immediately fix the CVE should the maintainer not be responsive
> > > enough wrt the severity of the security problem ? We shouldn't
> > > have security fixes blocked on the unreponsive maintainer
> > > process. Proven packagers obviously have suitable CVS commit
> > > privileges to make the changes, but do any of them actively
> > > monitor for security issues & address them ?
> > Yes. Security team did monitor and filed the security issue but they
> > don't do commits and builds and there is no team outside of them
> > taking care of these issues. It would be great to take care of
> > this.
> Would be great to have similar team - I've already did update for
> them as provenpackager (unmaintained orphaned package -
> mod_auth_shadow) but I wasn't sure about my responsibilities for this
> update. Some clarification would be great (I'm not talking about
> another policy just recommended practice).
We do have:
Ok, thanks! That was what I was looking for. I wasn't sure what are my
I would love to have a provenpackager security team that helps apply
security fixes in a timely manner.
As I said - I've already helped security team, so count me in too. It does not
have to be special provensecuritypackagers team but more likely just a list of
people who are willing to help with security issues, security people know them
and thus they can be in touch when it's needed.
Would be great to CC some people from security response team (I'm not sure
about interconnection between RH & Fedora people there, I'll try to poke
Jaroslav Řezník <jreznik(a)redhat.com>
Software Engineer - Base Operating Systems Brno
Office: +420 532 294 275
Mobile: +420 602 797 774
Red Hat, Inc. http://cz.redhat.com/