Re: Fedora 7 and the Security Response Team
ok. Looking at the nice big pile you checked in, I think we might be
served better by folks taking particular packages. Ie, if you are
already examining a package for one CVE, it might be easier to just
keep going on that package rather than switch to another one and have
to pull up more cvs files, bugzilla, etc.
This does make sense, yes. I'm also rather sure that most of the mess I
checked in today is fixed in F7, so this would speed things up for the very
reasons you mention.
Here's the top 10 of the ones you just checked in today:=20
30 (php)
14 (helixplayer)
11 (tomcat)
8 (fedoradirectoryserver)
7 (flash-plugin)
7 (acroread)
6 (openoffice.org)
6 (kernel)
5 (xscreensaver)
5 (wu-ftpd)
Should all the flash-plugin, acroread and wu-ftpd ones be marked
"ignore" since we don't ship them? Or removed?=20
Mark them ignore, no ship. The advantage to keeping the id in the file is
that if we ever do start shipping those things, we have a list of things to
look at.
Also, what level of scrutiny should we use in checking for fixes?=20
If a changelog lists the CVE being fixed, mark it? Should we check the
patch against upstream or other distros fix?=20
If the changelog mentions it we should be inclined to believe it. If there
is a reason to cast doubt we can invest more time.
Thanks.
--
JB